PR #17644: chore(deps): regenerate uv.lock to include [google] extra (#17556)

• Repository: NousResearch/hermes-agent
• Author: briandevans
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/17644

Description (problem / solution / changelog)

Summary

Regenerate uv.lock so it matches pyproject.toml after the [google] extra was added in 13038dc7 but the lockfile was never updated.

The bug

On a clean checkout of origin/main:

$ uv lock --check
Resolved 258 packages in 737ms
The lockfile at \`uv.lock\` needs to be updated, but \`--check\` was provided.

pyproject.toml declares a [google] optional extra (with google-api-python-client, google-auth-oauthlib, google-auth-httplib2) and includes it in [all], but the lockfile's provides-extras manifest is missing google and none of the google packages are locked. Lock-pinned consumers (Nix flake, Homebrew formula, reproducible builds) hit an unexpected re-resolve on uv sync --extra google or uv sync --all-extras.

While we're here, the [matrix] extra's aiohttp-socks (added in 32d4048c6 for proxy support) was also never locked.

The fix

Run uv lock once and commit the result.

The diff is intentionally minimal — only what's required to get uv lock --check to pass:

• Add google to the provides-extras manifest
• Lock the three [google] direct deps + their transitive deps (google-api-core, google-auth, googleapis-common-protos, proto-plus, protobuf, httplib2, oauthlib, pyasn1, pyasn1-modules, requests-oauthlib, uritemplate)
• Lock aiohttp-socks and python-socks for the [matrix] extra
• exclude-newer rolls forward by 5 days, which is automatic under the existing exclude-newer-span = \"P7D\" policy

No package upgrades, no removals. 14 packages added, 0 removed, 0 changed versions.

Test plan

• uv lock --check fails on origin/main (f45434d3c): The lockfile at \uv.lock` needs to be updated`
• uv lock --check passes after this commit: Resolved 258 packages in 16ms (no further changes needed)
• provides-extras now contains google
• Diff stat: 1 file changed, 188 insertions(+), 8 deletions(-)
• git diff shows zero existing-package version changes

Related

• Fixes #17556
• Follow-up to #13038dc74 (fix(skills): ship google-workspace deps as [google] extra)

Changed files

• uv.lock (modified, +188/-8)

PR #17673: chore(deps): regenerate uv.lock and add CI uv lock --check (#17556)

• Repository: NousResearch/hermes-agent
• Author: Tranquil-Flow
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/17673

Description (problem / solution / changelog)

What does this PR do?

The `[google]` optional extra was added to `pyproject.toml` in 13038dc7 but `uv.lock` was never regenerated to match, so on a fresh clone `uv lock --check` fails. Nix flakes, Homebrew formulae, and reproducible-build consumers that pin to the lockfile silently miss the deps the commit was meant to ship; `uv sync` from a clean clone re-resolves and may pick a newer wheel set than intended.

This PR is the two-part fix the issue recommends:

1. Regenerate `uv.lock`. The lockfile now records the dependency closure for the `google` extra (`google-api-core`, `google-api-python-client`, `google-auth`, `google-auth-httplib2`, `google-auth-oauthlib`, plus `pyasn1`, `oauthlib`, `httplib2`, etc.) and `provides-extras` lists `google`. `uv lock --check` exits 0.
2. Add a `uv lock --check` step to `.github/workflows/tests.yml` so the same drift can't merge silently again. The check runs immediately after `uv python install 3.11`, before the dependency install and test run, so a stale lockfile fails fast and doesn't burn the slower steps.

Related Issue

Fixes #17556

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• `uv.lock` regenerated against the current `pyproject.toml`. 188 lines added (5 `google-*` direct deps + transitive closure), 8 removed. `provides-extras` now lists `google`.
• `.github/workflows/tests.yml`: new `Verify uv.lock is in sync with pyproject.toml` step that runs `uv lock --check`.

How to Test

1. Locally: ``` git fetch && git checkout fix/17556-uv-lock-regen-and-ci-check uv lock --check ``` exits 0 with no output. (On main, the same command currently reports `The lockfile at uv.lock needs to be updated`.)
2. CI: the new `Verify uv.lock is in sync with pyproject.toml` step runs in the `test` job and will fail any future PR that drifts `pyproject.toml` against `uv.lock`.
3. Sanity-check the closure includes the google extra: ``` grep -c '^name = "google-' uv.lock # → 5 grep -A1 '^provides-extras' uv.lock # → includes "google" ```

This supersedes the stalled draft #17494 (which only does part 1) by adding the CI prevention the issue explicitly asks for.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (`fix(scope):`, `feat(scope):`, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run `uv lock --check` and it passes
• I've added tests for my changes (the new CI step is the regression test for the underlying class of bug)
• I've tested on my platform: macOS 15.x

Documentation & Housekeeping

• I've updated relevant documentation (README, `docs/`, docstrings) — or N/A
• I've updated `cli-config.yaml.example` if I added/changed config keys — or N/A
• I've updated `CONTRIBUTING.md` or `AGENTS.md` if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Before this PR (on main): ``` $ uv lock --check Resolved 258 packages in 741ms The lockfile at `uv.lock` needs to be updated, but `--check` was provided. To update the lockfile, run `uv lock`. ```

After: ``` $ uv lock --check Resolved 258 packages in 10ms ```

Changed files

• .github/workflows/tests.yml (modified, +3/-0)
• uv.lock (modified, +188/-8)