@biffo/cli 0.298.28 → 0.298.31

package/_skeletons/plugin-template/.github/workflows/ci.yml

@@ -41,7 +41,14 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-      - run: uv sync --all-groups
+      # `--locked` mirrors the root repo's own `ci.yml` (see the comment
+      # there): plain `uv sync` silently RE-RESOLVES when `pyproject.toml`
+      # has drifted from `uv.lock`, so a dependency bump committed without
+      # re-running `uv lock` still installs and still goes green — the
+      # committed lock just stops describing what actually ran. Every
+      # `uv sync` call in this workflow carries it for the same reason
+      # (biffo-template#1731).
+      - run: uv sync --all-groups --locked
       - run: uv run ruff check .
       - run: uv run ruff format --check .
 
@@ -54,7 +61,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-      - run: uv sync --all-groups
+      - run: uv sync --all-groups --locked
       - run: uv run pyright
 
   test:
@@ -66,7 +73,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-      - run: uv sync --all-groups
+      - run: uv sync --all-groups --locked
       # `--cov-report=json` is additive to the xml Codecov reads: the step
       # below (`scripts/error_branch_coverage.py`) reads coverage.json and
       # nothing else, so without this line it has no input and exits 2 ("no
@@ -180,7 +187,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-      - run: uv sync --all-groups
+      - run: uv sync --all-groups --locked
       # Authoritative check: load_manifest() runs the *real* Pydantic model
       # (biffo_plugin_sdk.plugin.PluginManifest) that the SDK, the Core API's
       # discover_plugin_manifests(), and `biffo plugin install` all actually
@@ -305,7 +312,7 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-      - run: uv sync --all-groups
+      - run: uv sync --all-groups --locked
       # Fails on a real advisory, but treats an unreachable PyPI/OSV as
       # INCONCLUSIVE rather than reddening a required check for an
       # infrastructure hiccup (#591, #743). The raw `uv run pip-audit` this

package/_skeletons/plugin-template/.github/workflows/release.yml

@@ -90,7 +90,18 @@ jobs:
         with:
           enable-cache: true
 
-      - run: uv sync --all-groups
+      # `--locked` mirrors every `uv sync` call site in this skeleton's own
+      # ci.yml (see the comment there): plain `uv sync` silently
+      # RE-RESOLVES when `pyproject.toml` has drifted from `uv.lock`, so a
+      # dependency bump committed without re-running `uv lock` still
+      # installs and still succeeds — the committed lock just stops
+      # describing what actually ran. This workflow fires on every `v*` tag
+      # push and is what actually builds and publishes the release
+      # artefact, so drift here ships silently rather than failing closed
+      # (biffo-template#1731, missed here originally and fixed per #1762;
+      # see scripts/uv-sync-locked.test.sh for the guard that now checks
+      # every call site under _skeletons/**/.github/workflows/**).
+      - run: uv sync --all-groups --locked
 
       # Full CI gate re-run on the tag, not just a build — a tag push must
       # be at least as strict as a merged PR before anything is published.

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -182,7 +182,13 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-      - run: uv sync --all-groups
+      # `--locked` mirrors the root repo's own `ci.yml` (see the comment
+      # there): plain `uv sync` silently RE-RESOLVES when `pyproject.toml`
+      # has drifted from `uv.lock`, so a dependency bump committed without
+      # re-running `uv lock` still installs and still goes green — the
+      # committed lock just stops describing what actually ran
+      # (biffo-template#1731).
+      - run: uv sync --all-groups --locked
       - name: Lint
         if: ${{ !cancelled() }}
         run: uv run ruff check .

package/dist/index.js

@@ -809,7 +809,13 @@ var EMPTY_SUMMARY = () => ({
 async function planCoreUpgrade(options) {
   const mergeFile = options.mergeFile ?? gitMergeFile;
   const trackedOnly = { trackedOnly: true };
-  const base = new Set(listTemplateOwnedFiles(options.baseDir, options.manifest, trackedOnly));
+  const baseManifestPath = join5(options.baseDir, CORE_MANIFEST_FILE);
+  const baseManifest = existsSync5(baseManifestPath) ? readCoreManifest(options.baseDir) : null;
+  const base = new Set(
+    listTemplateOwnedFiles(options.baseDir, options.manifest, trackedOnly).filter(
+      (path) => baseManifest === null || isTemplateOwned(path, baseManifest)
+    )
+  );
   const ours = new Set(listTemplateOwnedFiles(options.oursDir, options.manifest));
   const theirs = new Set(listTemplateOwnedFiles(options.theirsDir, options.manifest, trackedOnly));
   const divergentPrefixes = readDivergenceConfig(options.oursDir).warnOnly.map((e) => e.prefix);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.298.28",
+  "version": "0.298.31",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",