CI: install Python packages no newer than one week via uv

Plain pip has no time-based cutoff, so route the workflow's package
installs through uv and set UV_EXCLUDE_NEWER to refuse releases
published within the last week as supply-chain hardening. Mirror the
policy in the rips pyproject for local uv installs.

.github/workflows/ResInsightWithCache.yml

@@ -81,6 +81,10 @@ jobs:
       BUILDCACHE_DIR: ${{ github.workspace }}/buildcache_dir
       BUILDCACHE_ACCURACY: SLOPPY
       VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
+      # Supply-chain hardening: never install Python packages published within
+      # the last week, to avoid pulling freshly published (potentially
+      # compromised) releases. Honored by all `uv pip install` invocations below.
+      UV_EXCLUDE_NEWER: "1 week"
 
     steps:
       - name: Checkout
@@ -95,6 +99,9 @@ jobs:
       - name: Display Python version
         run: python -c "import sys; print(sys.version)"
 
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+
       - name: Get Python executable path
         shell: bash
         id: python-path
@@ -105,11 +112,10 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
           # rips/_version.py is normally generated by CMake; create a dev
           # fallback so the editable install below can resolve the version.
           echo '__version__ = "0.0.0.dev"' > GrpcInterface/Python/rips/_version.py
-          pip install -e GrpcInterface/Python[dev]
+          uv pip install --system -e "GrpcInterface/Python[dev]"
 
       - name: Use MSVC (Windows)
         if: contains(matrix.config.os, 'windows')
@@ -265,7 +271,7 @@ jobs:
         if: matrix.config.build-python-module
         shell: bash
         run: |
-          ${{ steps.python-path.outputs.PYTHON_EXECUTABLE }} -m pip install build wheel
+          uv pip install --system build wheel
           cd GrpcInterface/Python
           ${{ steps.python-path.outputs.PYTHON_EXECUTABLE }} -m build
 
@@ -273,7 +279,7 @@ jobs:
         if: matrix.config.build-python-module
         shell: bash
         run: |
-          ${{ steps.python-path.outputs.PYTHON_EXECUTABLE }} -m pip install mypy types-protobuf
+          uv pip install --system mypy types-protobuf
           cd GrpcInterface/Python
           ${{ steps.python-path.outputs.PYTHON_EXECUTABLE }} -m mypy rips/*.py rips/generated/generated_classes.py
 

GrpcInterface/Python/pyproject.toml

@@ -29,6 +29,13 @@ dev = [
 [project.urls]
 Homepage = "http://www.resinsight.org"
 
+[tool.uv]
+# Supply-chain hardening: never resolve/install packages published within the
+# last week, to avoid pulling freshly published (potentially compromised)
+# releases. CI also enforces this via the UV_EXCLUDE_NEWER env var, since this
+# setting is only discovered when uv runs from this directory.
+exclude-newer = "1 week"
+
 [tool.setuptools.dynamic]
 version = {attr = "rips._version.__version__"}