fix(ci): setting all the github action jobs to run on the edera runners

.dockerignore

@@ -11,3 +11,4 @@
 /matrix.json
 /docker.sh
 **/__pycache__/**
+/.venv

.github/workflows/buildenv-diff.yml

@@ -13,7 +13,9 @@ permissions:
 jobs:
   diff:
     name: package diff
-    runs-on: ubuntu-latest
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1

.github/workflows/buildenv.yml

@@ -35,7 +35,9 @@ jobs:
           - arch: arm64
             platform: linux/arm64
             runner: ubuntu-24.04-arm
-    runs-on: "${{ matrix.runner }}"
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
@@ -84,7 +86,9 @@ jobs:
   merge:
     name: merge and publish
     needs: build
-    runs-on: ubuntu-latest
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1

.github/workflows/digestabot.yml

@@ -17,7 +17,9 @@ permissions:
 jobs:
   image-update:
     name: Image digest update
-    runs-on: ubuntu-latest
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
 
     permissions:
       contents: write # to push the updates

.github/workflows/lint.yml

@@ -11,10 +11,11 @@ concurrency:
   cancel-in-progress: true
 jobs:
   format:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
     env:
       SHFMT_VERSION: "3.12.0"
-      BLACK_VERSION: "26.5.1"
       SHELLCHECK_VERSION: "0.11.0"
     steps:
       - name: Checkout
@@ -29,11 +30,10 @@ jobs:
           chmod +x "${HOME}/.local/bin/shfmt"
           curl -sSfL "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | tar -xJ -C /tmp
           install -m755 "/tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "${HOME}/.local/bin/shellcheck"
-          pipx install "black==${BLACK_VERSION}"
       - name: Show versions
         run: |
           shfmt --version
-          black --version
+          uv tool run black --version
           shellcheck --version
       - name: Check formatting
         run: ./hack/code/format.sh --check

.github/workflows/matrix.yml

@@ -19,7 +19,9 @@ concurrency:
 jobs:
   matrix:
     name: matrix
-    runs-on: ubuntu-latest
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
     steps:
     - name: Harden the runner (Audit all outbound calls)
       uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
@@ -33,7 +35,7 @@ jobs:
     - name: install dependencies
       run: ./hack/build/install-matrix-deps.sh
     - name: generate matrix
-      run: 'PATH="${HOME}/go/bin:${PATH}" ./hack/build/generate-matrix.sh "${{ inputs.spec }}"'
+      run: './hack/build/generate-matrix.sh "${{ inputs.spec }}"'
     - name: upload matrix
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
@@ -60,7 +62,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.matrix.outputs.builds) }}
-    runs-on: "${{ matrix.builds.runner }}"
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
     env:
       KERNEL_PUBLISH: "${{ inputs.publish }}"
       KERNEL_VERSION: "${{ matrix.builds.version }}"
@@ -119,7 +123,7 @@ jobs:
             echo "keeping build trees on / (${ROOT_AVAIL}K avail vs ${MNT_AVAIL}K on /mnt)"
           fi
       - name: docker setup linux-kernel-oci
-        run: sudo python3 ./hack/build/docker-setup.py
+        run: sudo uv run ./hack/build/docker-setup.py
       - name: docker setup buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: docker login ghcr.io
@@ -177,7 +181,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.matrix.outputs.merges) }}
-    runs-on: ubuntu-latest
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
     env:
       KERNEL_PUBLISH: "${{ inputs.publish }}"
       KERNEL_VERSION: "${{ matrix.merges.version }}"
@@ -198,7 +204,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: install python deps
-        run: pip3 install -r requirements.txt
+        run: uv sync
       - name: install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: docker setup buildx

.github/workflows/refresh-nvidia.yml

@@ -10,7 +10,9 @@ permissions:
 jobs:
   refresh:
     name: Open PR if NVIDIA versions changed
-    runs-on: ubuntu-latest
+    runs-on:
+      group: Self Hosted
+      labels: edera-24
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1

