From f8b1a79fe273542334ff25946925b8840a26bdcf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 16:00:17 +0000
Subject: [PATCH 1/9] Initial plan


From 331e2952097f6ecbc8cee5916f6753ad2ab0e431 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 16:08:13 +0000
Subject: [PATCH 2/9] Add Conan lockfile support to all CI/CD workflows for
 reproducible builds

Co-authored-by: jellespijker <8535734+jellespijker@users.noreply.github.com>
---
 .github/workflows/benchmark.yml              |  2 +-
 .github/workflows/conan-package.yml          |  2 +-
 .github/workflows/cura-installer-linux.yml   |  2 +-
 .github/workflows/cura-installer-macos.yml   |  2 +-
 .github/workflows/cura-installer-windows.yml |  2 +-
 .github/workflows/lint-tidier.yml            |  2 +-
 .github/workflows/npm-package.yml            |  2 +-
 .github/workflows/unit-test.yml              |  2 +-
 .github/workflows/update-translation.yml     |  2 +-
 README.md                                    | 21 ++++++++++++++++++++
 10 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 34f505c0..83425e94 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -58,7 +58,7 @@ jobs:
           install_system_dependencies: true
 
       - name: Install dependencies and build
-        run: conan build . -s build_type=Release --build=missing --update -g VirtualRunEnv ${{ inputs.conan_extra_args }}
+        run: conan build . -s build_type=Release --build=missing --update -g VirtualRunEnv ${{ inputs.conan_extra_args }} --lockfile-out=conan.lock
 
       - name: Run benchmark
         id: run-test
diff --git a/.github/workflows/conan-package.yml b/.github/workflows/conan-package.yml
index 65376520..8aaeedac 100644
--- a/.github/workflows/conan-package.yml
+++ b/.github/workflows/conan-package.yml
@@ -113,4 +113,4 @@ jobs:
           install_system_dependencies: ${{ inputs.install_system_dependencies }}
 
       - name: Create the Package (binaries)
-        run: conan create ${{ inputs.conan_recipe_root }} --version ${{ needs.conan-recipe-version.outputs.version_base }} --user ${{ needs.conan-recipe-version.outputs.user }} --channel ${{ needs.conan-recipe-version.outputs.channel }} ${{ inputs.conan_extra_args }} --build=missing ${{ matrix.conan_extra_args }}
+        run: conan create ${{ inputs.conan_recipe_root }} --version ${{ needs.conan-recipe-version.outputs.version_base }} --user ${{ needs.conan-recipe-version.outputs.user }} --channel ${{ needs.conan-recipe-version.outputs.channel }} ${{ inputs.conan_extra_args }} --build=missing ${{ matrix.conan_extra_args }} --lockfile-out=conan.lock
diff --git a/.github/workflows/cura-installer-linux.yml b/.github/workflows/cura-installer-linux.yml
index cfbc243c..9afb6fec 100644
--- a/.github/workflows/cura-installer-linux.yml
+++ b/.github/workflows/cura-installer-linux.yml
@@ -80,7 +80,7 @@ jobs:
         run: echo -n "${{ secrets.GPG_PRIVATE_KEY }}" | base64 --decode | gpg --import
 
       - name: Gather/build the packages
-        run: conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }}
+        run: conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }} --lockfile-out=conan.lock
 
       - name: Create the Cura distribution with pyinstaller
         id: prepare-distribution
diff --git a/.github/workflows/cura-installer-macos.yml b/.github/workflows/cura-installer-macos.yml
index 90e25f3e..e8af3db2 100644
--- a/.github/workflows/cura-installer-macos.yml
+++ b/.github/workflows/cura-installer-macos.yml
@@ -110,7 +110,7 @@ jobs:
         run: security unlock -p "${{  steps.macos-keychain-developer-cert.outputs.keychain-password }}" signing_temp.keychain
 
       - name: Gather/build the packages
-        run: conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }}
+        run: conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }} --lockfile-out=conan.lock
 
