chore(ci): add workflow to validate uv.lock and check for regressions

[priyank766]

Description

Adds a CI workflow (validate-lockfile.yaml) that triggers on pull requests when uv.lock or pyproject.toml are modified.

The workflow performs two checks:

1. Sync Check: Ensures the uv.lock file is fully in sync with pyproject.toml using uv lock --check.
2. Security Regression Check: Audits the PR branch and base branch using uv audit, compares the results, and posts a warning comment on the PR detailing any newly introduced vulnerabilities.

This follows the established pattern in kubeflow/sdk to prevent merging stale or insecure lockfiles.

Related Issue

Fixes #61

Testing

• Unit tests
• Integration tests
• E2E tests
• Manually tested (describe below)

Manually verified uv lock --check runs successfully on the local environment.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

🎉 Welcome to the Kubeflow MCP Server! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

• If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards
• Our team will review your PR soon! cc @kubeflow/kubeflow-sdk-team

Join the community:

• Slack: Join our #kubeflow-ml-experience Slack channel
• Meetings: Attend the Kubeflow SDK and ML Experience bi-weekly meetings

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏

[priyank766]

@Krishna-kg732 is there any suggestions on this ?? i saw the notification from your side but comment is removed ig!

[Krishna-kg732]

no , i had added a comment and then reomved it.

[abhijeet-dhumal]

/ok-to-test

[abhijeet-dhumal]

Thanks @priyank766 , Looks good ! t
This PR tracks the kubeflow/sdk validate-lockfile pattern and closes #61.

One ask before merge: can you rebase on latest main, bump astral-sh/setup-uv from v4 to v7 (matches sdk's pattern as well as recently merged Dependabot bumps in this repo).

Btw have you tested this PR? Could you either temporarily drop the path filter for one push or touch pyproject.toml on your fork so we see a green check-security-regressions run?

[priyank766]

Updated setup-uv to v7, and touched pyproject.toml. All checks are green now!
@abhijeet-dhumal

[abhijeet-dhumal]

/lgtm
/approve
Thanks @priyank766 for your contribution, this is great work 🚀

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abhijeet-dhumal

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [abhijeet-dhumal]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment