[MaxGhenis]

Part of #2128.

What this does

Since 38c63df (10/11), the tests install from uv.lock through .github/actions/test-environment. Lint and the documentation build still installed the newest releases, so a new upstream release could change what every pull request was checked against. That's how policyengine-core 3.32.16 broke every open PR's Test job on 10/3.

Job	Before	After
Lint (pr_code_changes, code_changes, Release lint in versioning)	uvx ruff, the newest ruff	the ruff uv.lock pins (uv export --frozen), the same way Versioning already runs towncrier; fails if the lock pins none
Documentation build (pr_code_changes Docs, pr_docs_changes)	uv pip install -e .[dev] --system, plus policyengine and jupyter-book, all newest	./.github/actions/test-environment, i.e. uv sync --frozen --extra dev with .venv/bin on PATH

Unchanged on purpose: the PR smoke-import matrix and Release install (Compat), which test the newest dependencies on Python 3.11–3.14, and the sdist install check.

uv pip install policyengine was dropped. Nothing in policyengine_uk or docs imports it, and on 10/3 it downgraded microdf-python in the system environment.

Verified

• Locked ruff (0.17.0) passes ruff format --check ., ruff check . and ruff check --select F811,F821 policyengine_uk on this branch. I ran the Lint steps' shell exactly as written, with a local GITHUB_ENV.
• The documentation build passed on the locked environment in run 37171779310 (10/4). This PR's own Docs jobs re-check it on today's lock (jupyter-book 2.1.7).
• actionlint is clean on the four workflows.
• After review: the Lint step runs under set -euo pipefail and fails unless the lock pins exactly one ruff. I checked locally that it fails clearly when the lock pins no ruff, pins two, or uv export fails.

Follow-up: --frozen installs the lock as committed but does not check that it matches pyproject.toml. That needs the lock's own version line kept in step on release. #2129 is being reworked for prepare_release.py.

Reproducer: n/a: CI workflows only with no model source or dependency file changes

axiom: n/a: CI only

🤖 Generated with Claude Code

Infra backlog update (23 October 2026)

Merged origin/main (a45baf5e4) with a merge commit. Kept the approved locked-ruff and locked-documentation intent, together with main's guard against agent notes at the repository root. The release workflow merged cleanly and includes #2399's statutory-pay fix.

Local validation uses Python 3.13 and UV_LINK_MODE=clone uv sync --frozen --extra dev (core 3.33.2). The current ruff format check, all three pinned-ruff lint blocks and nine failure probes, actionlint on all four changed workflows, and the documentation build pass. The hand-off comment records the focused pytest result and final head.

Vahid's approval still covers the substantive result: there is no expansion of the approved change. The new delta only merges main and preserves its root-note guard. The hub retains final review and landing.

[MaxGhenis]

Hand-off to the UK hub (session local_558c838a).

• Head: 9d55a5c8e. Ready for review now.
• Reviews: GPT-6.1 Sol APPROVE at 2aa36ec53 (~/reviews/uk-ci-lock-2026-10-04/review-2394.md). Delta review APPROVE at 9d55a5c8e (review-2394-delta.md), covering the pipefail and exactly-one-ruff change.
• CI at 2aa36ec53:
  • Lint, Release lint, Documentation build, smoke imports, Release build and Release install all passed with the locked ruff and environment.
  • Fix evidence failed only for the missing Reproducer: n/a line, which is now in the body.
  • Release test 3/4 failed on a random Hypothesis counterexample in test_uc_statutory_pay_properties.py::test_award_never_rises_with_a_claimants_statutory_pay. That's unrelated to this CI-only PR, and a fix is proposed separately (task_90f65de2). If it recurs, re-run the job.
• CI at 9d55a5c8e: queued; Actions is backed up.
• Depends on: nothing. Merge with a merge commit on the gates.
• Follow-ups: after Keep uv.lock's own version in step with pyproject on release #2129 lands and its first release commit brings main's uv.lock own-version line into step, switch .github/actions/test-environment from uv sync --frozen to --locked (proposed as its own session), then close Install CI dependencies from uv.lock #2128.

🤖 Generated with Claude Code

[vahid-ahmadi]

Looks right, fine to approve. Merging main first should make Release test pass.

@MaxGhenis, Lint now uses the ruff that uv.lock pins. Both documentation builds now use the same locked environment as the tests.

1. should: merge main before landing. Release test / Python 3/4 failed at 9d55a5c8e on test_award_never_rises_with_a_claimants_statutory_pay. That is the #2397 wheel-only failure, which #2399 has since fixed on main. This PR only changes workflows. The merge with main is clean.
2. nit: the ruff lookup block is now copied three times (code_changes.yaml:87, pr_code_changes.yaml:117, versioning.yaml:276). A small composite action, like test-environment, would keep the three in step. Fine to leave for later.
3. note, no change needed: the docs jobs no longer install policyengine, and the lock doesn't include it. Nothing under docs/ imports it, and notebooks don't run (execute_notebooks: off in docs/book/_config.yml). Both docs jobs passed at this head.

The set -euo pipefail with { grep ... || true; } and the exactly-one check fail with a clear message when the lock has no ruff or several, and not otherwise. uv pip install --system . in pr_code_changes.yaml:98 is still unlocked, but that is the smoke-import job, which is meant to test what a user installs.

What I checked

• The lookup and the three ruff calls run locally at 9d55a5c8e: they resolve ruff==0.17.0. Format check and both ruff check runs pass.
• uv export --frozen --extra dev includes jupyter-book==2.1.7 and no policyengine. I grepped docs/ for imports of policyengine.
• On a local merge with main, no workflow still calls uvx ruff without --from.
• CI at 9d55a5c8e: Lint, Release lint, Documentation build and Test documentation builds passed. The only failure was Release test 3/4 (point 1). I did not run the docs build locally.
• None of my open PRs touch these workflows.

🤖 Generated with Claude Code

[vahid-ahmadi]

Approving, per my review comment above.

[MaxGhenis]

Infra backlog hand-off (23 October 2026).

• Head: 11e835f7e52bcf50c1c1060b2faa07137cea4571 on ci-lint-docs-from-lock; merged origin/main at a45baf5e490928db20fda96eb845214853fe8068 with a merge commit. Shared history and PR author preserved.
• Changes: retained the approved pinned-ruff and locked-docs installation; resolved the PR workflow conflict by also preserving main's root-note guard. versioning.yaml merged cleanly. Main contains Fix benefit-cap statutory-pay earnings exemption #2399 (856547430), fixing the former Release-test statutory-pay failure.
• Approval: Vahid's approval still covers the substantive result. The new delta merges main and retains its guard without expanding this PR's approved intent. This is not a new approval; the hub reviews and lands.
• Tests: local Python 3.13 locked environment (UV_LINK_MODE=clone uv sync --frozen --extra dev; core 3.33.2); pytest -n 2 policyengine_uk/tests/test_uc_statutory_pay_properties.py -q: 8 passed in 569.69s, including the original failing property and deterministic cap regression. uvx ruff format --check .: 1,956 files pass. All 3 exact pinned lint workflow blocks plus 9 failure probes pass. actionlint passes on all 4 changed workflows. Locked make documentation passes (existing MyST configuration warnings).
• Resource gate: foreground tests/build; load1 below 110, statvfs free disk above 55 GB decimal, compressor below 30 GB; BLAS/OpenMP threads capped at 2.
• Impact/open items: CI-only diff against main; no model/dependency-file changes. Current-head remote CI, especially Release test on the wheel, is for the hub to gate. No merge, close or ready action taken.