.gitignore

@@ -9,3 +9,4 @@
 /matrix.json
 /docker.sh
 **/__pycache__/**
+/.venv

.python-version

@@ -0,0 +1 @@
+3.14.7

hack/build/activate-env.sh

@@ -7,12 +7,11 @@ unset REAL_SCRIPT
 
 activate_env() {
 	if [ ! -d "venv" ]; then
-		python3 -m venv venv
-		pip install --upgrade pip
+		uv venv venv
 	fi
 	# shellcheck source=/dev/null # venv is created at runtime, not present at lint time
 	. venv/bin/activate
-	pip3 install -qq -r requirements.txt
+	uv sync
 }
 
 activate_env

hack/build/common.sh

@@ -77,7 +77,7 @@ if [ ! -f "${KERNEL_SRC}/Makefile" ]; then
 		rm "${KERNEL_SRC}.txz"
 	fi
 
-	python3 "hack/build/patchlist.py" "${KERNEL_VERSION}" "${KERNEL_FLAVOR}" | while read -r PATCH_NAME; do
+	uv run "hack/build/patchlist.py" "${KERNEL_VERSION}" "${KERNEL_FLAVOR}" | while read -r PATCH_NAME; do
 		cd "${KERNEL_SRC}"
 		if [ "${KERNEL_SRC_IS_TAR}" = "1" ]; then
 			patch --verbose -p1 <"${KERNEL_DIR}/${PATCH_NAME}"

hack/build/generate-docker-script.py

@@ -327,7 +327,8 @@ def docker_build(
             image_build_command, "stage=build image=%s arch=%s" % (image_root, archs[0])
         )
         record_command = [
-            "python3",
+            "uv",
+            "run",
             "hack/build/record-digest.py",
             quoted(image_root),
             quoted(metadata_file),

hack/build/generate-docker-script.sh

@@ -3,4 +3,4 @@ set -e
 
 cd "$(dirname "${0}")/../.."
 
-python3 "$(dirname "${0}")/generate-docker-script.py" "${@}"
+uv run "$(dirname "${0}")/generate-docker-script.py" "${@}"

hack/build/generate-matrix.sh

@@ -3,4 +3,4 @@ set -e
 
 cd "$(dirname "${0}")/../.."
 
-python3 "$(dirname "${0}")/generate-matrix.py" "${@}"
+uv run "$(dirname "${0}")/generate-matrix.py" "${@}"

hack/build/install-matrix-deps.sh

@@ -2,4 +2,4 @@
 set -e
 
 go install github.com/google/go-containerregistry/cmd/crane@v0.20.2
-pip3 install -r requirements.txt
+uv sync

hack/code/format.sh

@@ -22,12 +22,12 @@ if [ -n "${CHECK}" ]; then
 	# shellcheck disable=SC2086 # word-splitting the file list is intended
 	shfmt -d ${SH_FILES} || RC=1
 	# shellcheck disable=SC2086
-	black --check ${PY_FILES} || RC=1
+	uv tool run black --check ${PY_FILES} --target-version py314 || RC=1
 else
 	# shellcheck disable=SC2086
 	shfmt -w ${SH_FILES}
 	# shellcheck disable=SC2086
-	black ${PY_FILES}
+	uv tool run black ${PY_FILES} --target-version py314
 fi
 
 # The linter has no autofix, so it runs as a check in both modes.

pyproject.toml

@@ -0,0 +1,28 @@
+[project]
+name = "linux-kernel-oci"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+authors = [
+    { name = "Marly Salazar", email = "marly@edera.dev" }
+]
+requires-python = ">=3.14"
+dependencies = [
+    "packaging>=26.3",
+    "pyyaml>=6.0.3",
+]
+
+[project.scripts]
+linux-kernel-oci = "linux_kernel_oci:main"
+
+[build-system]
+requires = ["uv_build>=0.12.7,<0.13.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "black==26.5.1",
+]
+
+[tool.uv]
+package = false