ci: install with uv sync --locked so a stale uv.lock fails the run

.github/workflows/coverage.yml

@@ -47,7 +47,7 @@ jobs:
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Sync dependencies
-      run: uv sync
+      run: uv sync --locked
 
     - name: Generate coverage report
       run: |

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Sync dependencies
-      run: uv sync --group dev --extra jwt
+      run: uv sync --locked --group dev --extra jwt
 
     # `tests` is linted here too. pre-commit only sees staged files, so test
     # code that was never touched again drifts; that is how the suite came to

.github/workflows/lowest.yml

@@ -51,7 +51,7 @@ jobs:
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Sync dependencies
-      run: uv sync
+      run: uv sync --locked
 
     - name: Test with the lowest direct dependencies
       run: uv run tox -e lowest

.github/workflows/release.yml

@@ -106,7 +106,7 @@ jobs:
       # a missing backend package would turn the gate below into a formality,
       # so it does not rely on a dev-group entry staying put.
       - name: Sync dependencies
-        run: uv sync --group dev --extra jwt --extra redis --extra memcached
+        run: uv sync --locked --group dev --extra jwt --extra redis --extra memcached
 
       # The gate. A release is the one run where a red test result arrives too
       # late to matter, so everything CI checks elsewhere is checked here too,

.github/workflows/test.yml

@@ -54,7 +54,7 @@ jobs:
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
     - name: Sync dependencies
-      run: uv sync --extra jwt
+      run: uv sync --locked --extra jwt
 
     - name: Run tests
       run: uv run coverage run -m pytest && uv run coverage report

docs/DEVELOPMENT.md

@@ -195,7 +195,10 @@ The hooks cover the standard pre-commit-hooks checks, `ruff` (with `--fix`) and
 `docs/` and `scripts/`). They run automatically on `git commit`. If any checks fail, fix the issues and try committing again.
 `uv-lock` only re-resolves the lockfile when `pyproject.toml` changed; it does not
 upgrade pinned versions. Upgrades come from Renovate or an explicit
-`uv lock --upgrade`.
+`uv lock --upgrade`. Every CI workflow installs with `uv sync --locked`, which
+fails when `uv.lock` does not match `pyproject.toml`, so a pull request that
+changes a dependency without committing the relocked `uv.lock` goes red
+instead of quietly re-resolving on the runner.
 
 pre-commit only sees the files you touched. The **Lint** workflow checks the
 whole tree; run the same commands before pushing: