What the developer wrote
Authored by Lakshya Singh
chore: add poetry for reckless
What changed, and why it matters
This is a routine build-script change. It adds one command to install the Poetry Python packaging tool via the uv package manager, so that the project's 'reckless' component can continue to work during a migration from Poetry to uv. There is no security-relevant change visible in the diff.
No security action required. Reviewers may optionally verify that the installed Poetry version is pinned or that the uv tool install command pulls from a trusted source, but this is standard practice.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies .github/scripts/setup.sh to run ‘uv tool install poetry’ after ‘uv sync’. The comment explains this is a temporary dependency needed for the ‘reckless’ component until its Poetry-to-uv migration is complete. The change is purely CI/build tooling and does not alter application code, cryptographic logic, network handling, or permissions.
Changed components
.github/scripts/setup.shInspect captured patch +2 / −0
diff --git a/.github/scripts/setup.sh b/.github/scripts/setup.sh
index eed10287..6e3e50cc 100755
--- a/.github/scripts/setup.sh
+++ b/.github/scripts/setup.sh
@@ -66,6 +66,8 @@ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- \
-y --default-toolchain ${RUST_VERSION}
uv sync --all-extras --all-groups
+# required for reckless till poetry to uv migration
+uv tool install poetry
# We also need a relatively recent protobuf-compiler, at least 3.12.0,
# in order to support the experimental `optional` flag.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.