[DoDiODev]

⚠️ Pre Checklist

Please complete ALL items in this checklist, and remove before submitting

• I have read through the Contributing Documentation.
• I have added relevant tests. (N/A — build change only, verified by building the images, see below)
• I have added relevant documentation. (N/A)
• I will add labels to the PR, such as pr-type/bug-fix, pr-type/feature-development, etc.
  (I can't set labels myself; suggested: pr-type/refactor, component/devops)

Summary

Both backend/Dockerfile and devops/docker/lake-builder/Dockerfile install
uv with curl -LsSf https://astral.sh/uv/install.sh | sh. That always pulls
whatever uv release is newest at build time, so two builds of the same commit
can ship different uv versions, and Dependabot cannot see or update it.

This PR copies uv from the official ghcr.io/astral-sh/uv image instead, as
recommended in the uv Docker guide:

• A named stage FROM ghcr.io/astral-sh/uv:0.13.7 as uv in each Dockerfile.
  Dependabot's docker ecosystem (already configured for /backend and
  /devops/docker/lake-builder) reads FROM lines, but not
  COPY --from=<image>, so the version is pinned through a stage.
• backend: COPY --from=uv --chown=devlake:0 /uv /uvx /app/.local/bin/ —
  same location and owner as before; placed after the existing
  chgrp/chmod so it does not add a second layer with the binaries.
• lake-builder: COPY --from=uv /uv /uvx /usr/local/bin/ — same location as before.
• The stage has no --platform, so the binaries match the target platform.

No version change in practice: 0.13.7 is the current uv release.

Note: once merged, the lake-builder image needs a new builder-v* tag to be
published.

Does this close any open issues?

N/A

Screenshots

N/A

Other Information

Validation:

• docker build --target base -t devlake-uvpin-base backend (linux/arm64): OK;
  all four Python plugins built (azuredevops, glpi, redmine, zephyr).
• docker run --rm devlake-uvpin-base uv --version: uv 0.13.7; uvx --version: uvx 0.13.7;
  /app/.local/bin/uv owned by devlake:0.
• docker run --rm -u 123456:0 -e HOME=/tmp devlake-uvpin-base sh -c 'uv venv /tmp/v --python 3.11':
  OK (arbitrary UID, as on OpenShift).
• docker build --platform linux/amd64 -t devlake-uvpin-builder devops/docker/lake-builder: OK;
  uv --version in the image: uv 0.13.7 (x86_64-unknown-linux-musl), /usr/local/bin/uv.
• CI on my fork with the lake-builder image built from this Dockerfile: 16/16 jobs green.