chore: architecture review fixes (locked sync, warnings as errors, pre-commit in CI)

.github/workflows/main.yml

@@ -45,7 +45,7 @@ jobs:
               run: uv python install ${{ matrix.python-version }}
 
             - name: Sync dependencies
-              run: uv sync
+              run: uv sync --locked
 
             - name: Test
               run: make test
@@ -65,6 +65,25 @@ jobs:
               if: matrix.python-version != '3.15'
               run: make audit
 
+    pre-commit:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+            - name: Setup uv
+              uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+              with:
+                  enable-cache: true
+
+            - name: Setup Python
+              run: uv python install 3.14
+
+            - name: Sync dependencies
+              run: uv sync --locked
+
+            - name: Run pre-commit hooks
+              run: make pre-commit
+
     dependency-review:
         if: github.event_name == 'pull_request'
         runs-on: ubuntu-latest

.pre-commit-config.yaml

@@ -1,18 +1,19 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]
       - id: end-of-file-fixer
       - id: check-yaml
       - id: check-toml
       - id: check-merge-conflict
       - id: check-added-large-files
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.6
+    rev: v0.17.1
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: ["--fix"]
       - id: ruff-format
 

CLAUDE.md

@@ -46,9 +46,10 @@ The module lives under `src/my_module/` (src layout; `mypy_path = "src"`). The p
 - **Ruff**: Linting + formatting (line-length 88, quote-style preserve)
   - Rules: pycodestyle (E/W), pyflakes (F), isort (I), pep8-naming (N), pyupgrade (UP), bugbear (B), comprehensions (C4), blind-except (BLE), builtins (A), pathlib (PTH), Ruff-native (RUF), bandit (S), perflint (PERF), simplify (SIM), type-checking (TCH), eradicate (ERA), print (T20), pylint (PLC/PLE/PLR/PLW), logging-format (G), tryceratops (TRY); `assert` and `print()` allowed in tests/CLI respectively
 - **Mypy**: Strict mode (`disallow_untyped_defs`, `warn_return_any`, `no_implicit_reexport`, `strict_equality`)
-- **pytest**: Coverage enforced at ≥95% (`pytest-cov`), randomized order (`pytest-randomly`), `__main__.py` excluded from coverage
-- **pip-audit**: CVE scanning for all dependencies
-- **pre-commit**: Ruff auto-fix + format, YAML/TOML/merge-conflict hygiene, gitleaks secret scanning
-- **Python**: 3.10–3.14, CI matrix-tests every version on each push (`.github/workflows/main.yml`)
+- **pytest**: Coverage enforced at ≥95% (`pytest-cov`), randomized order (`pytest-randomly`), warnings treated as errors (`filterwarnings = ["error"]`), `__main__.py` excluded from coverage
+- **pip-audit**: CVE scanning for all dependencies (skipped on 3.15 in CI until upstream supports it)
+- **pre-commit**: Ruff auto-fix + format, YAML/TOML/merge-conflict hygiene, gitleaks secret scanning; also run in CI as a separate `pre-commit` job
+- **Python**: 3.11–3.15, CI matrix-tests every version on each push (`.github/workflows/main.yml`)
+- **Lockfile**: CI installs with `uv sync --locked`, so run `uv lock` after any change to `pyproject.toml` dependencies or `requires-python`
 
 All config is centralized in `pyproject.toml`.

pyproject.toml

@@ -64,7 +64,6 @@ warn_unreachable = true
 
 [tool.pytest.ini_options]
 addopts = [
-  "-p", "no:warnings",
   "--import-mode=importlib",
   "--cov=my_module",
   "--cov-report=term-missing",
@@ -73,6 +72,7 @@ addopts = [
 testpaths = ["tests"]
 pythonpath = ["src"]
 xfail_strict = true
+filterwarnings = ["error"]
 
 [tool.coverage.run]
 source_pkgs = ["my_module"]