From 87cd2f68f8890d5f6def9f61c7d5fa2b1867fa1a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 10 Sep 2026 22:35:09 +0000
Subject: [PATCH] Use uv-managed Python for the remaining workflows

benchmark, linkcheck and pypi-publish were the last users of
actions/setup-python. They get uv from setup-uv with the version pinned
by ci-constraints-requirements.txt, as ci.yml and the wheel builder
already do.

linkcheck's cache key claimed to match the docs job's, but the docs job
has run on 3.12 with an OpenSSL component in its key, and rust-cache
adds the job id anyway, so it is keyed on the runtime id alone.
pypi-publish only needs uv for `uv publish`, so it no longer sets up an
interpreter at all. The benchmark comparison script runs on the PR
venv's interpreter instead of whatever `python` is on PATH.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0116sWJmeCaubZF2aMbR4kfc
---
 .github/workflows/benchmark.yml    |  9 ++++-----
 .github/workflows/linkcheck.yml    | 13 +++++++------
 .github/workflows/pypi-publish.yml | 14 ++++++--------
 3 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 26a737179c66..74b6c0a56a17 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -43,13 +43,12 @@ jobs:
         uses: ./cryptography-base/.github/actions/fetch-vectors
 
       - name: Setup python
-        id: setup-python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
+          version-file: cryptography-pr/ci-constraints-requirements.txt
           python-version: "3.11"
+          enable-cache: false
 
-      - name: Install uv
-        run: pip install -c ./cryptography-pr/ci-constraints-requirements.txt uv
       - name: Create virtualenv (base)
         run: |
           uv venv .venv-base
@@ -67,4 +66,4 @@ jobs:
         run: .venv-pr/bin/pytest --benchmark-enable --benchmark-only ./cryptography-pr/tests/bench/ --benchmark-json=bench-pr.json --x509-limbo-root=x509-limbo/
 
       - name: Compare results
-        run: python ./cryptography-pr/.github/bin/compare_benchmarks.py bench-base.json bench-pr.json | tee -a $GITHUB_STEP_SUMMARY
+        run: .venv-pr/bin/python ./cryptography-pr/.github/bin/compare_benchmarks.py bench-base.json bench-pr.json | tee -a $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/linkcheck.yml b/.github/workflows/linkcheck.yml
index 58b4cae7d103..b588b3da1ea1 100644
--- a/.github/workflows/linkcheck.yml
+++ b/.github/workflows/linkcheck.yml
@@ -25,17 +25,18 @@ jobs:
           persist-credentials: false
       - name: Setup python
         id: setup-python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
-          python-version: 3.11
+          version-file: ci-constraints-requirements.txt
+          python-version: "3.11"
+          activate-environment: true
+          cache-dependency-glob: ci-constraints-requirements.txt
       - name: Cache rust and pip
         uses: ./.github/actions/cache
         timeout-minutes: 2
         with:
-          # This creates the same key as the docs job (as long as they have the same
-          # python version)
-          key: 3.11-${{ steps.setup-python.outputs.python-version }}
-      - run: python -m pip install -c ci-constraints-requirements.txt 'nox[uv]'
+          key: ${{ steps.setup-python.outputs.python-runtime-id }}
+      - run: uv pip install -c ci-constraints-requirements.txt 'nox[uv]'
       - name: Build nox environment
         run: |
             nox -v --install-only -s docs-linkcheck
diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
index 57b8b5130b62..d6d05ff1564a 100644
--- a/.github/workflows/pypi-publish.yml
+++ b/.github/workflows/pypi-publish.yml
@@ -42,19 +42,17 @@ jobs:
           echo "PYPI_URL=https://test.pypi.org/legacy/" >> $GITHUB_ENV
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'testpypi'
 
-      - name: Setup python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.14'
-        timeout-minutes: 3
-
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: ci-constraints-requirements.txt
           sparse-checkout-cone-mode: false
           persist-credentials: false
-
-      - run: python -m pip install -c ci-constraints-requirements.txt 'uv'
+      - name: Setup uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          version-file: ci-constraints-requirements.txt
+          enable-cache: false
+        timeout-minutes: 3
 
       - uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
         with: