From 1b4b4ad004ee7cde6868596e34df659beec52a14 Mon Sep 17 00:00:00 2001
From: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
Date: Thu, 22 Jan 2026 10:58:05 +0000
Subject: [PATCH] ci: enforce uv.lock consistency with --locked flag

Add --locked flag to uv sync commands to fail if uv.lock is out of sync
with pyproject.toml. This ensures lockfile consistency across CI and
local development.

- Add --locked to setup-nix action
- Add --locked to flake.nix shellHook
---
 .github/actions/setup-nix/action.yaml | 2 +-
 flake.nix                             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/setup-nix/action.yaml b/.github/actions/setup-nix/action.yaml
index 018a47a..631ca3f 100644
--- a/.github/actions/setup-nix/action.yaml
+++ b/.github/actions/setup-nix/action.yaml
@@ -43,7 +43,7 @@ runs:
     - name: Install Python dependencies
       if: inputs.skip-uv-sync != 'true'
       shell: bash
-      run: uv sync --all-extras
+      run: uv sync --all-extras --locked
 
     - name: Install MCP mock server dependencies
       if: inputs.skip-uv-sync != 'true' && inputs.skip-mock-server != 'true'
diff --git a/flake.nix b/flake.nix
index f5faee7..fad236e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -117,7 +117,7 @@
               # Install Python dependencies only if .venv is missing or uv.lock is newer
               if [ ! -d .venv ] || [ uv.lock -nt .venv ]; then
                 echo "📦 Installing Python dependencies..."
-                uv sync --all-extras
+                uv sync --all-extras --locked
               fi
 
               # Install git hooks