chore(toolchain): refresh lockfile, declare db deps, and align hooks with uv.lock

[Alberto-Codes]

The lockfile had not moved since March: google-adk sat at 1.26.0 while PyPI shipped 2.8.0, and uv-secure was failing the CI lint job on stale starlette, urllib3, and sqlparse advisories (this was the red lint check on #156). Upgrading surfaced a packaging defect: google-adk 2.x moved SQLAlchemy and aiosqlite behind its optional db extra, so this package imported sqlalchemy without declaring it and would fail at import for anyone installing against ADK 2.x. aiosqlite stayed a core ADK dependency but is declared too, since it is the driver behind our default URL. The pre-commit line also pinned ruff, uv, and uv-secure through mirrors whose versions drifted from the lockfile CI installs, the same pattern quantfit and saucier already moved away from.

• Declare sqlalchemy[asyncio]>=2.0 and aiosqlite>=0.21 as direct dependencies; uv lock --upgrade to google-adk 2.8.0, cryptography 50.0.1, ruff 0.16.5, ty 0.0.78, pytest 9.1.1, docvet 1.15.1
• Run every Python hook through uv run so pre-commit and CI share one pinned version; add pre-commit-hooks whitespace/EOF/merge-marker/large-file checks; pin the docvet and actionlint actions by SHA in CI and add yamllint + actionlint steps to the lint job
• Adopt ruff 0.16 defaults: keep E402 on, ignore RUF022 (our __all__ ordering is plain-alphabetical, enforced by test_public_api.py), allow DTZ in tests and spike scripts, let ruff format Markdown code fences; exclude the framework-generated _bmad, _bmad-output, .specify, and .claude/commands trees from ruff and from the whitespace hooks
• Move to PEP 639 license metadata (silences the uv_build classifier warning), widen uv_build to <0.13, drop the now-unused pygments uv-secure ignore, refresh the hook tables in CONTRIBUTING and the development guide

Test: pre-commit run --all-files (all 14 hooks green); uv run pytest (295 passed on google-adk 2.8.0)

---

PR Review

Checklist

• Self-reviewed my code
• Tests pass (uv run pytest)
• Lint passes (uv run ruff check .)
• Breaking changes use ! in title and BREAKING CHANGE: in body

Review Focus

• Second commit is a review follow-up. A code-reviewer agent verified the PEP 639 metadata builds correctly, that uv-secure does run under --all-files, that the 1.22.0 CI cell keeps SQLAlchemy after the downgrade, and that the BLE001 suppression is load-bearing. It found the aiosqlite rationale was wrong (only SQLAlchemy moved behind the extra), a duplicated Raises: block, and a stale docvet row; all fixed.
• Not changed on purpose: the yamllint step uses the relaxed preset without --strict, so it only fails on syntax errors. Adding --strict would currently fail on two long lines in ci.yml. Separate decision.
• Supersedes chore(toolchain): refresh lockfile, declare db deps, and align hooks with uv.lock #157, which GitHub auto-closed when its base branch (fix/adk-2x-compatibility, merged as fix(session): restore compatibility with google-adk 1.22.0 through 2.8.0 #156) was deleted. Same three commits, rebased onto main. Copilot's review of chore(toolchain): refresh lockfile, declare db deps, and align hooks with uv.lock #157 is already addressed and answered there.
• pyproject.toml dependencies: the new sqlalchemy[asyncio] and aiosqlite entries are a real fix, not housekeeping. Without them uv sync on the upgraded lock has no sqlalchemy module at all.
• Ruff 0.16 reformatted Python code fences in 11 Markdown files. Changes are whitespace and wrapping only; test_docs_examples.py still executes the getting-started snippet and passes.
• ty 0.0.78 needed a typed decrypt_dispatch dict and a # ty: ignore[invalid-method-override] on _get_schema_classes (the old # type: ignore[override] form is not honoured).
• docvet 1.15 freshness is stricter than 1.7; nine docstrings were updated to describe what the bodies now do rather than just to satisfy the hash.
• Not ported from quantfit/saucier: CodeQL workflow, pytest-randomly, file-size and doc-ref gate scripts. Each is a separate decision.

Related

• fix(session): restore compatibility with google-adk 1.22.0 through 2.8.0 #156 (merged; this branch was stacked on it)
• chore(toolchain): refresh lockfile, declare db deps, and align hooks with uv.lock #157 (auto-closed predecessor with the Copilot review thread)
• [Tech Debt] Add automated regression tests for packaging metadata invariants #61 (packaging metadata regression tests; the undeclared-dependency gap here is the kind of thing it would catch)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

🟢 Approval recommended

No functional or CI-blocking issues were identified in the reviewed changes, with only a minor docstring clarity nit suggested.

Pull request overview

This PR refreshes the Python toolchain/lockfile and aligns local/CI quality gates around uv.lock, while fixing an import-time packaging gap introduced by google-adk 2.x moving SQLAlchemy behind an optional extra.

Changes:

• Declare sqlalchemy[asyncio]>=2.0 and aiosqlite>=0.21 as direct runtime dependencies and update related docs.
• Align pre-commit and CI to run Python tooling via uv run, and add additional linting checks (yamllint/actionlint) to CI.
• Update ruff configuration and apply resulting formatting/docstring updates across code, tests, and documentation.

File summaries

File	Description
tests/unit/test_models.py	Switch test UTC handling to datetime.UTC constant usage.
tests/integration/test_docs_examples.py	Remove inline noqa in favor of config-based ignores for exec-based doc tests.
src/adk_secure_sessions/services/models.py	Normalize UTC handling to UTC constant and update related docstrings/comments.
src/adk_secure_sessions/services/encrypted_session.py	Type decrypt_dispatch, adjust imports, and document direct DB dependency rationale.
src/adk_secure_sessions/rotation.py	Clarify error semantics and document intentional broad exception handling.
scripts/spike_typedecorator.py	Keep spike script aligned with new UTC handling.
README.md	Minor formatting for getting-started snippet readability.
pyproject.toml	Add DB deps, adopt PEP 639 license metadata, update ruff config and dev tool versions.
examples/basic_usage.py	Docstring improvement and removal of now-unneeded noqa on a fixed SQL string.
docs/reference/index.md	Ruff-driven code-fence formatting/whitespace adjustments.
docs/project-overview.md	Update dependency/tooling table to reflect new direct deps and versions.
docs/index.md	Ruff-driven code-fence formatting/whitespace adjustments.
docs/how-to/key-rotation.md	Formatting alignment for code example comments.
docs/how-to/backend-authoring.md	Formatting alignment for code examples and registry snippet.
docs/getting-started.md	Formatting alignment for code examples.
docs/development-guide.md	Update hook documentation to match new uv run-based workflow.
docs/adr/ADR-001-protocol-based-interfaces.md	Minor formatting adjustment in code example.
CONTRIBUTING.md	Update hook documentation and formatting for examples.
.pre-commit-config.yaml	Move Python hooks to uv run, add pre-commit-hooks checks, and make runs consistent with CI.
.gitignore	Whitespace-only comment cleanup.
.github/workflows/ci.yml	Add yamllint/actionlint to lint job and pin docvet/actionlint actions by SHA.
.claude/rules/python.md	Align style example with double-quote formatting convention.
.claude/rules/pytest.md	Formatting alignment for examples (ruff-driven).

Review details

• Files reviewed: 21/24 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.