ci: keep uv tool versions synchronized

.github/dependabot.yml

@@ -25,6 +25,9 @@ updates:
       time: "06:15"
       timezone: Asia/Tehran
     open-pull-requests-limit: 5
+    ignore:
+      # Keep this revision aligned with UV_VERSION in the CI workflow.
+      - dependency-name: https://github.com/astral-sh/uv-pre-commit
     groups:
       pre-commit-hooks:
         patterns:

docs/development-tooling.md

@@ -36,5 +36,10 @@ CI and validates merge-request metadata for collaborative projects. GitLab
 security and dependency-update capabilities vary by deployment and must be
 enabled deliberately according to `.gitlab/REPOSITORY_SETTINGS.md`.
 
+The `uv-pre-commit` revision is intentionally excluded from automated
+pre-commit updates. Upgrade it manually in the same change as `UV_VERSION` in
+`.github/workflows/ci.yml`; the publication tests require those two versions
+to remain identical.
+
 The neutral profile contains no hosted automation. This is intentional and
 does not weaken the local quality gate.

tests/test_repository_publication.py

@@ -23,6 +23,7 @@
     r"repo: https://github\.com/astral-sh/uv-pre-commit\s+"
     r"rev: (?P<version>\S+)",
 )
+UV_PRE_COMMIT_DEPENDENCY = "https://github.com/astral-sh/uv-pre-commit"
 
 
 def load_ruleset() -> dict[str, Any]:
@@ -52,6 +53,16 @@ def test_uv_runtime_and_lock_hook_versions_match() -> None:
     )
 
 
+def test_dependabot_does_not_split_the_coupled_uv_update() -> None:
+    """Keep CI and hook uv upgrades in one manually reviewed change."""
+
+    dependabot = (PROJECT_ROOT / ".github/dependabot.yml").read_text(
+        encoding="utf-8"
+    )
+    assert "ignore:" in dependabot
+    assert f"dependency-name: {UV_PRE_COMMIT_DEPENDENCY}" in dependabot
+
+
 def test_packaging_metadata_uses_canonical_repository_urls() -> None:
     """Keep public package links aligned with this repository."""