chore: pin deps to SHA256 hashes via pip-compile

.github/requirements/requirements.in

@@ -0,0 +1,4 @@
+firebase-admin
+pyyaml
+tclint==0.7.0
+yamlfix==1.19.1

.github/workflows/github-actions-lint-tcl.yml

@@ -15,10 +15,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
+
       - name: Install Dependencies
         run: |
           python3 -m venv venv
-          venv/bin/pip install tclint==0.7.0
+          venv/bin/pip install -r .github/requirements/requirements_lock.txt
 
       - name: Lint
         run: |

.github/workflows/github-actions-update-rules.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Install Python Packages
         run: |
           python3 -m venv venv
-          venv/bin/pip install firebase-admin
+          venv/bin/pip install -r .github/requirements/requirements_lock.txt
       - name: Execute Python Script Update
         env:
           CREDS_FILE: ${{ secrets.CREDS_FILE }}

.github/workflows/github-actions-yaml-test.yml

@@ -20,10 +20,14 @@ jobs:
           flow/scripts/variables.json
           docs/user/FlowVariables.md
           yamlfix.toml
+          .github/requirements/requirements_lock.txt
+    - uses: actions/setup-python@v6
+      with:
+        python-version: "3.10"
     - name: Install dependencies
       run: |
         python3 -m venv venv
-        venv/bin/pip install --quiet pyyaml yamlfix==1.19.1
+        venv/bin/pip install --quiet -r .github/requirements/requirements_lock.txt
     - name: Run generate-variables-docs.py
       run: |
         venv/bin/python3 flow/scripts/generate-variables-docs.py

.readthedocs.yaml

@@ -8,7 +8,7 @@ version: 2
 build:
   os: ubuntu-22.04
   tools:
-    python: "3.7"
+    python: "3.10"
 
 # Build documentation in the "docs/" directory with Sphinx
 sphinx:
@@ -19,4 +19,4 @@ sphinx:
 # See https://docs.readthedocs.io/en/stable/guides/reproducible-builds.html
 python:
    install:
-   - requirements: docs/requirements.txt
+   - requirements: docs/requirements_lock.txt

docker/Dockerfile.dev

@@ -8,6 +8,7 @@ FROM $fromImage
 WORKDIR /tmp/installer/etc
 
 COPY DependencyInstaller.sh .
+COPY requirements-common_lock.txt .
 
 COPY InstallerOpenROAD.sh \
        /tmp/installer/tools/OpenROAD/etc/DependencyInstaller.sh

docs/requirements.txt → docs/requirements.in

@@ -1,4 +1,4 @@
-git+https://github.com/executablebooks/sphinx-external-toc.git@v0.3.1
+sphinx-external-toc==0.3.1
 sphinx
 sphinx-autobuild
 myst-parser

etc/DependencyInstaller.sh

@@ -36,23 +36,24 @@ _installPipCommon() {
         source /opt/rh/rh-python38/enable
         set -u
     fi
-    local pkgs="pandas numpy firebase_admin click pyyaml yamlfix"
+    local lockfile
+    lockfile="$(dirname "$(realpath "$0")")/requirements-common_lock.txt"
     if [[ "$OSTYPE" == "darwin"* ]]; then
         if [[ "$EUID" -eq 0 ]]; then
             echo "Error: Do NOT run with sudo."
             exit 1
         fi
         if [[ -n "${VIRTUAL_ENV:-}" ]]; then
-            pip3 install --no-cache-dir -U $pkgs
+            pip3 install --no-cache-dir -r "$lockfile"
         else
             echo "Error: Activate a virtual environment on macOS."
             exit 1
         fi
     else
         if [[ $(id -u) == 0 ]]; then
-            pip3 install --no-cache-dir -U $pkgs
+            pip3 install --no-cache-dir -r "$lockfile"
         else
-            pip3 install --no-cache-dir --user -U $pkgs
+            pip3 install --no-cache-dir --user -r "$lockfile"
         fi
     fi
 }

etc/requirements-common.in

@@ -0,0 +1,6 @@
+pandas
+numpy
+firebase_admin
+click
+pyyaml
+yamlfix