From 396697b4f08c8554fdbe5bf38493e16c71eea13c Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:51:10 -0600
Subject: [PATCH] Fail the release when uv.lock is behind the latest releases

A release could ship or test against whatever uv.lock held, even when
newer releases allowed by pyproject.toml existed.

- Add a release workflow step that runs `uv lock --upgrade --dry-run` and
  fails unless uv reports no lockfile changes
- Document the same check in the pre-tag steps in AGENTS.md

Amp-Thread-ID: https://ampcode.com/threads/T-01a1ca38-20a5-7436-a7ae-1f2bce712489
Co-authored-by: Amp <amp@ampcode.com>
---
 .github/workflows/release.yml | 10 ++++++++++
 AGENTS.md                     |  6 ++++++
 2 files changed, 16 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a67d4bb..dce4af2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -115,6 +115,16 @@ jobs:
           echo "tag=${release_tag}" >> "${GITHUB_OUTPUT}"
           echo "version=${release_tag#v}" >> "${GITHUB_OUTPUT}"
 
+      - name: Validate lockfile freshness
+        run: |
+          upgrade_plan="$(uv lock --upgrade --refresh --dry-run 2>&1)" || true
+          echo "${upgrade_plan}"
+          if ! grep -q "No lockfile changes detected" <<<"${upgrade_plan}"; then
+            echo "::error title=Lockfile freshness::uv did not confirm that uv.lock is on the latest releases pyproject.toml allows."
+            echo "::error::If updates are listed above, merge the Renovate lock file maintenance PR, then tag the new main commit."
+            exit 1
+          fi
+
       - name: Validate runtime dependencies
         run: |
           runtime_requirements_file="build/release/runtime-requirements.txt"
diff --git a/AGENTS.md b/AGENTS.md
index 207b4db..54b2379 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -60,6 +60,10 @@ uv run python -m unittest discover -s tests
 - The release workflow builds from the tag and checks that wheel and source
   distribution filenames match the tag version before publishing.
 - Do not make the release workflow edit `pyproject.toml` or `uv.lock`.
+- The release workflow fails when `uv.lock` is behind the latest releases
+  `pyproject.toml` allows. Before tagging, merge open Renovate PRs and run the
+  freshness check on `origin/main`. If it lists updates, tick the lock file
+  maintenance box on the Dependency Dashboard issue and merge that PR first.
 - Tag the remote head of `main` directly:
 
 ```sh
@@ -71,6 +75,8 @@ GH_REPO="sourcegraph/src-py-lib"
 
 [[ "${VERSION_INPUT}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]
 git fetch origin --tags --prune
+test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)"
+uv lock --upgrade --refresh --dry-run 2>&1 | tee /dev/stderr | grep "No lockfile changes detected"
 MAIN_COMMIT="$(git rev-parse origin/main)"
 git tag -a "v${VERSION}" "${MAIN_COMMIT}" -m "Release v${VERSION}"
 git push origin "v${VERSION}"