Add lockfile consistency verification to check_dependencies CI #3064

What happened

PR #3035 had a stale uv.lock that didn't reflect the updated pyproject.toml constraints (mcp>=1.30.0 vs lockfile's mcp>=1.23.0, missing anthropic, stale litellm). The check_dependencies CI check passed despite this inconsistency because it only runs uv sync and uv pip list — it does not verify that uv.lock is consistent with pyproject.toml. CodeRabbit caught the stale lockfile in its second and third review rounds, but by then the author had already pushed additional commits.

What could go better

The .github/workflows/check_dependencies.yaml workflow runs uv sync (which succeeds even with a stale lockfile by updating it silently) and uv pip list (informational only). It does not run uv lock --check or uv sync --locked, which would fail fast if the lockfile is out of date. Adding this check would catch stale lockfiles on the first CI run, before any review — agent or human — needs to spend time identifying the problem. Confidence is high: uv lock --check is a standard uv feature designed for exactly this purpose, and the current workflow already sets up uv.

Proposed change

In .github/workflows/check_dependencies.yaml, add a step before uv sync that verifies lockfile consistency:

    - name: Verify lockfile consistency
      run: uv lock --check

Alternatively, change the existing uv sync step to use --locked mode:

    - name: Install dependencies
      run: uv sync --locked

Either approach will cause the CI check to fail immediately when uv.lock is stale relative to pyproject.toml, catching the exact class of error that required 4 CodeRabbit review rounds and 7 commits on PR #3035.

Validation criteria

After this change, any PR that modifies pyproject.toml dependency constraints without regenerating uv.lock should fail the check_dependencies CI check on its first run. Verify by examining the next 3 dependency-update PRs: the stale-lockfile error should appear in CI output rather than in review comments.

Related issues checked

Searched: uv lock check CI lockfile consistency; stale lockfile dependency check
Considered: fullsend-ai/fullsend#3132
fullsend-ai/fullsend#3132 proposes that the review agent detect hand-edited lockfiles missing transitive dependency updates. This proposal adds a repo-level CI gate that catches the problem earlier in the pipeline, independent of the review agent. They target different layers (CI vs agent review) and are complementary.

Generated by retro agent from #3035