fix(hooks): run the uv hooks with --locked so lock drift is loud

[Cipher208]

A bare uv run re-resolves and rewrites uv.lock whenever pyproject.toml has drifted from it. Inside a pre-commit hook that is destructive in a way that takes a while to see: the rewrite lands on a file the hook is not allowed to change, pre-commit stashes the commit, the auto-fix conflicts with the stash, and it rolls everything back with Stashed changes conflicted with hook auto-fixes. The commit silently never happens, and uv.lock is left modified in the working tree. I lost two commits to this in this session before spotting it.

That is also how the five Dependabot PRs (#71-#75) could each leave the lock stale: locally, the first commit attempt would have quietly repaired it.

Why --locked and not --frozen

Measured on a deliberately drifted lock (alembic>=1.19.0 against a locked 1.20.0):

flag	exit code	rewrites lock	fails loudly
--frozen	0 — proceeds silently	no	no
--locked	2 + clear error	no	yes

--frozen stops the destructive rewrite but happily runs against a stale lock, so the drift stays invisible. --locked stops the rewrite and fails, which is what makes it visible:

pytest gate (full suite).................................................Failed
- hook id: pytest-gate
- exit code: 2
error: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.

Checked both directions: with a consistent lock the commit goes through and git hash-object uv.lock is byte-identical before and after (no quiet rewrite); with drift the commit is blocked with exit code 1 and no stash-rollback.

This matches the uv lock --check gate added to CI in d12e941, so local and CI now agree.

The two --isolated --with ruff invocations in prepush-gate are deliberately left alone: --isolated ignores the project, so they never touch the lock.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: Cipher208/a-memory/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 41652a71-6d62-47b7-8ab0-28134c4fa62a

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}