ci: install uv.lock as committed instead of re-resolving

CI ran `uv sync --all-extras --dev` without `--locked`, so a stale or
inconsistent uv.lock never failed and the release build could test
versions other than the pinned ones. Both workflows now sync with
`--locked` and set `UV_LOCKED=1` so later `uv run` steps do not re-lock.

The committed lock records a 7-day `exclude-newer` span that only
existed in a contributor's global uv config, so `--locked` would fail
in CI. Declaring the cooldown in `[tool.uv]` makes the lock reproducible
from the project alone.

Fixes #677

Signed-off-by: Fernando Macedo <fgmacedo@gmail.com>

Author: fgmacedo

.github/workflows/python-package.yml

@@ -15,6 +15,8 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      UV_LOCKED: 1
     strategy:
       fail-fast: false
       matrix:
@@ -34,7 +36,7 @@ jobs:
         enable-cache: true
         cache-suffix: "python${{ matrix.python-version }}"
     - name: Install the project
-      run: uv sync --all-extras --dev
+      run: uv sync --locked --all-extras --dev
       #----------------------------------------------
       #              run ruff
       #----------------------------------------------

.github/workflows/release.yml

@@ -7,6 +7,8 @@ jobs:
   release-build:
     name: Build release artifacts
     runs-on: ubuntu-latest
+    env:
+      UV_LOCKED: 1
 
     permissions:
       id-token: write
@@ -27,7 +29,7 @@ jobs:
           enable-cache: true
 
       - name: Install the project
-        run: uv sync --all-extras --dev
+        run: uv sync --locked --all-extras --dev
 
       - name: Test
         run: |

docs/contributing.md

@@ -87,7 +87,10 @@ Ready to contribute? Here's how to set up `python-statemachine` for local develo
 
 1. Install dependencies.
    1. [graphviz](https://graphviz.org/download/#linux)
-   1. [uv](https://docs.astral.sh/uv/getting-started/installation/)
+   1. [uv](https://docs.astral.sh/uv/getting-started/installation/) 0.9.17 or newer
+      (older releases ignore the `[tool.uv]` settings in `pyproject.toml` and rewrite `uv.lock`).
+      The project resolves with a 7-day `exclude-newer` cooldown; to take a release younger
+      than that, use uv's `exclude-newer-package` setting.
 
 1. Fork the `python-statemachine` repository on GitHub.
 

pyproject.toml

@@ -69,6 +69,9 @@ dev = [
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
+[tool.uv]
+exclude-newer = "7 days"
+
 [tool.hatch.build.targets.wheel]
 packages = ["statemachine/"]