       - name: Create the Cura distribution with pyinstaller
         id: prepare-distribution
diff --git a/.github/workflows/cura-installer-windows.yml b/.github/workflows/cura-installer-windows.yml
index e40b94e3..807c9d9d 100644
--- a/.github/workflows/cura-installer-windows.yml
+++ b/.github/workflows/cura-installer-windows.yml
@@ -87,7 +87,7 @@ jobs:
         run: |
             $pydir = type pydir.txt
             $env:PATH += ";$pydir;$pydir/Scripts"
-            conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }}
+            conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }} --lockfile-out=conan.lock
 
       - name: Create the Cura distribution with pyinstaller
         id: prepare-distribution
diff --git a/.github/workflows/lint-tidier.yml b/.github/workflows/lint-tidier.yml
index 9f59dae0..b1505aad 100644
--- a/.github/workflows/lint-tidier.yml
+++ b/.github/workflows/lint-tidier.yml
@@ -21,7 +21,7 @@ jobs:
             src/**/*.c*
 
       - name: Install dependencies
-        run: conan install . -c tools.build:skip_test=False -s *:build_type=Release --build=missing --update
+        run: conan install . -c tools.build:skip_test=False -s *:build_type=Release --build=missing --update --lockfile-out=conan.lock
 
       - name: Build application and tests
         run: |
diff --git a/.github/workflows/npm-package.yml b/.github/workflows/npm-package.yml
index cdba75f2..6981e2d6 100644
--- a/.github/workflows/npm-package.yml
+++ b/.github/workflows/npm-package.yml
@@ -35,7 +35,7 @@ jobs:
           repository_path: _sources
 
       - name: Gather/build the packages
-        run: conan install --requires "${{ inputs.package_version_full }}" -pr:h cura_wasm.jinja -g npm --build=missing --update ${{ inputs.conan_extra_args }} -of .
+        run: conan install --requires "${{ inputs.package_version_full }}" -pr:h cura_wasm.jinja -g npm --build=missing --update ${{ inputs.conan_extra_args }} -of . --lockfile-out=conan.lock
 
       - name: Use Node.js
         uses: actions/setup-node@v4
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index e30f8a1b..01b2bb87 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -39,7 +39,7 @@ jobs:
           install_system_dependencies: true
 
       - name: Install dependencies and build unit test
-        run: conan build . -s build_type=Release --build=missing --update -c tools.build:skip_test=False ${{ inputs.test_use_pytest && '-g VirtualPythonEnv -c user.generator.virtual_python_env:dev_tools=True' || '' }} ${{ inputs.conan_extra_args }}
+        run: conan build . -s build_type=Release --build=missing --update -c tools.build:skip_test=False ${{ inputs.test_use_pytest && '-g VirtualPythonEnv -c user.generator.virtual_python_env:dev_tools=True' || '' }} ${{ inputs.conan_extra_args }} --lockfile-out=conan.lock
 
       - name: Run ctest-based unit test
         if: ${{ inputs.test_use_ctest }}
diff --git a/.github/workflows/update-translation.yml b/.github/workflows/update-translation.yml
index 03f4bbc5..00b1f42f 100644
--- a/.github/workflows/update-translation.yml
+++ b/.github/workflows/update-translation.yml
@@ -21,7 +21,7 @@ jobs:
           branch: ${{ inputs.branch }}
 
       - name: Update translation files using Conan install
-        run: conan install . --build=missing --update -o "&:enable_i18n=True"
+        run: conan install . --build=missing --update -o "&:enable_i18n=True" --lockfile-out=conan.lock
 
