From 5b61214f7bf5a4365a342c57b59539e5c9bd8ed9 Mon Sep 17 00:00:00 2001
From: Zheng Feng <zh.feng@gmail.com>
Date: Sun, 21 Jun 2026 19:10:12 +0800
Subject: [PATCH] chore(ci): enforce uv.lock is in sync (#3679)

Add a uv lock --check guard in two places so a stale uv.lock cannot be
committed unnoticed (as happened with the groundroute extra):

- pre-commit: a local uv-lock-check hook, scoped to the backend
  pyproject.toml files and uv.lock.
- CI: a "Check uv.lock is in sync" step in the lint-backend job, run
  before uv sync so the install step cannot mask a stale lock by
  regenerating it.
---
 .github/workflows/lint-check.yml | 4 ++++
 .pre-commit-config.yaml          | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/lint-check.yml b/.github/workflows/lint-check.yml
index f85bb52f2..783094f63 100644
--- a/.github/workflows/lint-check.yml
+++ b/.github/workflows/lint-check.yml
@@ -23,6 +23,10 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v7
 
+      - name: Check uv.lock is in sync
+        working-directory: backend
+        run: uv lock --check
+
       - name: Install dependencies
         working-directory: backend
         run: |
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c79d53b51..b4e85962c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -14,6 +14,12 @@ repos:
         language: system
         types_or: [python]
         files: ^backend/
+      - id: uv-lock-check
+        name: uv lock check
+        entry: bash -c 'cd backend && uv lock --check'
+        language: system
+        pass_filenames: false
+        files: ^backend/(pyproject\.toml|uv\.lock|packages/harness/pyproject\.toml)$
 
   # Frontend: eslint + prettier (must run from frontend/ for node_modules resolution)
   - repo: local