From 407231110f81676952b77402b1b75ca3e24f07b9 Mon Sep 17 00:00:00 2001
From: Fernando Macedo <fgmacedo@gmail.com>
Date: Tue, 13 Oct 2026 17:18:01 -0300
Subject: [PATCH] ci: install uv.lock as committed instead of re-resolving

CI ran `uv sync --all-extras --dev` without `--locked`, so a stale or
inconsistent uv.lock never failed and the release build could test
versions other than the pinned ones. Both workflows now sync with
`--locked` and set `UV_LOCKED=1` so later `uv run` steps do not re-lock.

The committed lock records a 7-day `exclude-newer` span that only
existed in a contributor's global uv config, so `--locked` would fail
in CI. Declaring the cooldown in `[tool.uv]` makes the lock reproducible
from the project alone.

Fixes #677

Signed-off-by: Fernando Macedo <fgmacedo@gmail.com>
---
 .github/workflows/python-package.yml | 4 +++-
 .github/workflows/release.yml        | 4 +++-
 docs/contributing.md                 | 5 ++++-
 pyproject.toml                       | 3 +++
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index cd9daf70..a8f3ce24 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -15,6 +15,8 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      UV_LOCKED: 1
     strategy:
       fail-fast: false
       matrix:
@@ -34,7 +36,7 @@ jobs:
         enable-cache: true
         cache-suffix: "python${{ matrix.python-version }}"
     - name: Install the project
-      run: uv sync --all-extras --dev
+      run: uv sync --locked --all-extras --dev
       #----------------------------------------------
       #              run ruff
       #----------------------------------------------
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c4a7174..251a63bd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ jobs:
   release-build:
     name: Build release artifacts
     runs-on: ubuntu-latest
+    env:
+      UV_LOCKED: 1
 
     permissions:
       id-token: write
@@ -27,7 +29,7 @@ jobs:
           enable-cache: true
 
       - name: Install the project
-        run: uv sync --all-extras --dev
+        run: uv sync --locked --all-extras --dev
 
       - name: Test
         run: |
diff --git a/docs/contributing.md b/docs/contributing.md
index b8844b89..9274e1c2 100644
--- a/docs/contributing.md
+++ b/docs/contributing.md
@@ -87,7 +87,10 @@ Ready to contribute? Here's how to set up `python-statemachine` for local develo
 
 1. Install dependencies.
    1. [graphviz](https://graphviz.org/download/#linux)
-   1. [uv](https://docs.astral.sh/uv/getting-started/installation/)
+   1. [uv](https://docs.astral.sh/uv/getting-started/installation/) 0.9.17 or newer
+      (older releases ignore the `[tool.uv]` settings in `pyproject.toml` and rewrite `uv.lock`).
+      The project resolves with a 7-day `exclude-newer` cooldown; to take a release younger
+      than that, use uv's `exclude-newer-package` setting.
 
 1. Fork the `python-statemachine` repository on GitHub.
 
diff --git a/pyproject.toml b/pyproject.toml
index ef7011b2..ae2a7d32 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -69,6 +69,9 @@ dev = [
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
+[tool.uv]
+exclude-newer = "7 days"
+
 [tool.hatch.build.targets.wheel]
 packages = ["statemachine/"]