       - uses: stefanzweifel/git-auto-commit-action@v4
         with:
diff --git a/README.md b/README.md
index f3e1a183..04e597a7 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,27 @@ UltiMaker developers working on Cura need to install the conan-config from the `
 conan config install https://github.com/Ultimaker/conan-config.git -a "-b dev"
 ```
 
+## Conan Lockfiles for Reproducible Builds
+
+All CI/CD workflows use Conan lockfiles to ensure reproducible builds across time and environments. Lockfiles pin exact package versions and revisions, preventing dependency drift between developer machines, CI servers, and release builds.
+
+### Key Benefits:
+- **Reproducibility**: Same dependencies for every build, regardless of when or where it runs
+- **Traceability**: Full audit trail of exact dependency versions used in each build
+- **Safety**: Builds fail if dependencies can't be resolved from the lockfile (strict mode)
+- **Consistency**: Developers, CI, and releases all use identical dependency graphs
+
+### How it Works:
+- Workflows use `--lockfile=conan.lock` to read the lockfile and `--lockfile-out=conan.lock` to update it
+- Default strict mode ensures all dependencies must be in the lockfile
+- Lockfiles are generated/updated automatically during CI builds
+- Each repository should maintain its own `conan.lock` file in version control
+
+### Maintenance:
+- Lockfiles are automatically updated when new dependencies are resolved
+- To update a specific dependency, use: `conan lock add --requires=package/version --lockfile=conan.lock --lockfile-out=conan.lock`
+- For development branches with frequently changing dependencies, consider using `--lockfile-partial` mode
+
 ## Pipeline caching over workflows
 
 Ported a lot of workflows to this repo. All of the reusable workflows have pipeline chacing enabled for Conan downloads and Conan data folders. The caching key have a default fallback key. This ensures that the cache is updated with the latest changes on the Artifactory remote server but reuses the previous stored downloads and data, greatly reducing our download bandwidth and flexible costs.

From 3f430c9fbfe43561a9e03f1d175fa7ed99636b9d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 16:10:31 +0000
Subject: [PATCH 3/9] Update README to clarify automatic conan.lock loading
 behavior

Co-authored-by: jellespijker <8535734+jellespijker@users.noreply.github.com>
---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 04e597a7..1e3d48ad 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,8 @@ All CI/CD workflows use Conan lockfiles to ensure reproducible builds across tim
 - **Consistency**: Developers, CI, and releases all use identical dependency graphs
 
 ### How it Works:
-- Workflows use `--lockfile=conan.lock` to read the lockfile and `--lockfile-out=conan.lock` to update it
+- Workflows use `--lockfile-out=conan.lock` to generate/update the lockfile
+- Conan 2 automatically loads `conan.lock` if it exists in the working directory
 - Default strict mode ensures all dependencies must be in the lockfile
 - Lockfiles are generated/updated automatically during CI builds
 - Each repository should maintain its own `conan.lock` file in version control

From be7de6be626eb27c07341cec1ae6128ea7ac70a0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 16:11:32 +0000
Subject: [PATCH 4/9] Add guidance for lockfile adoption and conflict
 resolution

Co-authored-by: jellespijker <8535734+jellespijker@users.noreply.github.com>
---
 README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 1e3d48ad..4b086e29 100644
--- a/README.md
+++ b/README.md
@@ -26,9 +26,12 @@ All CI/CD workflows use Conan lockfiles to ensure reproducible builds across tim
 - Each repository should maintain its own `conan.lock` file in version control
 
 ### Maintenance:
+- Lockfiles are automatically created on first CI run if they don't exist
 - Lockfiles are automatically updated when new dependencies are resolved
+- Commit the generated `conan.lock` file to version control for full reproducibility
 - To update a specific dependency, use: `conan lock add --requires=package/version --lockfile=conan.lock --lockfile-out=conan.lock`
-- For development branches with frequently changing dependencies, consider using `--lockfile-partial` mode
