What the developer wrote
Authored by M1nd3r
chore(ci): add `uv.lock` prebuild check
Check whether the `uv.lock` file is up-to-date.
[no changelog]
What changed, and why it matters
This commit adds a new automated CI check that verifies the project's Python dependency lock file (uv.lock) is up-to-date. It does not change any firmware code, fix a bug, or alter security-critical behavior. It is purely a build/development hygiene improvement.
No security action required. Treat as routine CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change introduces a GitHub Actions job named uvlock_check in .github/workflows/prebuild.yml and a corresponding uvlock_check target in the Makefile. The Makefile target runs uv lock --check, which fails if uv.lock is not synchronized with pyproject.toml. This is a preventive CI measure to ensure reproducible dependency resolution; it has no runtime security effect on its own.
Changed components
.github/workflows/prebuild.ymlMakefileInspect captured patch +19 / −0
diff --git a/.github/workflows/prebuild.yml b/.github/workflows/prebuild.yml
index 7d9f7155..05ad8a7c 100644
--- a/.github/workflows/prebuild.yml
+++ b/.github/workflows/prebuild.yml
@@ -70,6 +70,21 @@ jobs:
- name: "Run gen check"
run: nix-shell --run "uv run make gen_check"
+ # Check uv.lock is up-to-date
+ uvlock_check:
+ name: uv.lock check
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # actions/checkout@v6.0.2
+ with:
+ submodules: "recursive"
+ - name: Install nix
+ uses: cachix/install-nix-action@2126ae7fc54c9df00dd18f7f18754393182c73cd # cachix/install-nix-action@v31.9.1
+ with:
+ nix_path: nixpkgs=channel:nixos-unstable
+ - name: "Run uv.lock check"
+ run: nix-shell --run "make uvlock_check"
+
# Verifying that all commits changing some functionality have a changelog entry
# or contain `[no changelog]` in the commit message.
changelog_check:
diff --git a/Makefile b/Makefile
index 6178a4b7..8fb58f22 100644
--- a/Makefile
+++ b/Makefile
@@ -202,3 +202,7 @@ hsm_keys_check:
gen: templates mocks icons protobuf vendorheader solana_templates bootloader_hashes lsgen tropic_model_config hsm_keys ## regenerate auto-generated files from sources
gen_check: templates_check mocks_check icons_check protobuf_check vendorheader_check solana_templates_check bootloader_hashes_check lsgen_check tropic_model_config_check hsm_keys_check ## check validity of auto-generated files
+
+uvlock_check: ## check that uv.lock is up to date
+ @echo [UVLOCK-CHECK]
+ uv lock --check
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.