fix: uv sync --locked validates against pyproject.toml (--frozen does not) #11

Merged

john merged 1 commit from fix/dockerfile-uv-locked into dev

2026-07-30 03:46:46 +00:00

john commented

2026-07-30 03:33:24 +00:00

Owner

Problem

uv sync --frozen does not validate uv.lock against pyproject.toml. It only means "don't re-lock" — it installs whatever the lockfile already says, even if pyproject.toml has moved on. The flag that asserts the lock is up to date is --locked.

Combined with 2>/dev/null, a stale lockfile produced a silently wrong image: old dependencies installed, no error surfaced, no way to tell from the build log which branch of the || ran.

Fix

-    uv sync --frozen --no-dev 2>/dev/null || \
+    uv sync --locked --no-dev || \

--locked fails the command when uv.lock disagrees with pyproject.toml.
2>/dev/null removed, so when it fails the reason is in the build log.
The || uv sync --no-dev fallback is kept for the no-lockfile case.

Caveat on the fallback

The fallback means a stale lock is now visible but still not fatal — the build prints the error and then resolves dependencies fresh. That is a deliberate compromise to avoid breaking builds in repos without a committed lockfile. If we want stale locks to hard-fail, the fallback has to go, which is a separate decision.

Verification

uv lock --check run locally against this repo before the change.

Fleet-wide change: 7 Dockerfiles across 6 repos (smeos x2, haskos-engineering, haskos-sales, haskos-pm, haskos-legal, haskos-finance).

## Problem `uv sync --frozen` does **not** validate `uv.lock` against `pyproject.toml`. It only means "don't re-lock" — it installs whatever the lockfile already says, even if `pyproject.toml` has moved on. The flag that asserts the lock is up to date is `--locked`. Combined with `2>/dev/null`, a stale lockfile produced a silently wrong image: old dependencies installed, no error surfaced, no way to tell from the build log which branch of the `||` ran. ## Fix ```diff - uv sync --frozen --no-dev 2>/dev/null || \ + uv sync --locked --no-dev || \ ``` - `--locked` fails the command when `uv.lock` disagrees with `pyproject.toml`. - `2>/dev/null` removed, so when it fails the reason is in the build log. - The `|| uv sync --no-dev` fallback is kept for the no-lockfile case. ## Caveat on the fallback The fallback means a stale lock is now **visible but still not fatal** — the build prints the error and then resolves dependencies fresh. That is a deliberate compromise to avoid breaking builds in repos without a committed lockfile. If we want stale locks to hard-fail, the fallback has to go, which is a separate decision. ## Verification `uv lock --check` run locally against this repo before the change. Fleet-wide change: 7 Dockerfiles across 6 repos (smeos x2, haskos-engineering, haskos-sales, haskos-pm, haskos-legal, haskos-finance).

john added 1 commit

2026-07-30 03:33:24 +00:00