+- For development branches with frequently changing dependencies, consider using `--lockfile-partial` mode (add to `conan_extra_args`)
+- If merge conflicts occur in lockfiles, regenerate by deleting the lockfile and running the CI workflow
 
 ## Pipeline caching over workflows
 

From 065d18e30c3fbed81ac05b099b8f4124abea08f7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 16:13:38 +0000
Subject: [PATCH 5/9] Clarify lockfile maintenance commands and workflow input
 parameter

Co-authored-by: jellespijker <8535734+jellespijker@users.noreply.github.com>
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 4b086e29..a28f9ea5 100644
--- a/README.md
+++ b/README.md
@@ -29,8 +29,8 @@ All CI/CD workflows use Conan lockfiles to ensure reproducible builds across tim
 - Lockfiles are automatically created on first CI run if they don't exist
 - Lockfiles are automatically updated when new dependencies are resolved
 - Commit the generated `conan.lock` file to version control for full reproducibility
-- To update a specific dependency, use: `conan lock add --requires=package/version --lockfile=conan.lock --lockfile-out=conan.lock`
-- For development branches with frequently changing dependencies, consider using `--lockfile-partial` mode (add to `conan_extra_args`)
+- To add a new dependency: `conan lock add --requires=package/version --lockfile=conan.lock --lockfile-out=conan.lock` then run `conan install` to resolve it
+- For development branches with frequently changing dependencies, use `--lockfile-partial` flag (add to `conan_extra_args` workflow input)
 - If merge conflicts occur in lockfiles, regenerate by deleting the lockfile and running the CI workflow
 
 ## Pipeline caching over workflows

From b85b4ba368a21921b5adb78bc11da3f96a87a888 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 17:21:43 +0000
Subject: [PATCH 6/9] Add auto-commit of lockfiles on push to main/master
 branches

Co-authored-by: jellespijker <8535734+jellespijker@users.noreply.github.com>
---
 .github/workflows/benchmark.yml              | 8 ++++++++
 .github/workflows/conan-package.yml          | 8 ++++++++
 .github/workflows/cura-installer-linux.yml   | 8 ++++++++
 .github/workflows/cura-installer-macos.yml   | 8 ++++++++
 .github/workflows/cura-installer-windows.yml | 8 ++++++++
 .github/workflows/lint-tidier.yml            | 8 ++++++++
 .github/workflows/npm-package.yml            | 8 ++++++++
 .github/workflows/unit-test.yml              | 8 ++++++++
 .github/workflows/update-translation.yml     | 2 +-
 README.md                                    | 5 +++--
 10 files changed, 68 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 83425e94..c0f519a4 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -60,6 +60,14 @@ jobs:
       - name: Install dependencies and build
         run: conan build . -s build_type=Release --build=missing --update -g VirtualRunEnv ${{ inputs.conan_extra_args }} --lockfile-out=conan.lock
 
+      - name: Commit lockfile
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          file_pattern: conan.lock
+          commit_message: "Update Conan lockfile"
+          status_options: --untracked-files=no
+
       - name: Run benchmark
         id: run-test
         run: |
diff --git a/.github/workflows/conan-package.yml b/.github/workflows/conan-package.yml
index 8aaeedac..ce1a5cbf 100644
--- a/.github/workflows/conan-package.yml
+++ b/.github/workflows/conan-package.yml
@@ -114,3 +114,11 @@ jobs:
 
       - name: Create the Package (binaries)
         run: conan create ${{ inputs.conan_recipe_root }} --version ${{ needs.conan-recipe-version.outputs.version_base }} --user ${{ needs.conan-recipe-version.outputs.user }} --channel ${{ needs.conan-recipe-version.outputs.channel }} ${{ inputs.conan_extra_args }} --build=missing ${{ matrix.conan_extra_args }} --lockfile-out=conan.lock
+
+      - name: Commit lockfile
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          file_pattern: conan.lock
+          commit_message: "Update Conan lockfile"
+          status_options: --untracked-files=no
diff --git a/.github/workflows/cura-installer-linux.yml b/.github/workflows/cura-installer-linux.yml
index 9afb6fec..97276d00 100644
--- a/.github/workflows/cura-installer-linux.yml
+++ b/.github/workflows/cura-installer-linux.yml
@@ -82,6 +82,14 @@ jobs:
       - name: Gather/build the packages
