From 704c5679315d3ca92212c6ec5a99acbb8f24d1b3 Mon Sep 17 00:00:00 2001
From: Golo Roden <golo.roden@thenativeweb.io>
Date: Sat, 1 Aug 2026 10:37:29 +0200
Subject: [PATCH] chore: keep uv.lock in sync automatically

uv.lock kept drifting behind pyproject.toml because nothing updated the
two together. There were two sources for that:

- Dependabot ran as the `pip` ecosystem, which only knows pyproject.toml.
  Switching to the `uv` ecosystem makes it maintain both files in one PR.
- The release workflow bumped the version in pyproject.toml without
  re-locking, so uv.lock still claimed 1.9.0 while the project was at
  1.9.1. It now runs `uv lock` and commits the result along with it.

To keep this from silently coming back, `make qa` now verifies via
`uv lock --check` that the lockfile matches pyproject.toml. Also refresh
uv.lock, which was still on 1.9.0 from the last release.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3ADPwk11GHQF7BBwQHaPz
---
 .github/dependabot.yml        | 6 +++---
 .github/workflows/release.yml | 3 ++-
 Makefile                      | 7 ++++++-
 uv.lock                       | 2 +-
 4 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 774b765..20ab5a4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,6 @@
 version: 2
 updates:
-  - package-ecosystem: pip
+  - package-ecosystem: uv
     directory: "/"
     cooldown:
       default-days: 7
@@ -15,14 +15,14 @@ updates:
       prefix: fix
       prefix-development: chore
     groups:
-      pip-production:
+      uv-production:
         dependency-type: production
         patterns:
           - "*"
         update-types:
           - minor
           - patch
-      pip-development:
+      uv-development:
         dependency-type: development
         patterns:
           - "*"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bc9d915..02a6beb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,9 +39,10 @@ jobs:
       if: ${{ steps.get_next_version.outputs.hasNextVersion == 'true' }}
       run: |
         sed -i -r "s/(version = \")([0-9]+\.[0-9]+\.[0-9]+)(\")/\1${{ steps.get_next_version.outputs.version }}\3/" pyproject.toml
+        uv lock
         git config --global user.email "hello@thenativeweb.io"
         git config --global user.name "${{ github.actor }}"
-        git add pyproject.toml
+        git add pyproject.toml uv.lock
         git commit -m 'chore: Bump version to ${{ steps.get_next_version.outputs.version }}. [skip ci]'
         git push
         git tag ${{ steps.get_next_version.outputs.version }}
diff --git a/Makefile b/Makefile
index 1c4e317..0b6b237 100644
--- a/Makefile
+++ b/Makefile
@@ -2,12 +2,16 @@ PACKAGE := eventsourcingdb
 TEST_DIR := tests
 PYTHON_DIRS := $(PACKAGE) $(TEST_DIR)
 
-qa: analyze typecheck security test 
+qa: verify-lock analyze typecheck security test
 
 analyze:
 	@echo "Running code analysis..."
 	@uv run ruff check $(PYTHON_DIRS)
 
+verify-lock:
+	@echo "Verifying dependency lock..."
+	@uv lock --check
+
 build: qa clean
 	@echo "Build prepared."
 
@@ -61,4 +65,5 @@ typecheck:
 		security \
 		test \
 		typecheck \
+		verify-lock \
 		clean
diff --git a/uv.lock b/uv.lock
index 61e7323..c52bfa1 100644
--- a/uv.lock
+++ b/uv.lock
@@ -492,7 +492,7 @@ wheels = [
 
 [[package]]
 name = "eventsourcingdb"
-version = "1.9.0"
+version = "1.9.1"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },