From 0d76509fa05ac75b2af8aa40b18b119ee302a4eb Mon Sep 17 00:00:00 2001
From: Quentin Gliech <quenting@element.io>
Date: Wed, 1 Apr 2026 13:12:06 +0200
Subject: [PATCH] Adapt lockfile validation scripts and CI workflow for uv.lock

Update the three lockfile validation components to work with uv.lock
instead of poetry.lock:

- scripts-dev/check_locked_deps_have_sdists.py: Parse uv.lock format
  where sdist is a top-level key on each [[package]], skip the
  matrix-synapse project entry, use tomllib with tomli fallback
- .ci/scripts/check_lockfile.py: Check for version == 1 (uv format)
  instead of metadata.lock-version == "2.1" (Poetry format)
- .github/workflows/uv_lockfile.yaml: Trigger on uv.lock changes,
  drop the pip install tomli step since Python 3.x guarantees tomllib

Closes #19569

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .ci/scripts/check_lockfile.py                | 10 +++---
 .github/workflows/uv_lockfile.yaml           |  5 ++-
 scripts-dev/check_locked_deps_have_sdists.py | 33 ++++++++++++--------
 3 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/.ci/scripts/check_lockfile.py b/.ci/scripts/check_lockfile.py
index 46d3952b4c..d29452535d 100755
--- a/.ci/scripts/check_lockfile.py
+++ b/.ci/scripts/check_lockfile.py
@@ -6,17 +6,17 @@ if sys.version_info < (3, 11):
 
 import tomllib
 
-with open("poetry.lock", "rb") as f:
+with open("uv.lock", "rb") as f:
     lockfile = tomllib.load(f)
 
 try:
-    lock_version = lockfile["metadata"]["lock-version"]
-    assert lock_version == "2.1"
+    lock_version = lockfile["version"]
+    assert lock_version == 1
 except Exception:
     print(
         """\
-    Lockfile is not version 2.1. You probably need to upgrade poetry on your local box
-    and re-run `poetry lock`. See the Poetry cheat sheet at
+    Lockfile is not version 1. You probably need to upgrade uv on your local box
+    and re-run `uv lock`. See the dependency management documentation at
     https://element-hq.github.io/synapse/develop/development/dependencies.html
     """
     )
diff --git a/.github/workflows/uv_lockfile.yaml b/.github/workflows/uv_lockfile.yaml
index 5042a564f2..0788d86b3e 100644
--- a/.github/workflows/uv_lockfile.yaml
+++ b/.github/workflows/uv_lockfile.yaml
@@ -2,10 +2,10 @@ on:
   push:
     branches: ["develop", "release-*"]
     paths:
-      - poetry.lock
+      - uv.lock
   pull_request:
     paths:
-      - poetry.lock
+      - uv.lock
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -20,5 +20,4 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.x'
-      - run: pip install tomli
       - run: ./scripts-dev/check_locked_deps_have_sdists.py
diff --git a/scripts-dev/check_locked_deps_have_sdists.py b/scripts-dev/check_locked_deps_have_sdists.py
index f035ecb644..074575aa7e 100755
--- a/scripts-dev/check_locked_deps_have_sdists.py
+++ b/scripts-dev/check_locked_deps_have_sdists.py
@@ -22,25 +22,32 @@
 import sys
 from pathlib import Path
 
-import tomli
+try:
+    import tomllib
+except ModuleNotFoundError:
+    import tomli as tomllib
 
 
 def main() -> None:
-    lockfile_path = Path(__file__).parent.parent.joinpath("poetry.lock")
+    lockfile_path = Path(__file__).parent.parent.joinpath("uv.lock")
     with open(lockfile_path, "rb") as lockfile:
-        lockfile_content = tomli.load(lockfile)
+        lockfile_content = tomllib.load(lockfile)
 
-    # Poetry 1.3+ lockfile format:
-    # There's a `files` inline table in each [[package]]
-    packages_to_assets: dict[str, list[dict[str, str]]] = {
-        package["name"]: package["files"] for package in lockfile_content["package"]
-    }
+    packages: list[dict] = lockfile_content["package"]
 
     success = True
+    checked = 0
 
-    for package_name, assets in packages_to_assets.items():
-        has_sdist = any(asset["file"].endswith(".tar.gz") for asset in assets)
-        if not has_sdist:
+    for package in packages:
+        package_name = package["name"]
+
+        # Skip the project itself
+        if package_name == "matrix-synapse":
+            continue
+
+        checked += 1
+
+        if "sdist" not in package:
             success = False
             print(
                 f"Locked package {package_name!r} does not have a source distribution!",
@@ -49,13 +56,13 @@ def main() -> None:
 
     if not success:
         print(
-            "\nThere were some problems with the Poetry lockfile (poetry.lock).",
+            "\nThere were some problems with the uv lockfile (uv.lock).",
             file=sys.stderr,
         )
         sys.exit(1)
 
     print(
-        f"Poetry lockfile OK. {len(packages_to_assets)} locked packages checked.",
+        f"uv lockfile OK. {checked} locked packages checked.",
         file=sys.stderr,
     )