Skip to content
Sarj Repo Standards
sarj/github/immutable-installs

Use lock-enforcing installs

Recognized CI installs use lock-enforcing modes.

warning beta

Examples

FlaggedFails
run: uv sync
PassesClean
run: uv sync --locked

Why it matters

CI can resolve dependencies differently from the reviewed lockfile.

How detection works

A recognized uv, pnpm, Yarn, or npm install command does not use its immutable mode.

What is inspected

  • recognized dependency install commands in executable workflow steps

Limits

  • executing package managers
  • requiring lockfiles for global tool installs

How to fix it

Use the package manager's lock-enforcing install mode in CI.

  1. Use uv --locked, pnpm --frozen-lockfile, Yarn --immutable, or npm ci.

Verify

  • Run repo-lint again and confirm the rule passes.