fix: Audit 02/10 (#1825)

* Fix scaffold.

* Fix python.

* Fix uv.

* Bump versions.

Author: milesj

Diff for: .yarn/versions/1c174b42.yml

@@ -0,0 +1,9 @@
+releases:
+  "@moonrepo/cli": patch
+  "@moonrepo/core-linux-arm64-gnu": patch
+  "@moonrepo/core-linux-arm64-musl": patch
+  "@moonrepo/core-linux-x64-gnu": patch
+  "@moonrepo/core-linux-x64-musl": patch
+  "@moonrepo/core-macos-arm64": patch
+  "@moonrepo/core-macos-x64": patch
+  "@moonrepo/core-windows-x64-msvc": patch

Diff for: CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+
+#### 🐞 Fixes
+
+- Fixed an issue where `moon setup` wouldn't load configuration.
+- Fixed an issue where `moon docker scaffold` would unexpectedly install the toolchain languages.
+- Fixed an issue where `moon docker scaffold` would not copy `uv.toml` and `uv.lock` files.
+- Fixed an issue where changing `python.version` wouldn't regenerate the Python virtual environment.
+
 ## 1.32.2
 
 #### 🐞 Fixes

Diff for: crates/actions/src/actions/install_deps.rs

@@ -9,6 +9,7 @@ use moon_platform::{BoxedPlatform, PlatformManager, Runtime};
 use moon_project::Project;
 use moon_time::to_millis;
 use moon_workspace_graph::WorkspaceGraph;
+use proto_core::UnresolvedVersionSpec;
 use starbase_utils::fs;
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -19,6 +20,7 @@ cache_item!(
     pub struct DependenciesCacheState {
         pub last_hash: String,
         pub last_install_time: u128,
+        pub last_tool_version: Option<UnresolvedVersionSpec>,
     }
 );
 
@@ -103,8 +105,9 @@ pub async fn install_deps(
     )
     .await?;
 
-    // Extract lockfile timestamp
+    // Extract lockfile timestamp and tool version
     let mut lockfile_timestamp = track_lockfile(&app_context, project, &lockfile_name)?;
+    let tool_version = runtime.requirement.to_spec();
 
     // Only install deps if a cache miss
     let mut state = app_context
@@ -123,6 +126,8 @@ pub async fn install_deps(
         || manifests_hash
             .as_ref()
             .is_some_and(|hash| hash != &state.data.last_hash)
+        // Toolchain version has changed
+        || state.data.last_tool_version != tool_version
     {
         let working_dir = match project {
             Some(proj) => proj.root.clone(),
@@ -155,6 +160,7 @@ pub async fn install_deps(
 
         state.data.last_hash = manifests_hash.unwrap_or_default();
         state.data.last_install_time = lockfile_timestamp;
+        state.data.last_tool_version = tool_version;
         state.save()?;
 
         return Ok(ActionStatus::Passed);

Diff for: crates/app/src/session.rs

@@ -1,5 +1,6 @@
 use crate::app::{Cli, Commands};
 use crate::app_error::AppError;
+use crate::commands::docker::DockerCommands;
 use crate::components::*;
 use crate::systems::*;
 use async_trait::async_trait;
@@ -201,17 +202,22 @@ impl CliSession {
         self.workspace_config.telemetry
     }
 
-    pub fn requires_workspace_setup(&self) -> bool {
+    pub fn requires_workspace_configured(&self) -> bool {
         !matches!(
             self.cli.command,
-            Commands::Completions(_) | Commands::Init(_) | Commands::Setup
+            Commands::Completions(_) | Commands::Init(_)
         )
     }
 
     pub fn requires_toolchain_installed(&self) -> bool {
         matches!(
             self.cli.command,
-            Commands::Bin(_) | Commands::Docker { .. } | Commands::Node { .. } | Commands::Teardown
+            Commands::Bin(_)
+                | Commands::Docker {
+                    command: DockerCommands::Prune {}
+                }
+                | Commands::Node { .. }
+                | Commands::Teardown
         )
     }
 
@@ -238,7 +244,7 @@ impl AppSession for CliSession {
 
         self.working_dir = env::current_dir().map_err(|_| AppError::MissingWorkingDir)?;
 
-        self.workspace_root = if self.requires_workspace_setup() {
+        self.workspace_root = if self.requires_workspace_configured() {
             startup::find_workspace_root(&self.working_dir)?
         } else {
             self.working_dir.clone()
@@ -253,7 +259,7 @@ impl AppSession for CliSession {
 
         // Load configs
 
-        if self.requires_workspace_setup() {
+        if self.requires_workspace_configured() {
             let (workspace_config, tasks_config, toolchain_config) = try_join!(
                 startup::load_workspace_config(self.config_loader.clone(), &self.workspace_root),
                 startup::load_tasks_configs(self.config_loader.clone(), &self.workspace_root),
@@ -289,7 +295,7 @@ impl AppSession for CliSession {
             analyze::validate_version_constraint(constraint, &self.cli_version)?;
         }
 
