From 890546136b74658c07fa19bfa30f86bd055240f2 Mon Sep 17 00:00:00 2001
From: Emad Helmi <emad.helmi@tabdeal.org>
Date: Wed, 2 Sep 2026 18:31:40 +0330
Subject: [PATCH] ci: keep uv tool versions synchronized

---
 .github/dependabot.yml               |  3 +++
 docs/development-tooling.md          |  5 +++++
 tests/test_repository_publication.py | 11 +++++++++++
 3 files changed, 19 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 689a1e8..645f219 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,6 +25,9 @@ updates:
       time: "06:15"
       timezone: Asia/Tehran
     open-pull-requests-limit: 5
+    ignore:
+      # Keep this revision aligned with UV_VERSION in the CI workflow.
+      - dependency-name: https://github.com/astral-sh/uv-pre-commit
     groups:
       pre-commit-hooks:
         patterns:
diff --git a/docs/development-tooling.md b/docs/development-tooling.md
index 982fb16..de8b460 100644
--- a/docs/development-tooling.md
+++ b/docs/development-tooling.md
@@ -36,5 +36,10 @@ CI and validates merge-request metadata for collaborative projects. GitLab
 security and dependency-update capabilities vary by deployment and must be
 enabled deliberately according to `.gitlab/REPOSITORY_SETTINGS.md`.
 
+The `uv-pre-commit` revision is intentionally excluded from automated
+pre-commit updates. Upgrade it manually in the same change as `UV_VERSION` in
+`.github/workflows/ci.yml`; the publication tests require those two versions
+to remain identical.
+
 The neutral profile contains no hosted automation. This is intentional and
 does not weaken the local quality gate.
diff --git a/tests/test_repository_publication.py b/tests/test_repository_publication.py
index 7d5925b..77b3b8c 100644
--- a/tests/test_repository_publication.py
+++ b/tests/test_repository_publication.py
@@ -23,6 +23,7 @@
     r"repo: https://github\.com/astral-sh/uv-pre-commit\s+"
     r"rev: (?P<version>\S+)",
 )
+UV_PRE_COMMIT_DEPENDENCY = "https://github.com/astral-sh/uv-pre-commit"
 
 
 def load_ruleset() -> dict[str, Any]:
@@ -52,6 +53,16 @@ def test_uv_runtime_and_lock_hook_versions_match() -> None:
     )
 
 
+def test_dependabot_does_not_split_the_coupled_uv_update() -> None:
+    """Keep CI and hook uv upgrades in one manually reviewed change."""
+
+    dependabot = (PROJECT_ROOT / ".github/dependabot.yml").read_text(
+        encoding="utf-8"
+    )
+    assert "ignore:" in dependabot
+    assert f"dependency-name: {UV_PRE_COMMIT_DEPENDENCY}" in dependabot
+
+
 def test_packaging_metadata_uses_canonical_repository_urls() -> None:
     """Keep public package links aligned with this repository."""