hatch-uv-lock
Hatchling build hook that embeds the project's uv.lock and pyproject.toml into its wheels.
A tool like uvrev tool run can then rebuild the exact locked environment from the wheel alone, with uv sync --locked --no-install-project.
Usage
[project]
name = "my-project"
[build-system]
requires = ["hatchling>=1.28", "hatch-uv-lock"]
build-backend = "hatchling.build"
[tool.hatch.build.hooks.uv-lock]
The hook is active whenever hatchling loads it, so the (empty) [tool.hatch.build.hooks.uv-lock] table is all it takes.
There is no other switch.
To use it for wheels only, use [tool.hatch.build.targets.wheel.hooks.uv-lock] instead (the sdist then does not force-include uv.lock).
hatchling's generic build hook options work as usual.
For example, enable-by-default = false turns the hook off unless HATCH_BUILD_HOOKS_ENABLE=true is set.
Using it from an existing build hook
from pathlib import Path
from hatch_uv_lock import add_lock_files
class MyBuildHook(BuildHookInterface):
def initialize(self, version, build_data):
add_lock_files(
root=Path(self.root),
target_name=self.target_name,
version=version,
dynamic=self.metadata.dynamic,
build_data=build_data,
)
self.metadata.dynamic is the original project.dynamic list (hatchling keeps a copy before metadata hooks change it).
What ends up where
| Target | Files |
|---|---|
| wheel | <name>-<version>.dist-info/extra_metadata/uv.lock and .../extra_metadata/pyproject.toml, byte-identical to the originals |
| sdist | uv.lock (force-included), so a wheel built from the sdist gets it too |
| editable wheel | nothing |
| any other target | the build fails |
Reading the files from an installed distribution:
from importlib.metadata import distribution
lock = distribution("my-project").read_text("extra_metadata/uv.lock")
Checks
The lock file itself is not checked.
The only check: project.dynamic must not contain dependencies or optional-dependencies.
For these, uv sync --locked must call the build backend, which fails without the source tree.
All other dynamic fields work, including version (hatch-vcs and similar) and requires-python.
Development
uv sync
uv run prek run --all-files
This runs ruff format, ruff check, mypy --strict, the doctests and the tests under coverage (100 % required).
The tests in tests/test_integration.py build real projects with uv build and need network access to the package index (marker network).
Skip them with uv run pytest -m "not network".
Background: pre-PEP on discuss.python.org.
Metadata
Release files for hatch-uv-lock 0.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| hatch_uv_lock-0.1.tar.gz | 95.4 kB | With provenance | Details for hatch_uv_lock-0.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| hatch_uv_lock-0.1-py3-none-any.whl | Python 3 | none | any | Details for hatch_uv_lock-0.1-py3-none-any.whl |
Total release size: 101.8 kB
Release files / hatch_uv_lock-0.1.tar.gz
| Download URL | hatch_uv_lock-0.1.tar.gz |
|---|---|
| Size | 95.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b2b220de872af5151ad753da43b1ca2cf57787f6769f8473daa9763edd2eeddb
|
|
BLAKE2b-256 checksum How to use checksums |
d051ad7a7271f87d1b056582033591c7ad19a4aab254745e3ddec58bcae4560d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Debian GNU/Linux","version":"13","id":"trixie","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitLab CI/CD, verified by PyPI on Nov 1, 2026.
Transparency logRelease files / hatch_uv_lock-0.1-py3-none-any.whl
| Download URL | hatch_uv_lock-0.1-py3-none-any.whl |
|---|---|
| Size | 6.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0b5b13d7d8fcf71ee4b9b0ee71dfccb58bc0a0faadcd23def21150187d68c4e2
|
|
BLAKE2b-256 checksum How to use checksums |
7c86225e6a62780e9e100e6e3e30979042b1b650f20c426bbf8f209ca9213b3c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Debian GNU/Linux","version":"13","id":"trixie","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitLab CI/CD, verified by PyPI on Nov 1, 2026.
Transparency logSecurity for hatch-uv-lock 0.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for hatch_uv_lock-0.1.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitLab CI/CD, verified by PyPI on Nov 1, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.