pipeline: pass explicit --with deps to child jobs (--no-project suppressed PEP 723 and killed the merge in 3s)

pipeline.py

@@ -43,6 +43,15 @@ RESULT = {"train": "NOT_RUN", "merge": "NOT_RUN", "gguf": "NOT_RUN",
           "adapter": ADAPTER, "merged": MERGED, "gguf_repo": GGUF, "quant": QUANT}
 
 
+# Explicit dependencies for the child jobs. `uv run --no-project` was the cause of a
+# silent 3-second merge failure: --no-project suppresses PEP 723 inline metadata, so torch
+# and friends were never installed. Keep in sync with the `# dependencies = [...]` header
+# of merge_securecoder.py / quantise_securecoder.py.
+DEPS = ["--with", "torch", "--with", "transformers", "--with", "peft",
+        "--with", "huggingface_hub", "--with", "accelerate",
+        "--with", "safetensors", "--with", "unsloth"]
+
+
 def log(msg):
     print("[supervisor %s] %s" % (time.strftime("%H:%M:%S"), msg), flush=True)
 
@@ -175,7 +184,7 @@ def main():
         log("adapter %s is live" % ADAPTER)
 
         merge_job = launch(
-            ["uv", "run", "--no-project",
+            ["uv", "run"] + DEPS + [
              HUB + "/" + NS + "/securecoder-scripts/resolve/main/merge_securecoder.py",
              "--adapter", ADAPTER, "--output-repo", MERGED],
             "a100-large", 3 * 3600, "securecoder-v2-merge")
@@ -189,7 +198,7 @@ def main():
         log("merged repo %s is live" % MERGED)
 
     gguf_job = launch(
-        ["uv", "run", "--no-project",
+        ["uv", "run"] + DEPS + [
          HUB + "/" + NS + "/securecoder-scripts/resolve/main/quantise_securecoder.py",
          "--merged-repo", MERGED, "--gguf-repo", GGUF, "--quant", QUANT],
         "cpu-performance", 6 * 3600, "securecoder-v2-gguf")