         run: conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }} --lockfile-out=conan.lock
 
+      - name: Commit lockfile
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          file_pattern: conan.lock
+          commit_message: "Update Conan lockfile"
+          status_options: --untracked-files=no
+
       - name: Create the Cura distribution with pyinstaller
         id: prepare-distribution
         run: |
diff --git a/.github/workflows/cura-installer-macos.yml b/.github/workflows/cura-installer-macos.yml
index e8af3db2..407deca9 100644
--- a/.github/workflows/cura-installer-macos.yml
+++ b/.github/workflows/cura-installer-macos.yml
@@ -112,6 +112,14 @@ jobs:
       - name: Gather/build the packages
         run: conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }} --lockfile-out=conan.lock
 
+      - name: Commit lockfile
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          file_pattern: conan.lock
+          commit_message: "Update Conan lockfile"
+          status_options: --untracked-files=no
+
       - name: Create the Cura distribution with pyinstaller
         id: prepare-distribution
         run: |
diff --git a/.github/workflows/cura-installer-windows.yml b/.github/workflows/cura-installer-windows.yml
index 807c9d9d..60a511b5 100644
--- a/.github/workflows/cura-installer-windows.yml
+++ b/.github/workflows/cura-installer-windows.yml
@@ -89,6 +89,14 @@ jobs:
             $env:PATH += ";$pydir;$pydir/Scripts"
             conan install --requires "${{ inputs.cura_conan_version != '' && inputs.cura_conan_version || format('cura/{0}@ultimaker/testing', steps.setup-environment.outputs.package_version) }}" ${{ inputs.conan_args }} --build=missing --update -of cura_inst --deployer-package="*" --profile ${{ steps.set-overrides.outputs.profile }} -c user.sentry:token="${{ secrets.CURAENGINE_SENTRY_TOKEN }}" ${{ inputs.enterprise && '-o "cura/*:enterprise=True"' || '' }} ${{ inputs.staging && '-o "cura/*:staging=True"' || '' }} ${{ inputs.private_data && '-o "cura/*:internal=True"' || '' }} --lockfile-out=conan.lock
 
+      - name: Commit lockfile
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          file_pattern: conan.lock
+          commit_message: "Update Conan lockfile"
+          status_options: --untracked-files=no
+
       - name: Create the Cura distribution with pyinstaller
         id: prepare-distribution
         shell: cmd
diff --git a/.github/workflows/lint-tidier.yml b/.github/workflows/lint-tidier.yml
index b1505aad..a38d17bc 100644
--- a/.github/workflows/lint-tidier.yml
+++ b/.github/workflows/lint-tidier.yml
@@ -23,6 +23,14 @@ jobs:
       - name: Install dependencies
         run: conan install . -c tools.build:skip_test=False -s *:build_type=Release --build=missing --update --lockfile-out=conan.lock
 
+      - name: Commit lockfile
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          file_pattern: conan.lock
+          commit_message: "Update Conan lockfile"
+          status_options: --untracked-files=no
+
       - name: Build application and tests
         run: |
           source build/Release/generators/conanbuild.sh
diff --git a/.github/workflows/npm-package.yml b/.github/workflows/npm-package.yml
index 6981e2d6..24fcded2 100644
--- a/.github/workflows/npm-package.yml
+++ b/.github/workflows/npm-package.yml
@@ -37,6 +37,14 @@ jobs:
       - name: Gather/build the packages
         run: conan install --requires "${{ inputs.package_version_full }}" -pr:h cura_wasm.jinja -g npm --build=missing --update ${{ inputs.conan_extra_args }} -of . --lockfile-out=conan.lock
 
+      - name: Commit lockfile
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          file_pattern: conan.lock
+          commit_message: "Update Conan lockfile"
+          status_options: --untracked-files=no
+
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 01b2bb87..04e4cae8 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -41,6 +41,14 @@ jobs:
       - name: Install dependencies and build unit test
         run: conan build . -s build_type=Release --build=missing --update -c tools.build:skip_test=False ${{ inputs.test_use_pytest && '-g VirtualPythonEnv -c user.generator.virtual_python_env:dev_tools=True' || '' }} ${{ inputs.conan_extra_args }} --lockfile-out=conan.lock
 
