[olivermeyer]

Why?
The Supply Chain Day checklist (item 2) requires that CI installs dependencies only from the committed lock file with hashes, so that a bad new package release cannot enter the build. In this repo, the Makefile targets that CI runs (make lint, make docs, make audit, make dist_native and the test_* targets) called uv run without --locked, so uv could re-resolve and change uv.lock during the job. The Read the Docs build installed uv latest and ran npm install -g @mermaid-js/mermaid-cli with no version and no lock file.

How?
Every uv run in the Makefile now uses --locked, which matches the workflows since #765, and .readthedocs.yml is deleted. Without that file, the Read the Docs project aignostics cannot build new versions (Read the Docs requires the config file), so https://aignostics.readthedocs.io keeps the last version it built and stops updating. Someone with access to the Read the Docs project must deactivate it or point it elsewhere.

🤖 Generated with Claude Code

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/ci-locked-installs → main

View scan in OX Security →

[claude]

Claude finished @olivermeyer's task in 3m 38s —— View job

---

PR Review: CI Install from Lock File

Reviewing PR #768 for supply chain security improvements.

---

Review Summary

This PR successfully implements Supply Chain Day checklist item 2 by ensuring all CI dependency installations use locked dependencies. The changes improve security and are consistent with existing CI/CD practices.

✅ CRITICAL CHECKS - ALL PASS

1. Test Markers

Status: ✅ N/A - No test files changed

2. Test Coverage

Status: ✅ N/A - No code changes, only build configuration

3. Code Quality

Status: ✅ PASS - All linting checks passed

✓ ruff check   - All checks passed!
✓ ruff format  - 287 files already formatted
✓ pyright      - 0 errors, 0 warnings, 0 informations  
✓ mypy         - Success: no issues found in 84 source files

4. Conventional Commits

Status: ✅ PASS

deed82d ci: install from the lock file

Correct format: ci: <description>

---

✅ POSITIVE FINDINGS

Supply Chain Security Improvement

Impact: 🔒 High Security Value

The PR achieves its stated goal of preventing uv from re-resolving dependencies during CI builds:

• Before: uv run --all-extras nox (could modify uv.lock)
• After: uv run --locked --all-extras nox (enforces lock file)

This prevents a compromised package release from entering the build pipeline undetected, as required by Supply Chain Day checklist item 2.

Consistency with Existing CI/CD

All GitHub Actions workflows already use --locked:

• .github/workflows/_lint.yml:33: uv sync --all-extras --locked
• .github/workflows/_docs.yml:33: uv sync --all-extras --locked
• .github/workflows/_test.yml: Multiple uv run --locked commands

This PR brings the Makefile into alignment with the workflows, ensuring consistent behavior between CI and local make targets.

Read the Docs Security Benefit

The deleted .readthedocs.yml contained an unversioned npm install:

npm install -g --ignore-scripts @mermaid-js/mermaid-cli

This was itself a supply chain vulnerability (no version pin, no lock file). Removing this configuration eliminates that risk entirely.

---

⚠️ SUGGESTIONS (Non-Blocking)

Documentation Links to Read the Docs

Files affected:

• README.md:22 - Read the Docs badge
• README.md:45 - "Get started with Console" link → readthedocs.io
• Multiple other get-started links

Current State:
The PR description correctly states that Read the Docs will keep the last built version but stop updating. The links will continue to work but point to frozen documentation.

Recommendation:
Given that:

1. The SDK is in maintenance mode (deprecated, support ends April 30, 2027)
2. CI still builds docs via make docs for verification
3. The existing documentation remains accessible

This is acceptable as-is, but consider a follow-up to:

• Add a note to README about documentation being frozen
• Deactivate the Read the Docs project (requires account access)
• Or migrate documentation hosting to GitHub Pages

This can be tracked separately and does not block this PR.

---

🔍 DETAILED REVIEW

Makefile Changes (24 additions, 24 deletions)

All changes follow the same pattern: adding --locked flag to every uv run command.

Affected targets:

• all - Main CI pipeline
• nox-cmd - Nox session wrapper
• install - Pre-commit hooks
• test_* - All test targets (unit, integration, e2e, long_running, etc.)
• clean, pre_commit_run_all, gui_watch, profile, dist_native - Utility targets

No breaking changes - All commands that previously worked will continue to work as long as uv.lock is up to date (which is enforced by version control).

.readthedocs.yml Deletion (38 lines removed)

Impact: Read the Docs builds will stop, but existing documentation remains accessible.

Configuration that was removed:

• uv installation via asdf
• UV_PROJECT_ENVIRONMENT configuration
• uv sync --locked --all-extras
• npm install -g @mermaid-js/mermaid-cli (unversioned ⚠️)

The unversioned mermaid-cli install was a supply chain risk, so removal is a security improvement.

---

📋 NO BLOCKING ISSUES FOUND

All critical checks passed:

• ✅ Conventional commits format
• ✅ Linting (ruff, pyright, mypy)
• ✅ Supply chain security improvement
• ✅ CI/CD workflow compatibility
• ✅ No breaking changes

Suggestions are non-blocking and can be addressed in follow-up work if desired.

---

🎯 RECOMMENDATION

APPROVE - This PR successfully implements the Supply Chain Day requirement and improves security with no breaking changes.

Verdict: ✅ claude:review:passed

---

| Branch: chore/ci-locked-installs

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 2 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud