Lockfile consistency

Fails when the lockfile no longer matches the manifest, so CI installs exactly what was reviewed.

V1016 technique

16 of 256 scanned repositories run it (6%)

Sub-techniques

ID	Name	Description
`V1016.001`	Frozen install	Install with the frozen or locked flag so a stale lockfile fails.
`V1016.002`	Lock check	Regenerate the lock and fail on any diff.

Craft it

Commit lockfiles for applications.
Use frozen installs in CI (npm ci, uv sync --locked, cargo build --locked).
Add an explicit lock check step for clearer failures.

Reverse engineer it

Signs that a codebase already runs this technique, and where to read how it is configured.

--frozen-lockfile, --locked or npm ci in CI.
uv lock --check or a lockfile diff step.

Where the scanned repositories configure it:

.github/workflows/*.yml in 10 repositories
.pre-commit-config.yaml in 9 repositories
justfile in 1 repositories
pyproject.toml in 1 repositories

Detected by the scanner as: Lockfile consistency (a lockfile that no longer matches its manifest.)

Open-source packages

uv (uv lock --check) astral-sh/uv

Tools seen in scans

by repositories that run them

Tool	Repos	Command seen	Runs in	Docs
`uv-lock` autofix	16	`uv lock --check`	pre-commit, ci, local	docs

Procedure examples

repositories that run it, most-starred first

Repository	Tools	Runs in	Evidence
TheAlgorithms/Python	`uv-lock`	pre-commit, ci	`.pre-commit-config.yaml ci (pre-commit.ci)`
langgenius/dify	`uv-lock`	ci	`.github/workflows/dify-agent-tests.yml jobs.dify-agent-unit.steps[2] (Check U...`
pallets/flask	`uv-lock`	pre-commit, ci, local	`.github/workflows/pre-commit.yaml jobs.main.steps[4]`
apache/airflow	`uv-lock`	pre-commit	`.pre-commit-config.yaml hooks.update-uv-lock`
astral-sh/ruff	`uv-lock`	pre-commit	`.pre-commit-config.yaml hooks.uv-lock`
crewaiinc/crewai	`uv-lock`	pre-commit	`.pre-commit-config.yaml hooks.uv-lock`
openai/openai-python	`uv-lock`	ci	`.github/workflows/ci.yml jobs.dependency-locks.steps[4] (Verify dependency gr...`
BerriAI/litellm	`uv-lock`	ci	`.github/workflows/test-linting.yml jobs.python.steps[7] (Check uv.lock is up ...`
bytedance/deer-flow	`uv-lock`	ci	`.github/workflows/lint-check.yml jobs.lint-backend.steps[3] (Check uv.lock is...`
browserbase/stagehand	`uv-lock`	ci, local	`.github/workflows/ci.yml jobs.check.steps[9]`
semgrep/semgrep	`uv-lock`	pre-commit, ci	`.github/workflows/lint.yml jobs.pre-commit.steps[8] (Run pre-commit)`
the-pr-agent/pr-agent	`uv-lock`	ci	`.github/workflows/build-and-test.yaml jobs.build-and-test.steps[2] (Check uv....`
Unstructured-IO/unstructured	`uv-lock`	ci	`.github/workflows/ci.yml jobs.setup.steps[2] (Validate lockfile)`
astral-sh/ty	`uv-lock`	pre-commit	`.pre-commit-config.yaml hooks.uv-lock`
prowler-cloud/prowler	`uv-lock`	pre-commit, ci	`.github/workflows/api-code-quality.yml jobs.api-code-quality.steps[4] (uv loc...`
open-telemetry/opentelemetry-python	`uv-lock`	pre-commit	`.pre-commit-config.yaml hooks.uv-lock`