+      - name: Commit lockfile
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          file_pattern: conan.lock
+          commit_message: "Update Conan lockfile"
+          status_options: --untracked-files=no
+
       - name: Run ctest-based unit test
         if: ${{ inputs.test_use_ctest }}
         run: |
diff --git a/.github/workflows/update-translation.yml b/.github/workflows/update-translation.yml
index 00b1f42f..683f7c56 100644
--- a/.github/workflows/update-translation.yml
+++ b/.github/workflows/update-translation.yml
@@ -25,6 +25,6 @@ jobs:
 
       - uses: stefanzweifel/git-auto-commit-action@v4
         with:
-          file_pattern: resources/i18n/*.po resources/i18n/*.pot
+          file_pattern: resources/i18n/*.po resources/i18n/*.pot conan.lock
           status_options: --untracked-files=no
           commit_message: Update translations
diff --git a/README.md b/README.md
index a28f9ea5..270f61f7 100644
--- a/README.md
+++ b/README.md
@@ -23,13 +23,14 @@ All CI/CD workflows use Conan lockfiles to ensure reproducible builds across tim
 - Conan 2 automatically loads `conan.lock` if it exists in the working directory
 - Default strict mode ensures all dependencies must be in the lockfile
 - Lockfiles are generated/updated automatically during CI builds
+- **On push to main/master branches**, lockfiles are automatically committed back to the repository
 - Each repository should maintain its own `conan.lock` file in version control
 
 ### Maintenance:
 - Lockfiles are automatically created on first CI run if they don't exist
 - Lockfiles are automatically updated when new dependencies are resolved
-- Commit the generated `conan.lock` file to version control for full reproducibility
-- To add a new dependency: `conan lock add --requires=package/version --lockfile=conan.lock --lockfile-out=conan.lock` then run `conan install` to resolve it
+- **Lockfiles are automatically committed on push to main/master branches**
+- To manually add a new dependency: `conan lock add --requires=package/version --lockfile=conan.lock --lockfile-out=conan.lock` then run `conan install` to resolve it
 - For development branches with frequently changing dependencies, use `--lockfile-partial` flag (add to `conan_extra_args` workflow input)
 - If merge conflicts occur in lockfiles, regenerate by deleting the lockfile and running the CI workflow
 

From af23b4fda5db545a4865eaee17d64a176d940b65 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 17:22:58 +0000
Subject: [PATCH 7/9] Update git-auto-commit-action to v5 for consistency

Co-authored-by: jellespijker <8535734+jellespijker@users.noreply.github.com>
---
 .github/workflows/update-translation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/update-translation.yml b/.github/workflows/update-translation.yml
index 683f7c56..f79caf51 100644
--- a/.github/workflows/update-translation.yml
+++ b/.github/workflows/update-translation.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Update translation files using Conan install
         run: conan install . --build=missing --update -o "&:enable_i18n=True" --lockfile-out=conan.lock
 
-      - uses: stefanzweifel/git-auto-commit-action@v4
+      - uses: stefanzweifel/git-auto-commit-action@v5
         with:
           file_pattern: resources/i18n/*.po resources/i18n/*.pot conan.lock
           status_options: --untracked-files=no

From f7243426031a2801f573e57b72f6420cb6c105b0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 17:39:57 +0000
Subject: [PATCH 8/9] Change package creation workflow to commit lockfiles on
 release branches/tags only

Co-authored-by: jellespijker <8535734+jellespijker@users.noreply.github.com>
---
 .github/workflows/conan-package.yml | 2 +-
 README.md                           | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/conan-package.yml b/.github/workflows/conan-package.yml
index ce1a5cbf..44a4d050 100644
--- a/.github/workflows/conan-package.yml
+++ b/.github/workflows/conan-package.yml
@@ -116,7 +116,7 @@ jobs:
         run: conan create ${{ inputs.conan_recipe_root }} --version ${{ needs.conan-recipe-version.outputs.version_base }} --user ${{ needs.conan-recipe-version.outputs.user }} --channel ${{ needs.conan-recipe-version.outputs.channel }} ${{ inputs.conan_extra_args }} --build=missing ${{ matrix.conan_extra_args }} --lockfile-out=conan.lock
 
