Skip to main content

hatch-uv-lock

pipeline coverage PyPI Python versions License Typed Checked with mypy Ruff uv prek

Hatchling build hook that embeds the project's uv.lock and pyproject.toml into its wheels. A tool like uvrev tool run can then rebuild the exact locked environment from the wheel alone, with uv sync --locked --no-install-project.

Usage

[project]
name = "my-project"

[build-system]
requires = ["hatchling>=1.28", "hatch-uv-lock"]
build-backend = "hatchling.build"

[tool.hatch.build.hooks.uv-lock]

The hook is active whenever hatchling loads it, so the (empty) [tool.hatch.build.hooks.uv-lock] table is all it takes. There is no other switch. To use it for wheels only, use [tool.hatch.build.targets.wheel.hooks.uv-lock] instead (the sdist then does not force-include uv.lock).

hatchling's generic build hook options work as usual. For example, enable-by-default = false turns the hook off unless HATCH_BUILD_HOOKS_ENABLE=true is set.

Using it from an existing build hook

from pathlib import Path

from hatch_uv_lock import add_lock_files


class MyBuildHook(BuildHookInterface):
    def initialize(self, version, build_data):
        add_lock_files(
            root=Path(self.root),
            target_name=self.target_name,
            version=version,
            dynamic=self.metadata.dynamic,
            build_data=build_data,
        )

self.metadata.dynamic is the original project.dynamic list (hatchling keeps a copy before metadata hooks change it).

What ends up where

Target Files
wheel <name>-<version>.dist-info/extra_metadata/uv.lock and .../extra_metadata/pyproject.toml, byte-identical to the originals
sdist uv.lock (force-included), so a wheel built from the sdist gets it too
editable wheel nothing
any other target the build fails

Reading the files from an installed distribution:

from importlib.metadata import distribution

lock = distribution("my-project").read_text("extra_metadata/uv.lock")

Checks

The lock file itself is not checked. The only check: project.dynamic must not contain dependencies or optional-dependencies. For these, uv sync --locked must call the build backend, which fails without the source tree. All other dynamic fields work, including version (hatch-vcs and similar) and requires-python.

Development

uv sync
uv run prek run --all-files

This runs ruff format, ruff check, mypy --strict, the doctests and the tests under coverage (100 % required). The tests in tests/test_integration.py build real projects with uv build and need network access to the package index (marker network). Skip them with uv run pytest -m "not network".

Background: pre-PEP on discuss.python.org.

Metadata

Release files for hatch-uv-lock 0.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for hatch-uv-lock 0.1
File Size Uploaded Provenance Actions
hatch_uv_lock-0.1.tar.gz 95.4 kB With provenance Details for hatch_uv_lock-0.1.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for hatch-uv-lock 0.1
File Interpreter ABI Platform Actions
hatch_uv_lock-0.1-py3-none-any.whl Python 3 none any Details for hatch_uv_lock-0.1-py3-none-any.whl

Total release size: 101.8 kB

Release files / hatch_uv_lock-0.1.tar.gz

Download URL hatch_uv_lock-0.1.tar.gz
Size 95.4 kB
Tags Source
SHA-256 checksum
How to use checksums
b2b220de872af5151ad753da43b1ca2cf57787f6769f8473daa9763edd2eeddb
BLAKE2b-256 checksum
How to use checksums
d051ad7a7271f87d1b056582033591c7ad19a4aab254745e3ddec58bcae4560d
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Debian GNU/Linux","version":"13","id":"trixie","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitLab CI/CD, verified by PyPI on Nov 1, 2026.

Transparency log

Release files / hatch_uv_lock-0.1-py3-none-any.whl

Download URL hatch_uv_lock-0.1-py3-none-any.whl
Size 6.5 kB
Tags Python 3
SHA-256 checksum
How to use checksums
0b5b13d7d8fcf71ee4b9b0ee71dfccb58bc0a0faadcd23def21150187d68c4e2
BLAKE2b-256 checksum
How to use checksums
7c86225e6a62780e9e100e6e3e30979042b1b650f20c426bbf8f209ca9213b3c
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Debian GNU/Linux","version":"13","id":"trixie","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitLab CI/CD, verified by PyPI on Nov 1, 2026.

Transparency log

Security for hatch-uv-lock 0.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for hatch_uv_lock-0.1.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitLab CI/CD, verified by PyPI on Nov 1, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page