-        if self.requires_workspace_setup() {
+        if self.requires_workspace_configured() {
             let cache_engine = self.get_cache_engine()?;
 
             analyze::install_proto(

Diff for: crates/toolchain/src/detect/languages.rs

@@ -45,6 +45,9 @@ pub static PYTHON: StaticStringList = &[
     // poetry
     "poetry.toml",
     "poetry.lock",
+    // uv
+    "uv.toml",
+    "uv.lock",
 ];
 
 pub static RUBY: StaticStringList = &["Gemfile", "Gemfile.lock", ".bundle", ".ruby-version"];

Diff for: legacy/python/platform/src/actions/install_deps.rs

@@ -4,8 +4,23 @@ use moon_config::PythonPackageManager;
 use moon_console::{Checkpoint, Console};
 use moon_logger::error;
 use moon_python_tool::PythonTool;
+use proto_core::VersionSpec;
+use starbase_utils::fs;
 use std::path::Path;
 
+fn is_venv_diff_version(venv_root: &Path, python_version: VersionSpec) -> miette::Result<bool> {
+    let cfg_path = venv_root.join("pyvenv.cfg");
+
+    if !cfg_path.exists() {
+        return Ok(false);
+    }
+
+    let cfg = fs::read_file(cfg_path)?;
+    let version_line = format!("version = {python_version}");
+
+    Ok(!cfg.contains(&version_line))
+}
+
 pub async fn install_deps(
     python: &PythonTool,
     workspace_root: &Path,
@@ -19,18 +34,24 @@ pub async fn install_deps(
         workspace_root.join(&python.config.venv_name)
     } else {
         venv_parent
-            .as_ref()
-            .and_then(|vp| vp.parent())
+            .as_deref()
             .unwrap_or(working_dir)
             .join(&python.config.venv_name)
     };
 
-    if !venv_root.exists() && venv_parent.is_some() {
+    if !venv_root.exists() && venv_parent.is_some()
+        || venv_root.exists()
+            && is_venv_diff_version(&venv_root, python.tool.get_resolved_version())?
+    {
         let command = match python.config.package_manager {
             PythonPackageManager::Pip => "python -m venv",
             PythonPackageManager::Uv => "uv venv",
         };
 
+        // Ensure the venv doesn't exist, otherwise we'll have stale
+        // artifacts between each activation
+        fs::remove_dir_all(&venv_root)?;
+
         operations.push(
             Operation::task_execution(command)
                 .track_async(|| async {

Diff for: legacy/python/tool/src/python_tool.rs

@@ -109,6 +109,7 @@ impl PythonTool {
         args: I,
         working_dir: &Path,
         workspace_root: &Path,
+        with_paths: bool,
     ) -> miette::Result<()>
     where
         I: IntoIterator<Item = S>,
@@ -118,13 +119,21 @@ impl PythonTool {
 
         cmd.args(args)
             .envs(get_proto_env_vars())
-            .env(
-                "PATH",
-                prepend_path_env_var(get_python_tool_paths(self, working_dir, workspace_root)),
-            )
             .cwd(working_dir)
             .with_console(self.console.clone());
 
+        if with_paths {
+            cmd.env(
+                "PATH",
+                prepend_path_env_var(get_python_tool_paths(self, working_dir, workspace_root)),
+            );
+        } else {
+            cmd.env(
+                "PATH",
+                prepend_path_env_var(get_proto_paths(&self.proto_env)),
+            );
+        }
+
         if let Some(version) = get_proto_version_env(&self.tool) {
             cmd.env("PROTO_PYTHON_VERSION", version);
         }
@@ -144,17 +153,27 @@ impl PythonTool {
         match self.config.package_manager {
             PythonPackageManager::Pip => {
                 self.exec_python(
-                    ["-m", "venv", venv_root.to_str().unwrap_or_default()],
+                    [
+                        "-m",
+                        "venv",
+                        venv_root.to_str().unwrap_or_default(),
+                        "--clear",
+                    ],
                     working_dir,
                     workspace_root,
+                    false,
                 )
                 .await?;
             }
             PythonPackageManager::Uv => {
                 let uv = self.get_uv()?;
 
-                uv.create_command_with_paths(self, working_dir)?
-                    .args(["venv", venv_root.to_str().unwrap_or_default()])
+                uv.create_command(self)?
+                    .args([
+                        "venv",
+                        venv_root.to_str().unwrap_or_default(),
+                        "--no-python-downloads",
+                    ])
                     .cwd(working_dir)
                     .exec_stream_output()
                     .await?;