deps: install from uv.lock (hash-pinned) in the image and CI, never floating

The API image did 'pip install -e .' and CI 'pip install -e ".[dev]"':
every rebuild could ship newer fastapi/starlette/pydantic than CI tested
(Windy Cloud hit exactly this 09-23). uv.lock is cut to EXACTLY what prod
runs now (42 runtime pkgs, 0 differences; botocore/pyjwt held back to
prod's versions). Image: uv 0.12.5 exports, pip --require-hashes installs,
same layout. CI: uv sync --locked (also fails on a stale lock).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/check.yml

@@ -51,9 +51,10 @@ jobs:
       - name: install
         run: |
           python3 --version
-          python3 -m venv .venv
-          .venv/bin/pip install -q --upgrade pip
-          .venv/bin/pip install -e ".[dev]"
+          # From uv.lock, never floating: CI tests exactly what the image ships.
+          # --locked also FAILS if pyproject.toml changed without re-locking.
+          python3 -m pip install -q uv==0.12.5
+          uv sync --locked --extra dev
 
       - name: lint
         run: .venv/bin/ruff check api scripts

Dockerfile

@@ -10,10 +10,19 @@ WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends git curl \
     && rm -rf /var/lib/apt/lists/*
 
-COPY pyproject.toml ./
-RUN pip install --no-cache-dir -e .
-
+# Dependencies come from uv.lock, hash-pinned, never "latest at build time".
+# Floating installs meant a rebuild could ship different fastapi/starlette/
+# pydantic than CI tested (Windy Cloud's OpenAPI drift, 09-23). The lock was
+# cut to exactly what prod ran then. uv only exports; pip installs, so the
+# image layout (system python, uvicorn on PATH) is unchanged.
+COPY --from=ghcr.io/astral-sh/uv:0.12.5 /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock ./
+RUN uv export --frozen --no-dev --no-emit-project -o /tmp/requirements.txt \
+ && pip install --no-cache-dir --require-hashes -r /tmp/requirements.txt \
+ && rm /tmp/requirements.txt
 COPY api ./api
+RUN pip install --no-cache-dir --no-deps -e .
+
 COPY alembic ./alembic
 COPY alembic.ini ./
 COPY scripts ./scripts