Skip to content

Force UV_FROZEN=0 for uv-lock hook - #71

Open
jfra1397 wants to merge 1 commit into
astral-sh:mainfrom
jfra1397:fix-uv-lock-frozen
Open

Force UV_FROZEN=0 for uv-lock hook#71
jfra1397 wants to merge 1 commit into
astral-sh:mainfrom
jfra1397:fix-uv-lock-frozen

Conversation

@jfra1397

Copy link
Copy Markdown

Closes #70.

When UV_FROZEN=1 is set in the environment (common in CI), uv lock enables its --check-exists semantics: it verifies that uv.lock exists but does not check if it is up-to-date and does not update it. The uv-lock pre-commit hook then passes even when pyproject.toml has drifted from uv.lock, so lockfile drift can slip through pre-commit unnoticed.

This PR prefixes the hook's entry with env UV_FROZEN=0 so it always exercises the "update the lockfile" path regardless of what the surrounding environment sets. Users who want a check-only variant can still call uv lock --check directly.

Marked as draft — happy to switch to a different approach (e.g. entry: env -u UV_FROZEN uv lock, or args: ["--check"] as a behavior change) if the maintainers prefer.

Portability note: this relies on env being on PATH, which is true on POSIX systems. Not sure how it fares for pre-commit users on Windows — feedback welcome.

When UV_FROZEN=1 is set in the environment (common in CI), `uv lock`
enables --check-exists semantics: it verifies uv.lock exists but does
not check if it is up-to-date and does not update it. The hook then
passes even when pyproject.toml has drifted from uv.lock, so lockfile
drift can slip through pre-commit unnoticed.

Prefix the entry with `env UV_FROZEN=0` so the hook always exercises
the "update the lockfile" path regardless of what the surrounding
environment sets. Users who genuinely want a check-only variant can
still call `uv lock --check` directly.

Closes astral-sh#70
@jfra1397
jfra1397 force-pushed the fix-uv-lock-frozen branch from 11f66f9 to 52ffe4f Compare July 14, 2026 08:12
@jfra1397
jfra1397 marked this pull request as ready for review July 17, 2026 18:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

uv-lock hook can pass with an outdated lockfile when UV_FROZEN=1

1 participant