[vinsymoyya]

Issue #, if available: Refs #839, specifically the lock-options report.

Description of changes

Export dependencies with --locked and reuse the resolution mode, prerelease mode, fork strategy, and exclude-newer cutoff recorded in uv.lock. A valid lock retains its options and bytes; a manifest with newly declared dependencies fails the build until the lock is updated. Export no longer rewrites a valid lock or silently builds with an outdated dependency set.

Lock-file failures use the normal action-error path. TOML parsing uses the standard library on Python 3.11+ and a declared tomli dependency on Python 3.10. The existing path that creates a missing lock still runs uv lock first.

This addresses lock mutation and freshness only; #839's broader configuration requests remain open.

Description of how you validated changes

• 64 focused unit, functional, and real integration checks pass locally.
• Offline integration tests generate a lock with all four supported resolver options, build through LambdaBuilder, and verify unchanged source lock bytes. Adding a local dependency then produces the expected --locked failure, with both experimental-flag settings.
• A negative control using frozen export instead of locked export makes both stale-manifest regressions fail because the build incorrectly succeeds.
• Final validation for commit 4145c4e passed all five jobs: Linux/Windows with uv 0.11.26/0.13.7 on Python 3.13, plus Python 3.10 compatibility. Each job passed 1,022 unit/functional tests, 24 UV integration tests, Ruff, Black, and the 94% coverage gate (94.42-94.55%).

Checklist

• Review the generative AI contribution guidelines

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[aws-sam-tooling-bot]

✅ Lambda Tooling PR Reviewer: No high-confidence issues found.

1 lower-confidence observation: these passed verification at a lower score, so check before acting

1. [BUG] aws_lambda_builders/workflows/python_uv/packager.py:324: --frozen builds from a stale uv.lock without any error

When uv.lock exists, _handle_pyproject_build goes straight to _build_from_lock_file. With --frozen, uv export no longer checks the lock against pyproject.toml. If someone adds or changes a dependency and doesn't re-run uv lock, the build succeeds but packages the old dependency set, and the Lambda can then fail at import time. --locked would fail the build on a stale lock and still leave uv.lock unchanged. Check whether --locked accepts a lock created with --exclude-newer before switching to it; if it doesn't, the silent stale-lock behavior should at least be logged.

[aws-sam-tooling-bot]

Code Review Results

Reviewed: e3e1453..202f389
Files: 4
Comments: 1