[napetrov]

Replaces #330, which is red on main: the Renovate pip-compile refresh moved certifi and platformdirs in the main and tools locks, but not in the docs lock. Renovate skipped the docs lock because its header is not uv's, so the next weekly refresh would have left it behind too.

Summary

 requirements.lock.txt        certifi 2026.10.23   (Renovate, 6f04caaf as-is)
 requirements-ci.lock.txt     certifi, platformdirs 4.13.5   (Renovate, as-is)
 requirements-mutation.lock.txt                    (Renovate, as-is)
 requirements-docs.lock.txt   certifi 2026.10.23, platformdirs 4.13.5   (regenerated)
-# Locked dependency closure of requirements-docs.txt ... (prose header)
+# This file was autogenerated by uv via the following command:
+#    uv pip compile requirements-docs.txt --constraint=requirements.lock.txt --constraint=requirements-ci.lock.txt ...
 .github/renovate.json5
-  managerFilePatterns: requirements(-ci|-mutation)?.lock.txt
+  managerFilePatterns: requirements(-ci|-docs|-mutation)?.lock.txt
 tests/test_dependency_locks.py
-RENOVATE_LOCKS = (main, ci, mutation)
+RENOVATE_LOCKS = (main, ci, docs, mutation)

Commits, in order:

1. chore(deps): refresh pip-compile outputs (Renovate, unchanged from chore(deps): refresh pip-compile outputs #330)
2. fix(deps): regenerate requirements-docs.lock.txt with the refreshed stack (unchanged from chore(deps): refresh pip-compile outputs #330's 752d6c70)
3. chore(deps): give requirements-docs.lock.txt uv's header: the header is rewritten the way uv writes it, with long options and the 7-day cooldown; the pins are the same as commit 2, and the lock now carries uv's # via annotations like the other three
4. chore(deps): have Renovate refresh requirements-docs.lock.txt: adds the docs lock to the pip-compile pattern and to the lock test

Evidence

• Before: tests/test_dependency_locks.py::test_stacked_lock_pins_agree fails for main and ci against docs (certifi, platformdirs); docs.yml fails with ResolutionImpossible: certifi==2026.10.19 and certifi==2026.10.23.
• After: pytest tests/test_dependency_locks.py 31 passed (29 before, plus the docs lock in the header and cooldown checks). mkdocs build --strict passes (only the MkDocs 2 banner, which CI disables). The three hashed locks install together with uv pip install --require-hashes.

Merge Danger

Door: two-way. Lock and config files only; a revert restores the previous state.

Blast Radius: CI installs (ci.yml, docs.yml, pip-audit, eval image) read the docs lock. The pins are the ones #330 and commit 2 already carry, so only the header format changes for the docs lock.

The header is checked against Renovate's pip-compile reader (its main-branch source, not the pinned 44.198.0 build): it reads the uv header, takes several --constraint= options, and accepts every option used, so --no-annotate was dropped. Not run against a live Renovate; the next weekly lock PR is the first real refresh of the docs lock.

🤖 Generated with Claude Code

[exai-bot]

✅ OpenCodeReview: Review complete: 0 finding(s) across 3 selected item(s).

Review details

• Commit reviewed: 5c3a51d against merge base b4a0a8c
• Coverage: 3 files in 1 groups
• Engine: OpenCodeReview v1.13.3, us.openai.gpt-6.1-sol
• Usage: 61k tokens (38k from cache), 7s
• Tool calls: 4 (4 file_read)
• small change set: 3 files

[Copilot]

🟡 Changes recommended

The Renovate pattern change leaves the docs lock stale after main/tools-only updates, recreating the stacked-install conflict and requiring ordered dependent-lock regeneration with a regression check.

1 open issue

• Regenerate dependent docs lock when main/tools constraints change · New

What changed in this PR

1 new must-fix finding.

This PR replaces #330, aligning documentation dependencies with the refreshed locks and adding the docs lock to Renovate’s managed files.

Changes:

• Refresh dependency pins and hashes in the CI, mutation, and docs locks.
• Give the docs lock a uv-compatible header constrained by both main and CI locks.
• Extend Renovate matching and existing header/cooldown checks to cover the docs lock.

