fix: add lint rule to detect bare pip install and fix beval.yml violation

.github/skills/experimental/powerpoint/SKILL.md

@@ -6,7 +6,7 @@ compatibility: 'Requires uv, Python 3.11+, PowerShell 7+, and LibreOffice'
 metadata:
   authors: "microsoft/hve-core"
   spec_version: "1.0"
-  last_updated: "2026-03-18"
+  last_updated: "2026-07-31"
 ---
 
 # PowerPoint Skill
@@ -460,7 +460,7 @@ python scripts/embed_audio.py \
 
 Embeds WAV audio files into PPTX slides. Audio files are matched to slides by naming convention (`slide-001.wav`, `slide-002.wav`, etc.). The audio icon is placed off-screen (below the slide boundary) to keep it hidden during presentation. Pass `--slides` to embed audio on specific slides only.
 
-**Dependencies**: Requires `pillow` (`pip install pillow`) for poster frame generation.
+**Dependencies**: Requires `pillow` (`uv pip install pillow`) for poster frame generation.
 
 > [!NOTE]
 > WAV files are embedded uncompressed. For large narrated decks, consider pre-compressing audio before embedding to manage PPTX file size.

.github/skills/experimental/powerpoint/scripts/export_slides.py

@@ -161,7 +161,7 @@ def filter_pdf_pages(pdf_path: Path, pages: list[int], output_path: Path) -> Pat
         import fitz  # noqa: PLC0415 — PyMuPDF
     except ImportError:
         logger.error(
-            "PyMuPDF is required for slide filtering. Install via: pip install pymupdf"
+            "PyMuPDF is required for slide filtering. Install via: uv pip install pymupdf"
         )
         sys.exit(EXIT_FAILURE)
 

.github/skills/experimental/powerpoint/scripts/export_svg.py

@@ -173,7 +173,7 @@ def export_pdf_to_svg(
         import fitz  # noqa: F401, PLC0415 — PyMuPDF availability check
     except ImportError as e:
         raise PyMuPDFError(
-            "PyMuPDF is required for SVG export. Install via: pip install pymupdf"
+            "PyMuPDF is required for SVG export. Install via: uv pip install pymupdf"
         ) from e
 
     try:

.github/skills/experimental/powerpoint/scripts/render_pdf_images.py

@@ -98,7 +98,7 @@ def render_pages(
     try:
         import fitz  # noqa: F401, PLC0415 — PyMuPDF availability check
     except ImportError:
-        logger.error("PyMuPDF is required. Install via: pip install pymupdf")
+        logger.error("PyMuPDF is required. Install via: uv pip install pymupdf")
         sys.exit(EXIT_FAILURE)
 
     output_dir.mkdir(parents=True, exist_ok=True)

.github/workflows/beval.yml

@@ -41,11 +41,14 @@
           npm ci --prefix evals/beval
           echo "${{ github.workspace }}/evals/beval/node_modules/.bin" >> "$GITHUB_PATH"
 
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
       - name: Install beval
         # beval is hosted under a personal account (vyta) while an org-owned
         # home is evaluated. The install is pinned to a specific commit SHA to
         # mitigate supply-chain risk in the interim.
-        run: pip install --no-cache-dir "beval[all] @ git+https://github.com/vyta/beval.git@d9f46c24f03b0b806d928a8a8ce2fc66d8e470fb#subdirectory=python"
+        run: uv pip install --system --no-cache-dir "beval[all] @ git+https://github.com/vyta/beval.git@d9f46c24f03b0b806d928a8a8ce2fc66d8e470fb#subdirectory=python"
 
       - name: Start agent (TCP)
         env:

.github/workflows/pip-install-lint.yml

@@ -0,0 +1,18 @@
+name: Pip Install Lint
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  check-bare-pip-install:
+    name: Check for bare pip install
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run bare pip install lint check
+        run: pwsh -File scripts/linting/Invoke-PipInstallLint.ps1