       - name: Commit lockfile
-        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+        if: github.event_name == 'push' && (github.ref_type == 'tag' || (github.ref_name != 'main' && github.ref_name != 'master'))
         uses: stefanzweifel/git-auto-commit-action@v5
         with:
           file_pattern: conan.lock
diff --git a/README.md b/README.md
index 270f61f7..b3a396ad 100644
--- a/README.md
+++ b/README.md
@@ -23,13 +23,17 @@ All CI/CD workflows use Conan lockfiles to ensure reproducible builds across tim
 - Conan 2 automatically loads `conan.lock` if it exists in the working directory
 - Default strict mode ensures all dependencies must be in the lockfile
 - Lockfiles are generated/updated automatically during CI builds
-- **On push to main/master branches**, lockfiles are automatically committed back to the repository
+- **Auto-commit behavior varies by workflow:**
+  - **Most workflows**: Lockfiles committed on push to main/master branches
+  - **Package creation workflow**: Lockfiles committed on push to release branches/tags (not main/master)
 - Each repository should maintain its own `conan.lock` file in version control
 
 ### Maintenance:
 - Lockfiles are automatically created on first CI run if they don't exist
 - Lockfiles are automatically updated when new dependencies are resolved
-- **Lockfiles are automatically committed on push to main/master branches**
+- **Lockfiles are automatically committed based on workflow type:**
+  - Test/build workflows commit on push to main/master
+  - Package creation commits on release branches/tags
 - To manually add a new dependency: `conan lock add --requires=package/version --lockfile=conan.lock --lockfile-out=conan.lock` then run `conan install` to resolve it
 - For development branches with frequently changing dependencies, use `--lockfile-partial` flag (add to `conan_extra_args` workflow input)
 - If merge conflicts occur in lockfiles, regenerate by deleting the lockfile and running the CI workflow

From 3551249f092151df30b8275ade14d84c721c9a0d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 5 Jan 2026 17:42:19 +0000
Subject: [PATCH 9/9] Improve condition logic clarity and add permissions note
 to README

Co-authored-by: jellespijker <8535734+jellespijker@users.noreply.github.com>
---
 .github/workflows/conan-package.yml | 2 +-
 README.md                           | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/conan-package.yml b/.github/workflows/conan-package.yml
index 44a4d050..1fca4811 100644
--- a/.github/workflows/conan-package.yml
+++ b/.github/workflows/conan-package.yml
@@ -116,7 +116,7 @@ jobs:
         run: conan create ${{ inputs.conan_recipe_root }} --version ${{ needs.conan-recipe-version.outputs.version_base }} --user ${{ needs.conan-recipe-version.outputs.user }} --channel ${{ needs.conan-recipe-version.outputs.channel }} ${{ inputs.conan_extra_args }} --build=missing ${{ matrix.conan_extra_args }} --lockfile-out=conan.lock
 
       - name: Commit lockfile
-        if: github.event_name == 'push' && (github.ref_type == 'tag' || (github.ref_name != 'main' && github.ref_name != 'master'))
+        if: github.event_name == 'push' && (github.ref_type == 'tag' || (github.ref_type == 'branch' && github.ref_name != 'main' && github.ref_name != 'master'))
         uses: stefanzweifel/git-auto-commit-action@v5
         with:
           file_pattern: conan.lock
diff --git a/README.md b/README.md
index b3a396ad..d6e6ab4e 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,7 @@ All CI/CD workflows use Conan lockfiles to ensure reproducible builds across tim
 - **Lockfiles are automatically committed based on workflow type:**
   - Test/build workflows commit on push to main/master
   - Package creation commits on release branches/tags
+- **Note**: Calling workflows must have `contents: write` permission for auto-commit to work
 - To manually add a new dependency: `conan lock add --requires=package/version --lockfile=conan.lock --lockfile-out=conan.lock` then run `conan install` to resolve it
 - For development branches with frequently changing dependencies, use `--lockfile-partial` flag (add to `conan_extra_args` workflow input)
 - If merge conflicts occur in lockfiles, regenerate by deleting the lockfile and running the CI workflow