mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-10 04:00:35 +00:00
KaifAhmad1
48737629d9
Scorecard's Pinned-Dependencies check requires pip installs to be hash-verified, not just version-pinned - our existing pkg==X.Y.Z pins (and even pip install -r requirements-ci.txt, despite that file already carrying hashes) still scored a 4 because the pin/hash isn't visible on the command line itself. Adds .github/requirements/*.txt: hash-locked files generated via `uv pip compile --generate-hashes` for every pip target that isn't already requirements-ci.txt, covering standalone CI tooling (build, wheel, twine, uv, pip-audit, safety/bandit/semgrep/jq, pip/setuptools bootstrap) and the project's own local-source installs. The latter (`pip install -e ".[explorer]"`, `pip install -e .`) can't be hash-pinned directly since there's nothing to hash for a local source tree; split into `pip install --no-deps -e .` plus a separate hash-pinned install of the actual fetched dependencies instead. Also adds --require-hashes to every `-r requirements-ci.txt` install so hash verification is enforced explicitly rather than only implied by the file's own content. Simplifies the Dockerfile in the process: it now installs from the same pre-generated explorer-extra.txt (copied in at build time) instead of extracting constraints from requirements-ci.txt at build time, which also means setuptools gets its CVE-2025-47273 fix as a side effect of the hash-pinned install rather than a separate upgrade step. benchmark.yml: pip install -r benchmarks/requirements.txt is left unpinned - that directory doesn't exist in this repo, so there's nothing to generate hashes from. Pre-existing breakage, unrelated to this change.
11 lines
684 B
Plaintext
11 lines
684 B
Plaintext
# This file was autogenerated by uv via the following command:
|
|
# uv pip compile .github/requirements/bootstrap.in --generate-hashes --python-version 3.11 --python-platform linux -o .github/requirements/bootstrap.txt
|
|
pip==26.2.1 \
|
|
--hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e \
|
|
--hash=sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f
|
|
# via -r .github/requirements/bootstrap.in
|
|
setuptools==84.0.0 \
|
|
--hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \
|
|
--hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73
|
|
# via -r .github/requirements/bootstrap.in
|