Stop prek hooks changing uv.lock and fail CI when it is stale

.pre-commit-config.yaml

@@ -17,11 +17,15 @@
 ---
 default_stages: [pre-commit, pre-push]
 default_install_hook_types: [pre-commit, commit-msg]
-minimum_prek_version: '0.3.4'
+minimum_prek_version: '0.4.8'
 default_language_version:
   python: python3
   node: 22.19.0
   golang: 1.25.0
+default_env:
+  # Unless overridden, no hook defined in this file should change the resolutions in uv.lock; they use
+  # the committed ones. Hooks in nested configs do not inherit this and must pass --frozen to uv themselves.
+  UV_FROZEN: "1"
 exclude: ^.*/.*_vendor/
 repos:
   - repo: meta
@@ -565,6 +569,7 @@ repos:
         name: Upgrade important versions (manual)
         entry: ./scripts/ci/prek/upgrade_important_versions.py
         stages: ['manual']
+        env: {UV_FROZEN: "0"}
         language: python
         files: >
           (?x)
@@ -577,6 +582,7 @@ repos:
         name: Upgrade curated dependency floors (manual)
         entry: ./scripts/ci/prek/upgrade_dependency_floors.py
         stages: ['manual']
+        env: {UV_FROZEN: "0"}
         language: python
         files: >
           (?x)
@@ -1585,13 +1591,15 @@ repos:
         files: ^dev/breeze/src/airflow_breeze/global_constants\.py$
         require_serial: true
         # This is a fast regular hook that runs when any pyproject.toml changes.
-        # It runs locally with `--frozen` so the lock is only verified against pyproject.toml,
-        # never silently rewritten during a commit. If a pyproject.toml change makes the lock
-        # stale, the hook fails and the contributor must run `uv lock` explicitly and commit
-        # the refreshed uv.lock — which keeps lock updates intentional and reviewable.
+        # It runs `uv lock --check`, so the lock is verified against pyproject.toml but never
+        # rewritten during a commit. If a pyproject.toml change makes the lock stale, the hook
+        # fails and the contributor must run `uv lock` explicitly and commit the refreshed
+        # uv.lock — which keeps lock updates intentional and reviewable. UV_FROZEN is disabled
+        # because under it `--check` only validates the lock, it does not detect staleness.
       - id: update-uv-lock
         name: Update uv.lock
-        entry: uv lock --frozen
+        entry: uv lock --check
+        env: {UV_FROZEN: "0"}
         language: system
         files: >
           (?x)

contributing-docs/07_local_virtualenv.rst

@@ -287,8 +287,12 @@ or when running tests), you can pass the ``--frozen`` flag:
 
     uv sync --frozen
 
-This will fail if the lock file is out of date with respect to ``pyproject.toml``, rather than
-silently updating it. This is useful when you want to guarantee fully reproducible environments.
+This never resolves or writes to the lock file, even when it is out of date with respect to
+``pyproject.toml``. Use ``--locked`` (or ``uv lock --check``) to fail on a stale lock file instead.
+
+A change to a ``pyproject.toml`` (including a workspace member's version) must be committed together
+with the refreshed ``uv.lock``: run ``uv lock``. The ``update-uv-lock`` prek hook, which also runs in CI,
+fails otherwise. All other prek hooks run ``uv`` frozen and never change ``uv.lock``.
 
 Cooldown via ``exclude-newer``
 ..............................

dev/breeze/src/airflow_breeze/utils/selective_checks.py

@@ -1925,7 +1925,6 @@ def docs_list_as_string(self) -> str | None:
     def skip_prek_hooks(self) -> str:
         prek_hooks_to_skip = set()
         prek_hooks_to_skip.add("identity")
-        prek_hooks_to_skip.add("update-uv-lock")
         if self._default_branch != "main":
             # Skip those tests on all "release" branches
             prek_hooks_to_skip.update(