KaifAhmad1 5ed98cefbd fix(ci): hash-pin PEP 517 build isolation deps (setuptools, wheel) ...

Qodo review on this PR: `pip install --no-deps -e .` / `pip install
--no-deps .` still leaves PEP 517 build isolation on by default, which
fetches [build-system] requires (setuptools==84.0.0, wheel==0.48.0)
completely outside any hash checking - the --require-hashes installs
right next to it didn't cover this at all.

Adds .github/requirements/pep517-build.txt, hash-locked to the exact
pyproject.toml [build-system] requires, and installs it before every
local-source install (Dockerfile, ci.yml, benchmark.yml) with
--no-build-isolation so pip reuses those hash-verified copies instead
of fetching its own.

2026-08-31 15:43:59 +05:30

..

benchmark.yml

fix(ci): hash-pin PEP 517 build isolation deps (setuptools, wheel)

2026-08-31 15:43:59 +05:30

ci.yml

fix(ci): hash-pin PEP 517 build isolation deps (setuptools, wheel)

2026-08-31 15:43:59 +05:30

codeql.yml

fix(security): resolve Scorecard vulnerability and token-permission alerts (#1280)

2026-08-30 20:58:39 +05:30

container-scan.yml

fix(ci): hash-pin PEP 517 build isolation deps (setuptools, wheel)

2026-08-31 15:43:59 +05:30

defender-for-devops.yml

fix(security): resolve Scorecard vulnerability and token-permission alerts (#1280)

2026-08-30 20:58:39 +05:30

docs.yml

security: SHA-pin all Actions, harden release pipeline, add pin verification (#824)

2026-08-03 19:17:10 +05:30

install-matrix.yml

ci: reusable install action, install-matrix, and release hardening (#1266)

2026-08-30 17:30:21 +05:00

release.yml

fix(ci): hash-pin every pip install for Scorecard Pinned-Dependencies

2026-08-31 15:29:40 +05:30

scorecard.yml

ci: reusable install action, install-matrix, and release hardening (#1266)

2026-08-30 17:30:21 +05:00

security-scan.yml

fix(ci): hash-pin every pip install for Scorecard Pinned-Dependencies

2026-08-31 15:29:40 +05:30

security.yml

fix(ci): hash-pin every pip install for Scorecard Pinned-Dependencies

2026-08-31 15:29:40 +05:30

verify-action-pins.yml

security: SHA-pin all Actions, harden release pipeline, add pin verification (#824)

2026-08-03 19:17:10 +05:30