.github/workflows/pr-validation.yml

@@ -27,6 +27,10 @@
     with:
       soft-fail: false
 
+  pip-install-lint:
+    name: Pip Install Lint
+    uses: ./.github/workflows/pip-install-lint.yml
+
   markdown-lint:
     name: Markdown Lint
     uses: ./.github/workflows/markdown-lint.yml
@@ -485,6 +489,7 @@
       - node-tests
       - fuzz-tests
       - pip-audit
+      - pip-install-lint
       - docusaurus-tests
       - frontmatter-validation
       - adr-consistency-validation

scripts/linting/Invoke-PipInstallLint.ps1

@@ -0,0 +1,114 @@
+# Copyright (c) 2026 Microsoft Corporation. All rights reserved.
+# SPDX-License-Identifier: MIT
+
+<#
+.SYNOPSIS
+Lint script to detect bare 'pip install' calls.
+The repository follows a 'uv-first' Python convention.
+#>
+
+param(
+    [string]$TestDirectory = ""
+)
+
+$ErrorActionPreference = "Stop"
+
+$script:ExcludeDirs = @(".git", "evals", ".venv", "venv", "env", "node_modules", "__pycache__")
+$script:ExcludeFiles = @("THIRD-PARTY-NOTICES", "Invoke-PipInstallLint.ps1", "Invoke-PipInstallLint.Tests.ps1")
+$script:Violations = @()
+$script:ScannedFiles = @{}
+
+function script:Should-Exclude {
+    param([string]$Path)
+    $normalizedPath = $Path.Replace("\", "/").ToLowerInvariant()
+
+    foreach ($dir in $script:ExcludeDirs) {
+        if ($normalizedPath -match "(^|/)$dir(/|$)") { return $true }
+    }
+    foreach ($file in $script:ExcludeFiles) {
+        if ($normalizedPath -match "(^|/)$file(/|$)") { return $true }
+    }
+    return $false
+}
+
+function script:Scan-File {
+    param([string]$FilePath)
+
+    $normalizedPath = $FilePath.Replace("\", "/")
+    if ($script:ScannedFiles.ContainsKey($normalizedPath)) { return }
+    $script:ScannedFiles[$normalizedPath] = $true
+
+    if (script:Should-Exclude -Path $FilePath) { return }
+
+    $ext = [System.IO.Path]::GetExtension($FilePath).ToLowerInvariant()
+    if ($ext -notin @(".py", ".ps1", ".yml", ".yaml", ".md", "")) { return }
+
+    try {
+        $lines = Get-Content -Path $FilePath -Raw -ErrorAction SilentlyContinue
+        if (-not $lines) { return }
+
+        $lineNumber = 1
+        foreach ($line in $lines -split "`r?`n") {
+            $strippedLine = $line.Trim()
+
+            if ([string]::IsNullOrWhiteSpace($strippedLine)) { 
+                $lineNumber++
+                continue 
+            }
+
+            if ($line -match "#\s*pip-install-ok\b" -or $line -match "<!--\s*pip-install-ok\s*-->") {
+                $lineNumber++
+                continue
+            }
+
+            if ($line -match "\bpip3?\s+install\b" -and $line -notmatch "\buv\s+pip3?\s+install\b") {
+                if ($strippedLine -notmatch "^(name:|- name:)") {
+                    $script:Violations += "$FilePath`:$lineNumber`: $strippedLine"
+                }
+            }
+            $lineNumber++
+        }
+    }
+    catch {
+        Write-Warning "Could not read $FilePath`: $_"
+    }
+}
+
+function script:Invoke-Lint {
+    param([string]$TargetDir = ".")
+
+    $script:Violations = @()
+    $script:ScannedFiles = @{}
+
+    if ($TargetDir -eq ".") {
+        foreach ($dir in @(".github/workflows", "scripts")) {
+            if (Test-Path $dir) {
+                Get-ChildItem -Path $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object { script:Scan-File -FilePath $_.FullName }
+            }
+        }
+        Get-ChildItem -Path "." -Recurse -Include *.py, *.ps1, *.yml, *.yaml, *.md -File -ErrorAction SilentlyContinue | ForEach-Object {
+            script:Scan-File -FilePath $_.FullName
+        }
+    } else {
+        Get-ChildItem -Path $TargetDir -Recurse -Include *.py, *.ps1, *.yml, *.yaml, *.md -File -ErrorAction SilentlyContinue | ForEach-Object {
+            script:Scan-File -FilePath $_.FullName
+        }
+    }
+
+    if ($script:Violations.Count -gt 0) {
+        Write-Error "ERROR: Found bare 'pip install' calls. Use 'uv pip install' instead."
+        Write-Host "The repo follows a uv-first Python convention.`n" -ForegroundColor Yellow
+        foreach ($v in ($script:Violations | Sort-Object -Unique)) {
+            Write-Host "  - $v" -ForegroundColor Red
+        }
+        return $false
+    } else {
+        Write-Host "Success: No bare 'pip install' calls found." -ForegroundColor Green
+        return $true
+    }
+}
+
+if ($MyInvocation.InvocationName -ne '.') {
+    $success = script:Invoke-Lint -TargetDir $TestDirectory
+    if (-not $success) { exit 1 }
+}

