ci: hash-pin the release path

.github/workflows/capture-core-publish.yml

@@ -52,7 +52,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
-      - run: pip install build twine
+      - run: pip install --require-hashes -r requirements/release.txt
       - name: Build wheel and sdist
         working-directory: packages/agentrust-capture-core
         run: python -m build
@@ -68,7 +68,9 @@ jobs:
         run: |
           set -euo pipefail
           python -m venv /tmp/smoke
-          /tmp/smoke/bin/pip install --quiet dist/*.whl pytest
+          # The wheel under test is deliberately unpinned; the runner is not.
+          /tmp/smoke/bin/pip install --quiet --require-hashes -r "$GITHUB_WORKSPACE/requirements/smoke.txt"
+          /tmp/smoke/bin/pip install --quiet --no-deps dist/*.whl
           /tmp/smoke/bin/python - <<'PY'
           import agentrust_capture_core as core
           import sys

.github/workflows/trace-adapters-publish.yml

@@ -46,7 +46,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
-      - run: pip install build twine
+      - run: pip install --require-hashes -r requirements/release.txt
       - name: Build and inspect artifacts
         working-directory: packages/agentrust-trace-adapters
         run: |
@@ -55,7 +55,9 @@ jobs:
       - name: Smoke-test installed wheel and signed OpenShell proof
         run: |
           python -m venv /tmp/smoke
-          /tmp/smoke/bin/pip install --quiet packages/agentrust-trace-adapters/dist/*.whl agentrust-trace-tests==0.5.0 pytest
+          # The wheel under test is deliberately unpinned; the runner is not.
+          /tmp/smoke/bin/pip install --quiet --require-hashes -r requirements/smoke.txt
+          /tmp/smoke/bin/pip install --quiet --no-deps packages/agentrust-trace-adapters/dist/*.whl
           /tmp/smoke/bin/python -c "from agentrust_trace_adapters import build_openshell_record; assert callable(build_openshell_record)"
           /tmp/smoke/bin/python integrations/openshell/demo/build_signed_record.py --output /tmp/signed-record.json
           /tmp/smoke/bin/trace-tests verify --record /tmp/signed-record.json --level 0

.github/workflows/trace-adapters-verify-provenance.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install independent provenance verifier
-        run: python -m pip install --disable-pip-version-check pypi-attestations==0.0.30
+        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements/provenance.txt
       - name: Resolve the published wheel and source distribution
         id: distributions
         env:
@@ -75,12 +75,15 @@ jobs:
         run: |
           set -euo pipefail
           python -m venv /tmp/released-package
+          # The released version is the subject of this check, so it stays
+          # resolved from PyPI; the harness around it comes from the lock.
+          /tmp/released-package/bin/pip install --require-hashes \
+            -r "$GITHUB_WORKSPACE/requirements/smoke.txt"
           /tmp/released-package/bin/pip install \
             --disable-pip-version-check \
             --no-cache-dir \
-            "agentrust-trace-adapters==$VERSION" \
-            agentrust-trace-tests==0.5.0 \
-            pytest
+            --no-deps \
+            "agentrust-trace-adapters==$VERSION"
       - name: Exercise the released adapter with the signed OpenShell proof
         run: |
           set -euo pipefail

requirements/provenance.in

@@ -0,0 +1,5 @@
+# Attestation verification for the released trace-adapters artifact.
+# Compile with:
+#   uv pip compile requirements/provenance.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/provenance.txt
+pypi-attestations==0.0.30

requirements/release.in

@@ -0,0 +1,7 @@
+# Release tooling for the capture-core and trace-adapters publish workflows.
+# These jobs build and upload to PyPI, so an unpinned resolution here is the
+# most consequential one in the repo. Compile with:
+#   uv pip compile requirements/release.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/release.txt
+build
+twine

requirements/smoke.in

@@ -0,0 +1,7 @@
+# The post-publish smoke tests install the wheel that was just built, which is
+# deliberately not pinned, alongside a test runner that should be. This lock
+# covers only that runner and the conformance suite. Compile with:
+#   uv pip compile requirements/smoke.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/smoke.txt
+pytest
+agentrust-trace-tests==0.5.0