build: pin an absolute exclude-newer so CI can verify the lockfile

.github/workflows/ci.yml

@@ -29,10 +29,7 @@ jobs:
       - name: Install dependencies
         # Include the spark extra: ty must resolve pyspark to type-check the optional
         # engine. The test-duckdb leg is what proves a DuckDB-only install works.
-        # NOTE: no --locked. A machine-global `exclude-newer = "7 days"` in the
-        # maintainer's ~/.config/uv/uv.toml stamps a relative `exclude-newer-span`
-        # into uv.lock that CI cannot reproduce, so --locked can never be satisfied.
-        run: ./run.sh uv sync --extra spark --dev
+        run: ./run.sh uv sync --locked --extra spark --dev
       - name: Lint with ruff
         run: |
           ./run.sh uv run ruff check .
@@ -60,7 +57,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libegl1 libgl1 libxkbcommon-x11-0 libdbus-1-3
       - name: Install dependencies
-        run: ./run.sh uv sync --dev --python ${{ matrix.python-version }}
+        run: ./run.sh uv sync --locked --dev --python ${{ matrix.python-version }}
       - name: Verify interpreter
         run: |
           actual=$(
@@ -95,7 +92,7 @@ jobs:
           distribution: temurin
           java-version: '21'
       - name: Install dependencies
-        run: ./run.sh uv sync --extra spark --dev --python ${{ matrix.python-version }}
+        run: ./run.sh uv sync --locked --extra spark --dev --python ${{ matrix.python-version }}
       - name: Verify interpreter
         run: |
           actual=$(
@@ -122,7 +119,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libegl1 libgl1 libxkbcommon-x11-0 libdbus-1-3
       - name: Install dependencies
-        run: ./run.sh uv sync --dev --python 3.14
+        run: ./run.sh uv sync --locked --dev --python 3.14
       - name: Build and smoke test installed wheel
         run: ./run.sh uv run --python 3.14 python scripts/smoke_installed_wheel.py
 
@@ -157,7 +154,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libegl1 libgl1 libxkbcommon-x11-0 libdbus-1-3
       - name: Install dependencies
-        run: uv sync --dev --python 3.14
+        run: uv sync --locked --dev --python 3.14
       - name: Run offscreen Qt widget and integration smoke tests
         run: >-
           uv run --python 3.14 pytest -q --no-cov

pyproject.toml

@@ -36,6 +36,13 @@ wherewolf-desktop = "wherewolf.desktop.application:main"
 
 [tool.uv]
 cache-dir = "/tmp/wherewolf/.uv_cache"
+# Absolute UTC instant so the lockfile is reproducible and CI can verify it with
+# --locked. A bare date resolves to LOCAL midnight and differs per machine timezone.
+# A relative exclude-newer (e.g. the maintainer's global "7 days") writes a
+# machine-specific exclude-newer-span into uv.lock that CI cannot reproduce.
+exclude-newer = "2026-07-26T00:00:00Z"
+# polars 1.43.0/1.43.1 are yanked; 1.43.2 (the fix) postdates the pin.
+exclude-newer-package = { polars = false, "polars-runtime-32" = false, "polars-runtime-64" = false, pyludusavi = false }
 
 [tool.ruff]
 line-length = 100

tests/test_ci_workflow.py

@@ -28,9 +28,12 @@ def test_ci_install_contracts_match_the_tooling_each_leg_runs() -> None:
         for name in ("lint", "test-duckdb", "test-spark", "build", "qt-smoke")
     }
 
-    # Do not restore --locked: the maintainer's relative exclude-newer-span makes the
-    # lock impossible for CI to reproduce, even though the resolved dependencies are valid.
-    assert all("--locked" not in line for job in jobs.values() for line in _sync_lines(job))
+    # --locked is required: an absolute `exclude-newer` in pyproject.toml keeps uv.lock
+    # machine-independent, so CI can verify the lockfile is current. Reverting to a relative
+    # exclude-newer would reintroduce a machine-specific exclude-newer-span and break this.
+    assert all(any("--locked" in line for line in _sync_lines(job)) for job in jobs.values()), (
+        "every leg must install from the verified lockfile"
+    )
 
     lint_sync = _sync_lines(jobs["lint"])
     assert "ty check" in jobs["lint"]