File	Description
dokimi/​tests/​test_dependency_locks.py	Includes the docs lock in Renovate header and cooldown checks.
dokimi/​requirements-mutation.lock.txt	Refreshes mutation-testing dependencies and hashes.
dokimi/​requirements-docs.lock.txt	Aligns shared pins and adds uv metadata for automated refreshes.
dokimi/​requirements-ci.lock.txt	Refreshes CI tooling dependencies and hashes.
.github/​renovate.json5	Adds the docs lock to pip-compile matching and updates explanatory comments.

_{Review effort: Balanced}

[napetrov]

Not changed in this push; this needs a decision. The main/tools-only case is already caught: a PyYAML bump in requirements.lock.txt alone fails test_stacked_lock_pins_agree (probed: 6.0.3 -> 6.0.4 gives "regenerate requirements-docs.lock.txt after requirements.lock.txt"), so the drift cannot ship silently.
What is missing is the ordered refresh of the docs lock. I have not verified that Renovate's pip-compile manager refreshes it from --constraint headers, so I am not adding a postUpgradeTasks step on that basis.
Pending the maintainer: (a) a postUpgradeTasks step that reruns the docs header command after the main and tools locks (needs Renovate allowedCommands), or (b) keep Renovate on main and tools and regenerate the docs lock by hand when the stacked test fails. I suggest (b) unless postUpgradeTasks is confirmed.

[napetrov]

Maintainer chose option (b): Renovate stays on main and tools, and the docs lock is regenerated by hand when test_stacked_lock_pins_agree fails. No postUpgradeTasks step.
No change in this PR (head 5c3a51d). The stacked test already fails on a main or tools-only bump, so the drift cannot ship silently.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.04%. Comparing base (b4a0a8c) to head (5c3a51d).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #341      +/-   ##
==========================================
- Coverage   94.05%   94.04%   -0.01%     
==========================================
  Files         297      297              
  Lines       38018    38018              
  Branches     6424     6424              
==========================================
- Hits        35756    35754       -2     
- Misses       1452     1454       +2     
  Partials      810      810              

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[antonwolfy]

LGTM. The docs lock keeps the same pins and now carries uv's header, so Renovate's pip-compile reader can pick it up. The drift test covers it. One nit inline.

@copilot-pull-request-reviewer's point on a main/tools-only update leaving the docs lock behind waits for the author. Copilot's point on the cascading refresh does not block this PR: a main-only bump already fails test_stacked_lock_pins_agree, so the drift cannot ship silently.

What I ran, on a Linux review host at 00af4ec:

• make ci-local: 27 passed, 3 failed, 7 skipped; 11,971 tests; changed-line coverage passes. The failures are not the PR's: the gitleaks download returned 504 here (so its scan did not run), and test_unbalanced_quote_in_hook_completes_quickly took 1.05 s against its 1 s bound under load and passes alone in 0.74 s.
• tests/test_dependency_locks.py: 31 passed. With certifi in a copy of the docs lock changed to 2026.10.22, 2 stacked-pin tests fail, as they should.
• Pin sets of the docs lock before and after the header commit are identical; shared pins agree with the main and tools locks.

Checked, no issues

• Hashes: every pin in the docs lock has well-formed sha256 lines (64 hex characters).
• Commits: all four commits carry a Signed-off-by.

[antonwolfy]

LGTM. I pushed a commit per nit, up to 5c3a51d, which fix the nit from my review:

• 5c3a51d: dokimi/CONTRIBUTING.md:196: the sentence now says Renovate refreshes requirements-docs.lock.txt with the other locks and pip-audit audits it too.

make ci-local at 5c3a51d: 28 passed, 2 failed (host: gitleaks download), 7 skipped.

Not merging yet: @copilot-pull-request-reviewer on Docs lock may not refresh when only main/tools locks change; author left the choice (postUpgradeTasks vs manual regeneration) to the maintainer, unanswered. waits for your answer, @napetrov.

I'm withdrawing my approval for now. The nit is fixed in 5c3a51d and CI is green, but Copilot's point on the docs lock is still open: when only the main or tools lock changes, the docs lock is not refreshed. The choice between a Renovate postUpgradeTasks step and regenerating it by hand waits for the maintainer, and the merge should wait for it. I'll approve once that is settled.