scripts/tests/linting/Invoke-PipInstallLint.Tests.ps1

@@ -0,0 +1,78 @@
+# Copyright (c) 2026 Microsoft Corporation. All rights reserved.
+# SPDX-License-Identifier: MIT
+
+Describe "Invoke-PipInstallLint.ps1" {
+    BeforeAll {
+        $scriptPath = "$PSScriptRoot/../../linting/Invoke-PipInstallLint.ps1"
+        . $scriptPath
+        $testDir = "$PSScriptRoot/TestLintDir"
+        if (Test-Path $testDir) { Remove-Item -Recurse -Force $testDir }
+        New-Item -ItemType Directory -Path $testDir | Out-Null
+    }
+
+    AfterAll {
+        if (Test-Path $testDir) { Remove-Item -Recurse -Force $testDir }
+    }
+
+    AfterEach {
+        if (Test-Path $testDir) { Remove-Item -Recurse -Force $testDir }
+        New-Item -ItemType Directory -Path $testDir | Out-Null
+    }
+
+    It "Should pass on clean state" {
+        $testFile = Join-Path $testDir "clean.py"
+        Set-Content -Path $testFile -Value "print('hello world')"
+
+        $result = script:Invoke-Lint -TargetDir $testDir
+        $result | Should -Be $true
+        $script:Violations.Count | Should -Be 0
+    }
+
+    It "Should detect bare pip install violation" {
+        $testFile = Join-Path $testDir "violation.yml"
+        Set-Content -Path $testFile -Value "run: pip install malicious-package"
+
+        $result = script:Invoke-Lint -TargetDir $testDir
+        $result | Should -Be $false
+        $script:Violations.Count | Should -BeGreaterThan 0
+        $script:Violations[0] | Should -Match "malicious-package"
+    }
+
+    It "Should respect exclusion logic (evals directory)" {
+        $evalsDir = Join-Path $testDir "evals"
+        New-Item -ItemType Directory -Path $evalsDir | Out-Null
+        $testFile = Join-Path $evalsDir "fake_eval_test.py"
+        Set-Content -Path $testFile -Value "run: pip install mock-package"
+
+        $result = script:Invoke-Lint -TargetDir $testDir
+        $result | Should -Be $true
+        $script:Violations.Count | Should -Be 0
+    }
+
+    It "Should allow uv pip install" {
+        $testFile = Join-Path $testDir "uv_allowed.py"
+        Set-Content -Path $testFile -Value "run: uv pip install fastapi"
+
+        $result = script:Invoke-Lint -TargetDir $testDir
+        $result | Should -Be $true
+        $script:Violations.Count | Should -Be 0
+    }
+
+    It "Should respect inline ignore marker for Python/YAML" {
+        $testFile = Join-Path $testDir "ignored.py"
+        Set-Content -Path $testFile -Value "run: pip install legacy-package # pip-install-ok"
+
+        $result = script:Invoke-Lint -TargetDir $testDir
+        $result | Should -Be $true
+        $script:Violations.Count | Should -Be 0
+    }
+
+    It "Should respect inline ignore marker for Markdown" {
+        $testFile = Join-Path $testDir "ignored.md"
+        Set-Content -Path $testFile -Value "run: pip install legacy-package <!-- pip-install-ok -->"
+
+        $result = script:Invoke-Lint -TargetDir $testDir
+        $result | Should -Be $true
+        $script:Violations.Count | Should -Be 0
+    }
+}