Skip to content

build: uv.lock hygiene (normalise markers, require uv 0.8+, --locked everywhere) - #157

Open
renato-umeton wants to merge 6 commits into
mainfrom
build/lock-hygiene
Open

renato-umeton wants to merge 6 commits into
mainfrom
build/lock-hygiene

Conversation

@renato-umeton

Copy link
Copy Markdown
Collaborator

follow up to #147, a few small lock things

  • relocked w/ uv 0.12.19, markers only: redundant python_full_version markers in 13 entries (23 removed, 1 simplified on tzdata), no version/source/pkg changes, still revision 3 and croissant-baker 0.6.1. uv 0.8.22 and 0.11.10 pass uv lock --check on it, and 0.12.20 (what CI gets today) leaves it byte identical
  • [tool.uv] required-version = ">=0.8" so uv 0.7 stops w/ an error before it rewrites the lock to revision 2 (bit us once in fix: refuse unknown RAI config keys and correct the social impact key in the template #134)
  • docs.yaml and pre-commit.yaml now uv sync --locked like test.yaml, + a test that parses the workflows and checks every uv sync has --locked
  • dependabot moves from the pip ecosystem to uv, pip bumps touched pyproject.toml w/o the lock and would fail every --locked job
  • short DEVELOPMENT.md section on relocking and uv.lock conflicts (fetch, take main's lock, uv lock, git add, no hand edits)

heads up: if u are on uv 0.7 (i was, 0.7.22) uv run will now refuse, pls uv self update or brew upgrade uv

merge-tree vs the open lock PRs:

suggested merge order: #148, this one, #141, #135, #130 last (resolve w/ the recipe in DEVELOPMENT.md)

thx!

uv 0.12 drops redundant python_full_version markers in 13 entries the
first time it re-resolves the lock (23 removed, 1 simplified on tzdata).
Relocking with uv 0.12.19 records that form once, so CI and contributors
on a current uv stop producing a marker only diff. No package, version
or source changes; uv 0.8.22 and 0.11.10 accept the result with
uv lock --check.
uv 0.7 rewrites uv.lock to revision 2, which already slipped into a PR
once. required-version under [tool.uv] makes an older uv stop with an
error before it touches the lock. The lock itself is unchanged.
The test job already fails on a stale uv.lock; the docs and pre-commit
jobs quietly relocked instead. A test now checks that every uv sync in
the workflows passes --locked.
Nothing documented the uv version floor, how to change dependencies,
or how to settle a uv.lock conflict, and hand edits have caused trouble
before. Add a short section to DEVELOPMENT.md.
The pip ecosystem bumps pyproject.toml without touching uv.lock, so its
PRs would fail every job that now syncs with --locked. The uv ecosystem
updates both files. Directory and schedule are unchanged.
@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

Coverage report

This PR does not seem to contain any modification to coverable code.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant