v0.6.1 — Python 3.14 image + reproducible builds

A build and packaging release. No functional change to the runner — src/ is untouched apart from __version__, and OBSL compatibility is unchanged.

⚠️ The image now runs Python 3.14

The base image moves from Python 3.12 → 3.14. Because the minor line is pinned to OBSL (0.6.x ↔ OBSL 2.16.x), this ships as a patch — but the interpreter jump is larger than a patch tag suggests.

:latest, :0.6, and :0 all now resolve to a Python 3.14 image. If you pin to any of those and depend on the interpreter, pin to :0.6.0 instead, which stays on 3.12.

The full test suite passes on both 3.12 and 3.14, and the published image was pulled and verified end-to-end.

Reproducible builds

• uv.lock is now committed. Previously gitignored, so image builds re-resolved dependencies on every run and the same commit could produce different images over time. The image now installs the lockfile with uv sync --frozen — exactly the versions CI tested.
• The uv build tool is pinned to 0.11.28 instead of tracking :latest, so the tool installing the lockfile can't drift either.
• CI enforces the lock with uv sync --locked, which fails if uv.lock drifts from pyproject.toml.

Locking the baseline picked up current releases of the dev/runtime stack, including mypy 2.3.0 and structlog 26.1.0. Both verified against the full suite.

CI

• Tests now run on a 3.12 / 3.14 matrix — 3.12 is the requires-python floor, 3.14 is what the image ships.
• Every PR now builds the image and smoke-tests it (entrypoint + all runtime imports), instead of Dockerfile changes going unexercised until release.
• Dependabot is configured for uv, github-actions, and docker.

Compatibility

Requires OrionBelt Semantic Layer 2.16.x — unchanged from 0.6.0.

Full changelog: v0.6.0...v0.6.1