ci: enforce uv.lock consistency with --locked flag

[ryoppippi]

Summary

• Add --locked flag to uv sync in setup-nix action
• Add --locked flag to uv sync in flake.nix shellHook

This ensures CI and local development fail early if uv.lock is out of sync with pyproject.toml, catching lockfile drift before it causes issues.

Test plan

• CI passes with current uv.lock
• CI fails if uv.lock is modified without updating pyproject.toml

---

Summary by cubic

Enforce uv.lock consistency by running uv sync with --locked in CI and the Nix dev shell. Builds and local setup now fail early if uv.lock and pyproject.toml drift.

• Migration
  • If sync fails, run uv lock and commit the updated uv.lock.
  • Keep uv.lock updated whenever you change pyproject.toml.

^{Written for commit 1b4b4ad. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

[Copilot]

Pull request overview

This PR adds the --locked flag to uv sync commands in CI and local development environments to ensure lockfile consistency with pyproject.toml, preventing lockfile drift issues.

Changes:

• Add --locked flag to uv sync in CI setup-nix action
• Add --locked flag to uv sync in flake.nix shellHook

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/actions/setup-nix/action.yaml	Adds --locked flag to uv sync in CI to enforce lockfile consistency
flake.nix	Adds --locked flag to uv sync in dev shell initialization hook

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The --locked flag in the shellHook may prevent developers from entering the development shell if uv.lock is out of sync with pyproject.toml. This creates a problematic scenario where developers cannot enter the shell to fix the lockfile issue.

Consider removing --locked from the shellHook while keeping it in CI (setup-nix action). The shellHook is meant to facilitate local development setup, not enforce strict validation. CI will catch lockfile drift issues, while local developers can still sync their dependencies even when the lockfile needs updating.

Suggested change

	uv sync --all-extras --locked
	uv sync --all-extras