fix(scripts): keep uv.lock in sync and scope the version sed to [project]

[dbrattli]

Two defects in scripts/shipit_bump_version.sh, the command updater ShipIt invokes to write the release version. Both surfaced while working on #798/#800.

1. uv.lock was never updated

uv.lock records the project's own version, but the updater only wrote pyproject.toml and reactivex/_version.py. The lock has been drifting for two releases:

uv.lock:        version = "5.0.0rc1"   ← stale
pyproject.toml: version = "5.0.0rc2"

Any later uv command silently corrects it, so the drift shows up as an unrelated uv.lock diff in an otherwise clean working tree — which is exactly how I ran into it.

Fixed by running uv lock after the bump. Only the local package is re-resolved; pinned dependency versions are left alone (that would be --upgrade).

2. The version sed was not scoped to a table

sed -i "s/^version = \".*\"/version = \"$PEP440\"/" pyproject.toml

This rewrites every column-0 version key in the file. Only [project] has one today, so nothing was silently corrupted — but a top-level version in any future [tool.*] section would have been clobbered. Now restricted to the [project] table.

3. setup-uv added to the shipit-pr job

The updater runs inside shipit-pr, which sets up .NET only — no Python, no uv. Without this step uv lock would fail under set -euo pipefail and break release-PR generation. This is a required part of change 1, not an unrelated addition.

Verification

Ran the script for real (5.0.0-rc.9):

File	Before	After
pyproject.toml	5.0.0rc2	5.0.0rc9
reactivex/_version.py	5.0.0rc2	5.0.0rc9
uv.lock	5.0.0rc1	5.0.0rc9

Diffing every version = line in the lock before/after shows the project's own version as the sole change — no dependency drift.

For the sed, I appended a [tool.faketool] section with version = "9.9.9" and ran both variants:

• old, unanchored → 9.9.9 overwritten with 5.0.0 (the bug)
• new, anchored → 9.9.9 preserved, [project] still correctly bumped

Also: bash -n clean, workflow YAML parses, pre-commit run --all-files passes (ruff check, ruff format, pyright, mypy).

Note

This adds a new failure mode: if uv lock fails, the updater now fails and takes the ShipIt run with it. That is intentional — a half-updated version set is worse than a failed release PR — but it does mean release-PR generation now depends on uv being installable and the lock being resolvable.

Independent of #800; either can merge first.

🤖 Generated with Claude Code

[coveralls]

coverage: 93.559%. remained the same — fix/bump-script-lock-and-sed into master