[tbolis-at-mulesoft]

Refs #1206 (the lock-refresh PR this unblocks). No tracking issue was filed for the ruff 0.17.2 bump: it arrived through the nightly lock refresh, not a framework-release issue.

Summary

• Problem. chore(deps): refresh the PR CI lock #1206 moves ruff 0.17.1 -> 0.17.2 in python/constraints/typecheck-and-lint-py3.11.txt, but .pre-commit-config.yaml still pins the ruff-pre-commit rev: v0.17.1. tests/unit/test_noxfile.py::test_pre_commit_runs_the_lint_jobs_tool_versions holds the two equal, so all 15 test legs of run 39946600694 fail with AssertionError: assert 'v0.17.1' == 'v0.17.2'. chore(deps): ship the framework releases in the nightly lock refresh #1143 and chore(deps): ship the framework releases in the nightly lock refresh (#1156) #1165 both had to bump the rev by hand. A hand push to bot/lock-refresh doesn't stick, because the workflow rebuilds that branch from develop.
• Fix. scripts/compile_constraints.py now rewrites the ruff-pre-commit rev: and the lint-imports hook's import-linter== pin from the typecheck-and-lint lock it just compiled, as a text edit so the file's comments survive. --check now lists .pre-commit-config.yaml when its pins are stale. lock-refresh.yml adds ../.pre-commit-config.yaml to the bump commit.
• Both versions keep working. The hooks follow whatever ruff the lock holds, so develop keeps v0.17.1 with its 0.17.1 lock, and the next refresh ships v0.17.2 together with ruff==0.17.2. No version ceiling (§8.4). No src/ change, so the layered-import rule (§1.1) is not affected.
• Docs: docs/ci.md (lock-refresh section), the CONTRIBUTING hand-refresh steps, and the pre-commit config header comment.

Test plan

• New tests/unit/test_pre_commit_lock_sync.py (7 tests). On develop it fails at collection because the sync doesn't exist yet. After the fix all 7 pass. They check: a ruff 0.17.2 lock moves the rev from v0.17.1 to v0.17.2; an import-linter release moves the hook dependency; only those two lines change; the committed hooks already match the committed lock; a missing pin or hook raises an error; lock-refresh.yml stages .pre-commit-config.yaml.
• Reproduced chore(deps): refresh the PR CI lock #1206: with the bot/lock-refresh lint lock in place, pytest tests/unit/test_noxfile.py gives 1 failed, 74 passed. After running the sync it gives 75 passed, with the rev rewritten to v0.17.2 and nothing else changed.
• python scripts/compile_constraints.py --check (live uv resolve) exits 1 and lists .pre-commit-config.yaml with the stale locks. That is expected, because upstream has moved since the last lock.
• From python/ in a venv with ruff==0.17.2 and import-linter==2.15: ruff check . all passed, ruff format --check . 295 files already formatted, mypy no issues in 91 source files, lint-imports 9 kept / 0 broken, vulture clean, pytest -q 3477 passed / 264 skipped / 15 deselected.
• actionlint and zizmor --offline on lock-refresh.yml: clean. scripts/check_commit_identities.py origin/develop..HEAD: clean. verify_frameworks.py: exit 0. No adapter is affected, so no framework is installed.

Post-deploy steps

After this merges, re-run lock-refresh.yml on develop (gh workflow run lock-refresh.yml --ref develop), or wait for the next green nightly. It rebuilds bot/lock-refresh and #1206 with rev: v0.17.2, and that clears the 15 failing jobs. Merge #1206 once its CI is green.

🤖 Generated with Claude Code