nextchanges: Render changelog preview with uv run --frozen

.github/workflows/changelog-preview.yml

@@ -13,6 +13,7 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
     paths:
+      - ".github/workflows/changelog-preview.yml"
       - ".nextchanges/**"
       - "internal/genkit/**"
       - "tools/validate_nextchanges.py"
@@ -61,7 +62,11 @@ jobs:
           # Render into a variable first so a renderer error fails this step
           # (rather than being swallowed by a pipe), then emit the .md directly
           # into the job summary so GitHub renders it as the changelog.
-          preview=$(uv run --locked internal/genkit/tagging.py --preview)
+          # --frozen installs from the committed lock as-is. --locked re-validates
+          # it against a requires-python that uv infers from the runner's default
+          # interpreter (the genkit-synced script declares none), so it broke when
+          # ubuntu-latest moved to 26.04 (Python 3.14).
+          preview=$(uv run --frozen internal/genkit/tagging.py --preview)
           {
             echo '## Changelog preview'
             echo ''

Taskfile.yml

@@ -275,8 +275,8 @@ tasks:
       - task: check-changelog
       # --frozen renders from the committed tagging.py.lock as-is. Re-resolving (what
       # --locked does) hits the package index, which breaks under a newer local uv or the
-      # internal PyPI proxy index and rewrites the lock; CI keeps --locked (pinned uv +
-      # pypi.org) in changelog-preview.yml. --python 3.12 satisfies the lock's
+      # internal PyPI proxy index and rewrites the lock (changelog-preview.yml uses
+      # --frozen too). --python 3.12 satisfies the lock's
       # requires-python >=3.12, which the script omits (so uv would otherwise pick 3.9).
       - "uv run --python 3.12 --frozen --script internal/genkit/tagging.py --preview"