From eabdf727a9e3f67803413dc46c70484fa98debe6 Mon Sep 17 00:00:00 2001 From: Pymetheus Date: Sun, 13 Sep 2026 21:52:37 +0200 Subject: [PATCH 1/2] chore: use locked uv sync in CI workflows Update GitHub Actions workflows to use `uv sync --locked` instead of running `uv lock` followed by `uv sync`. This keeps dependency installation reproducible and consistent with the committed lockfile across CI jobs for linting, type checking, tests, and security scans. --- .github/workflows/ci.yml | 3 +-- .github/workflows/pr-checks.yml | 9 +++------ .github/workflows/security.yml | 3 +-- 3 files changed, 5 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c89cde7..ccbeab5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -66,8 +66,7 @@ jobs: - name: Install project dependencies run: | - uv lock - uv sync + uv sync --locked - name: Run mypy run: uv run mypy src/ diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index f5b7194..0944790 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -83,8 +83,7 @@ jobs: - name: Install project dependencies run: | - uv lock - uv sync + uv sync --locked - name: Run ruff linter run: uv run ruff check src/ tests/ @@ -114,8 +113,7 @@ jobs: - name: Install project dependencies run: | - uv lock - uv sync + uv sync --locked - name: Run mypy run: uv run mypy src/ @@ -142,8 +140,7 @@ jobs: - name: Install project dependencies run: | - uv lock - uv sync + uv sync --locked - name: Run tests with coverage run: | diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 78ef4f8..93783d0 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -95,8 +95,7 @@ jobs: - name: Install project dependencies run: | - uv lock - uv sync + uv sync --locked - name: Run Bandit security linter run: uv run bandit -r src/ -c pyproject.toml -f json -o bandit-report.json From bf32bad1ba93e978ca915a90f636e4ca785e9e5b Mon Sep 17 00:00:00 2001 From: Pymetheus Date: Sun, 13 Sep 2026 22:02:51 +0200 Subject: [PATCH 2/2] fix: run uv lock before uv sync in CI workflows Replace occurrences of `uv sync --locked` with `uv lock` followed by `uv sync` in .github/workflows/ci.yml, pr-checks.yml, and security.yml. This ensures the project's lockfile is generated/updated before syncing dependencies so CI and checks use an up-to-date lockfile and avoid failures from the `--locked` usage. --- .github/workflows/ci.yml | 3 ++- .github/workflows/pr-checks.yml | 9 ++++++--- .github/workflows/security.yml | 3 ++- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ccbeab5..c89cde7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -66,7 +66,8 @@ jobs: - name: Install project dependencies run: | - uv sync --locked + uv lock + uv sync - name: Run mypy run: uv run mypy src/ diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 0944790..f5b7194 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -83,7 +83,8 @@ jobs: - name: Install project dependencies run: | - uv sync --locked + uv lock + uv sync - name: Run ruff linter run: uv run ruff check src/ tests/ @@ -113,7 +114,8 @@ jobs: - name: Install project dependencies run: | - uv sync --locked + uv lock + uv sync - name: Run mypy run: uv run mypy src/ @@ -140,7 +142,8 @@ jobs: - name: Install project dependencies run: | - uv sync --locked + uv lock + uv sync - name: Run tests with coverage run: | diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 93783d0..78ef4f8 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -95,7 +95,8 @@ jobs: - name: Install project dependencies run: | - uv sync --locked + uv lock + uv sync - name: Run Bandit security linter run: uv run bandit -r src/ -c pyproject.toml -f json -o bandit-report.json