Wait 3 days before taking new dependency releases

.github/workflows/release.yml

@@ -104,7 +104,7 @@ jobs:
             uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-
 
       - name: Install build tools
-        run: python -m pip install "uv==${UV_VERSION}"
+        run: python -m pip install --uploaded-prior-to P3D "uv==${UV_VERSION}"
 
       - name: Validate release inputs
         id: release

.github/workflows/validate.yml

@@ -187,7 +187,7 @@ jobs:
             uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-
 
       - name: Install uv
-        run: python -m pip install "uv==${UV_VERSION}"
+        run: python -m pip install --uploaded-prior-to P3D "uv==${UV_VERSION}"
 
       - name: Validate lockfile
         run: uv lock --check
@@ -243,7 +243,7 @@ jobs:
             uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-
 
       - name: Install uv
-        run: python -m pip install "uv==${UV_VERSION}"
+        run: python -m pip install --uploaded-prior-to P3D "uv==${UV_VERSION}"
 
       - name: Build distributions
         run: |

.npmrc

@@ -0,0 +1 @@
+min-release-age=3

AGENTS.md

@@ -241,6 +241,10 @@ Business workflows live in packages:
 - `uv run pyright` must be clean. No `# type: ignore` to silence -
   fix the underlying type.
 - Local tests use stdlib `unittest`: `uv run python -m unittest discover -s tests`.
+- Dependencies wait 3 days after release: `minimumReleaseAge` in
+  `renovate.json` (`src-py-lib` is exempt), `min-release-age` in `.npmrc`, and
+  `--uploaded-prior-to P3D` where workflows `pip install` uv. pip reports a
+  younger pin as `No matching distribution found`.
 - For Sourcegraph mutation-path changes, also verify by dry-running `--get` /
   `--set` / `--restore` against a real instance and diffing. If the expected
   changes look right, run `--apply` against a scratch instance and inspect

renovate.json

@@ -10,6 +10,7 @@
       "before 4am"
     ]
   },
+  "minimumReleaseAge": "3 days",
   "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
@@ -18,6 +19,13 @@
       ],
       "groupName": "build requirements"
     },
+    {
+      "description": "First-party package, no cooldown",
+      "matchPackageNames": [
+        "src-py-lib"
+      ],
+      "minimumReleaseAge": null
+    },
     {
       "matchPackageNames": [
         "python"