ci: lock dependencies to ensure reproducible builds

Author: pjhartzell

.github/workflows/ci.yml

@@ -24,11 +24,15 @@ jobs:
           enable-cache: true
 
       - name: Install dependencies
-        run: uv sync
+        run: uv sync --locked
 
       - name: Run pre-commit hooks
         run: uv run pre-commit run --all-files
 
+      - name: Show files modified by pre-commit
+        if: failure()
+        run: git diff --name-only
+
   test:
     name: Test
     runs-on: ubuntu-latest
@@ -46,7 +50,7 @@ jobs:
           enable-cache: true
 
       - name: Install dependencies
-        run: uv sync
+        run: uv sync --locked
 
       - name: Run tests
         run: uv run pytest -v