ci: add uv.lock sync practices to GitHub workflows (#48)

* Initial plan

* Add uv.lock sync practices to GitHub workflows

- ci.yml: Use `uv sync --locked` to catch lockfile drift
- publish-to-pypi.yml: Use `uv build --no-sources` to validate metadata
- release.yml: Auto-update uv.lock on release-please PRs

Co-authored-by: deviantintegral <255023+deviantintegral@users.noreply.github.com>

* chore: update uv.lock to match pyproject.toml version 0.4.0

Co-authored-by: deviantintegral <255023+deviantintegral@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: deviantintegral <255023+deviantintegral@users.noreply.github.com>

Author: Copilot

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.13"
-      - run: uv sync --all-extras --dev
+      - run: uv sync --locked --all-extras --dev
       - name: Lint
         run: uv run ruff check .
       - name: Format check

.github/workflows/publish-to-pypi.yml

@@ -32,7 +32,7 @@ jobs:
               print(tomllib.load(f)['project']['version'])
           ")
           sed -i "s/^version = \".*\"/version = \"${CURRENT_VERSION}.dev${GITHUB_RUN_NUMBER}\"/" pyproject.toml
-      - run: uv build
+      - run: uv build --no-sources
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: python-package-distributions

.github/workflows/release.yml

@@ -23,3 +23,25 @@ jobs:
         with:
           release-type: python
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        if: steps.release.outputs.pr && !steps.release.outputs.release_created
+        with:
+          ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7
+        if: steps.release.outputs.pr && !steps.release.outputs.release_created
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        if: steps.release.outputs.pr && !steps.release.outputs.release_created
+        with:
+          python-version: "3.13"
+      - name: Update uv.lock
+        if: steps.release.outputs.pr && !steps.release.outputs.release_created
+        run: |
+          uv lock
+          if [ -n "$(git status --porcelain uv.lock)" ]; then
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git add uv.lock
+            git commit -m "chore: update uv.lock for release"
+            git push
+          fi