From 5e4640f5035f26fa14cecb6c543b176e7cdbf63a Mon Sep 17 00:00:00 2001 From: Bharat Date: Wed, 29 Jul 2026 09:03:35 +0100 Subject: [PATCH] PLAT-2003/ci: add uv-lock pre-commit hook Nothing currently checks that uv.lock agrees with pyproject.toml. The Dockerfile runs `uv sync --frozen`, which installs from the lock without verifying it matches pyproject, so a dependabot PR that edits pyproject alone stays green while the lock goes stale. The mismatch then lands all at once whenever someone next regenerates the lock, far from the PR that caused it - see PLAT-2000, where that pattern left ratatosk staging silently undeployable for a week. The uv-lock hook regenerates uv.lock and fails if the file changes, so drift goes red on the PR that introduces it, via the pre-commit check this repo already runs. rev 0.10.0 matches the org's current standard. --- .pre-commit-config.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 4a510b0..6e365d1 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -41,3 +41,7 @@ repos: language: python entry: prepare-commit-msg stages: [prepare-commit-msg] + - repo: https://github.com/astral-sh/uv-pre-commit + rev: 0.10.0 + hooks: + - id: uv-lock