Repository navigation
ci: install from the lock file with --locked - #148
Open
olivermeyer wants to merge 1 commit into
Open
olivermeyer wants to merge 1 commit into
olivermeyer wants to merge 1 commit into
Conversation
CI installed with uv sync --frozen, which skips the check that uv.lock matches pyproject.toml. Use --locked so a stale lock fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
OX Security reviewed this pull request — nothing to fix.
Branch |
Codecov Report✅ All modified and coverable lines are covered by tests. |
|
olivermeyer
marked this pull request as ready for review
November 6, 2026 15:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
The Supply Chain Day checklist (item 2) requires that CI installs dependencies only from the committed lock file with hashes. CI installed with
uv sync --frozen, which does not check that uv.lock matches pyproject.toml, so a stale lock went unnoticed and a lateruv runcould re-lock.How?
The
installmise task and the nox_setup_venvhelper now useuv sync --locked, so uv fails when uv.lock is out of date instead of syncing from it. The lowest-direct job resolves outside the lock on purpose and is out of scope here; https://github.com/aignostics/foundry-python/pull/533 handles it.🤖 Generated with Claude Code