build: commit uv.lock and install with --locked in CI

uv.lock was gitignored, so every CI run resolved the dev toolchain
(pytest, mypy, ruff, sphinx and ~70 transitive packages) fresh, and the
Dependabot `uv` entry from #210 had no lockfile to update. The runtime
footprint is one dependency, so the lock is about reproducible CI and
reviewable tool upgrades, not what ships in the wheel.

- uv.lock committed (76 packages; the local file was current except for
  pyx12's own version entry, now 4.1.0rc1). Removed from .gitignore.
- Both workflows use `uv sync --locked`, so a pyproject.toml change
  without a matching `uv lock` fails CI instead of silently re-resolving.
- Dependabot Python entry back to the `uv` ecosystem; grouped weekly.
- CLAUDE.md: any PR touching pyproject.toml, including the `version`
  field the lock records, re-locks in the same PR. The publish skill's
  pre-flight gains `uv lock --check`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: azoner

.claude/skills/publish/SKILL.md

@@ -28,6 +28,7 @@ Tell the user the version (e.g. `4.0.0rc1` or `4.0.0`) and what will happen
 ### 3. Pre-flight verification
 All of these must pass before tagging:
 ```
+uv lock --check          # version bump must have re-locked; CI runs uv sync --locked
 .venv/Scripts/python.exe -m pytest pyx12/test/
 .venv/Scripts/python.exe -m mypy --strict pyx12
 .venv/Scripts/python.exe -m ruff check pyx12

.github/dependabot.yml

@@ -7,7 +7,7 @@ updates:
     groups:
       actions:
         patterns: ["*"]
-  - package-ecosystem: pip
+  - package-ecosystem: uv
     directory: /
     schedule:
       interval: weekly

.github/workflows/main.yml

@@ -21,7 +21,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --locked --extra dev
       - name: Test with pytest
         run: uv run pytest
 
@@ -37,7 +37,7 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install dev dependencies
-        run: uv sync --extra dev
+        run: uv sync --locked --extra dev
       - name: Run mypy
         run: uv run mypy
 
@@ -53,7 +53,7 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install dev dependencies
-        run: uv sync --extra dev
+        run: uv sync --locked --extra dev
       - name: Run map validator
         run: uv run python tools/check_maps.py
 
@@ -69,7 +69,7 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install dev dependencies
-        run: uv sync --extra dev
+        run: uv sync --locked --extra dev
       - name: Build wheel and run install regression suite
         run: uv run python tools/test_install.py
 
@@ -85,7 +85,7 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install docs dependencies
-        run: uv sync --extra docs
+        run: uv sync --locked --extra docs
       - name: Build HTML docs
         run: uv run sphinx-build -b html docs docs/_build/html
       - name: Check external links

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install dev deps
-        run: uv sync --extra dev
+        run: uv sync --locked --extra dev
       - name: Smoke test
         run: uv run pytest -q
       - name: Build sdist + wheel

.gitignore

@@ -18,7 +18,6 @@ Backup/
 *.pyperf
 .tox
 .vscode/
-uv.lock
 .claude/settings.local.json
 CLAUDE.local.md
 docs/_build/

CLAUDE.md

@@ -14,6 +14,7 @@ HIPAA X12 EDI document validator and converter. Parses ANSI X12N data files and
 - **Runtime deps:** `defusedxml>=0.7` (only)
 - **Build backend:** setuptools (>=61) via `pyproject.toml`; no `setup.py`
 - **Package manager:** `uv` — install Python packages with `uv pip install ...`, not pip
+- **Lockfile:** `uv.lock` is committed and CI installs with `uv sync --locked`. Any PR that touches `pyproject.toml` (dependencies **or** the `version` field, which the lock records) must run `uv lock` and commit the result, or CI fails on lock drift. Dependabot bumps the lock weekly via the `uv` ecosystem
 - **Local environment:** `.venv/` at project root. Always invoke tools via `.venv/Scripts/python.exe -m <tool>` — never `source .venv/Scripts/activate`, since shell state does not persist across Bash tool calls
 - **Test runner:** pytest (+ pytest-cov for coverage); tests written in `unittest.TestCase` style
 - **Format / lint:** ruff (line length 100); `ruff format` + `ruff check --select I` for imports