ci: hash-pin the remaining pip installs (Scorecard Pinned-Dependencies)

.github/workflows/ci.yml

@@ -148,10 +148,12 @@ jobs:
           path: .framework
       - name: Install chock
         # chock's own dependencies are hash-pinned in requirements/chock.txt (its pyproject at
-        # the pinned tag); chock itself then installs from the pinned checkout with no resolution.
+        # the pinned tag), and so is its setuptools build backend; chock itself is then built from
+        # the pinned checkout without build isolation and installed with no resolution.
         run: |
           pip install --require-hashes -r requirements/chock.txt
-          pip install --no-deps ./.framework
+          pip wheel --no-deps --no-build-isolation -w .framework/dist ./.framework
+          pip install --no-deps .framework/dist/*.whl
       - name: This repo is a valid adopter
         run: |
           chock check

.github/workflows/demo-gif.yml

@@ -24,7 +24,11 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
         with:
           python-version: "3.12"
-      - run: pip install .
+      # Dependencies and build backend hash-pinned in requirements/install.txt; the wheel is
+      # built without build isolation and installed with no resolution of its own.
+      - run: pip install --require-hashes -r requirements/install.txt
+      - run: pip wheel --no-deps --no-build-isolation -w dist .
+      - run: pip install --no-deps dist/*.whl
       # No verified pin for charmbracelet/vhs-action was available to this change (see the PR
       # description's Deviations); this reproduces the same tape with the plain VHS binary
       # instead, using the release URL already pinned in docs/README-refresh's render recipe.
@@ -64,7 +68,10 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
         with:
           python-version: "3.12"
-      - run: pip install .
+      # Same pinned install as the render job above.
+      - run: pip install --require-hashes -r requirements/install.txt
+      - run: pip wheel --no-deps --no-build-isolation -w dist .
+      - run: pip install --no-deps dist/*.whl
       # No verified pin for charmbracelet/vhs-action was available to this change (see the PR
       # description's Deviations); this reproduces the same tape with the plain VHS binary
       # instead, using the release URL already pinned in docs/README-refresh's render recipe.

.github/workflows/quickstart.yml

@@ -27,7 +27,11 @@ jobs:
           python-version: "3.12"
       # Installed from this checkout, not PyPI, so the README's own `pip install context-report`
       # line finds itself already satisfied and does not fetch a different released version.
-      - run: pip install .
+      # Its dependencies and build backend are hash-pinned in requirements/install.txt; the
+      # wheel is built without build isolation and installed with no resolution of its own.
+      - run: pip install --require-hashes -r requirements/install.txt
+      - run: pip wheel --no-deps --no-build-isolation -w dist .
+      - run: pip install --no-deps dist/*.whl
       - name: Regenerate docs/quickstart.sh and check it matches the committed copy
         run: |
           {

requirements/chock.in

@@ -3,3 +3,6 @@ pyyaml>=6.0
 jsonschema>=4.18,<5
 referencing>=0.35,<0.38
 agentseam==0.3.0
+# chock's build backend (its pyproject [build-system]), so CI builds the pinned checkout's
+# wheel with --no-build-isolation instead of fetching an unpinned setuptools.
+setuptools>=77

requirements/chock.txt

@@ -223,3 +223,9 @@ typing-extensions==4.16.0 \
     --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
     --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
     # via referencing
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==84.0.0 \
+    --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \
+    --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73
+    # via -r requirements/chock.in

requirements/install.in

@@ -0,0 +1,6 @@
+# context-report's runtime dependencies (pyproject [project].dependencies) plus its build
+# backend, so workflows build the wheel with --no-build-isolation and install it --no-deps:
+# every package that lands is hash-pinned here.
+jsonschema>=4.18,<5
+pyyaml>=6
+hatchling