feat: support uv.lock as version-file (#379)

Adds `uv.lock` as a supported `version-file` format, alongside the
existing
`pyproject.toml` and `requirements.txt`. A `uv.lock` pins the exact
resolved
ruff version, so reading it gives a reproducible install that matches
the
project's lockfile — the single source of truth — instead of the
lower-bound /
range typically declared in `pyproject.toml`.

The parser reads the `[[package]]` entry whose `name` is `ruff` and
returns its
`version`. If ruff is absent or the file cannot be parsed, the action
warns and
falls back to `latest` (same behaviour as the other formats).

Validation:
- `npm run all` — tsc typecheck clean, biome clean, dist rebuilt, jest
65/65 pass
- Added unit tests (`__tests__/version/file-parser.test.ts`) + a
`uv.lock` fixture
- Added an integration job (`test-default-version-from-uv-lock`) that
runs the
  action against the fixture and asserts ruff 0.9.5 is installed

closes #375

src/version/file-parser.ts

@@ -24,6 +24,10 @@ interface Pyproject {
   };
 }
 
+interface UvLock {
+  package?: Array<{ name?: string; version?: string }>;
+}
+
 const VERSION_FILE_PARSERS: VersionFileParser[] = [
   {
     format: "pyproject.toml",
@@ -33,6 +37,14 @@ const VERSION_FILE_PARSERS: VersionFileParser[] = [
     },
     supports: (filePath) => filePath.endsWith("pyproject.toml"),
   },
+  {
+    format: "uv.lock",
+    parse: (filePath) => {
+      const fileContent = fs.readFileSync(filePath, "utf-8");
+      return getRuffVersionFromUvLockContent(fileContent);
+    },
+    supports: (filePath) => filePath.endsWith("uv.lock"),
+  },
   {
     format: "requirements",
     parse: (filePath) => {
@@ -132,6 +144,18 @@ export function parsePyprojectContent(pyprojectContent: string): Pyproject {
   return toml.parse(pyprojectContent) as Pyproject;
 }
 
+export function getRuffVersionFromUvLockContent(
+  uvLockContent: string,
+): string | undefined {
+  const uvLock = toml.parse(uvLockContent) as UvLock;
+  const ruffPackage = (uvLock.package || []).find((pkg) => pkg.name === "ruff");
+  if (ruffPackage?.version === undefined) {
+    return undefined;
+  }
+  core.info(`Found ruff version in uv.lock: ${ruffPackage.version}`);
+  return ruffPackage.version;
+}
+
 function getVersionFileParser(filePath: string): VersionFileParser | undefined {
   return VERSION_FILE_PARSERS.find((parser) => parser.supports(filePath));
 }

src/version/types.ts

@@ -4,7 +4,7 @@ export type VersionSource =
   | "pyproject.toml"
   | "default";
 
-export type VersionFileFormat = "pyproject.toml" | "requirements";
+export type VersionFileFormat = "pyproject.toml" | "requirements" | "uv.lock";
 
 export interface ParsedVersionFile {
   format: VersionFileFormat;