fix: use public dependency sources in lockfiles

Regenerate uv.lock against PyPI without changing dependency versions or hashes. Check Python and npm dependency sources before CI installation and enforce a current lockfile.

Fixes #28

.github/workflows/ci.yml

@@ -37,6 +37,9 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Check public dependency sources before installation
+        run: python scripts/check_dependency_sources.py
+
       - name: Set up uv
         uses: astral-sh/setup-uv@v6
         with:
@@ -44,7 +47,7 @@ jobs:
           cache-dependency-glob: uv.lock
 
       - name: Install locked development environment
-        run: uv sync --dev --frozen
+        run: uv sync --dev --locked
 
       - name: Check Python formatting
         run: uv run ruff format --check .

scripts/check_dependency_sources.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Reject private dependency sources before installing project dependencies.
+
+Uses only the Python 3.12+ standard library so CI can run it before uv sync.
+"""
+
+import json
+import sys
+import tomllib
+from pathlib import Path
+from urllib.parse import urlsplit
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def main() -> int:
+    errors: list[str] = []
+
+    def check_url(label: str, url: str, host: str) -> None:
+        parsed = urlsplit(url)
+        if parsed.scheme != "https" or parsed.netloc != host:
+            errors.append(f"{label}: expected an HTTPS URL on {host}")
+
+    lock = tomllib.loads((ROOT / "uv.lock").read_text(encoding="utf-8"))
+    workspace_sources = {
+        "artemis": {"editable": "."},
+        "artemis-client": {"editable": "packages/artemis-client"},
+    }
+    for package in lock["package"]:
+        label = f"uv.lock: {package['name']}=={package['version']}"
+        source = package["source"]
+        if source != workspace_sources.get(package["name"]):
+            if source != {"registry": "https://pypi.org/simple"}:
+                errors.append(f"{label}: expected the public PyPI registry")
+        artifacts = list(package.get("wheels", []))
+        if "sdist" in package:
+            artifacts.append(package["sdist"])
+        for artifact in artifacts:
+            check_url(f"{label}: artifact", artifact.get("url", ""), "files.pythonhosted.org")
+
+    npm_lock = json.loads((ROOT / "apps/showcase_ui/package-lock.json").read_text(encoding="utf-8"))
+    for name, package in npm_lock["packages"].items():
+        if "resolved" in package:
+            check_url(f"package-lock.json: {name}", package["resolved"], "registry.npmjs.org")
+
+    if errors:
+        print("Dependency source check failed:\n" + "\n".join(errors), file=sys.stderr)
+        return 1
+    print("Dependency sources use public PyPI and npm registries.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())