wheels: harden supply chain, slim wheels, rehearse PyPI publish

.github/workflows/buildAndTestAieTools.yml

@@ -1,5 +1,9 @@
 name: Build and Test with AIE tools
 
+permissions:
+  contents: read
+  packages: read
+
 on:
   push:
     branches:
@@ -41,7 +45,7 @@ jobs:
     steps:
 
       - name: Free disk space
-        uses: descriptinc/free-disk-space@main
+        uses: descriptinc/free-disk-space@1b4b157593c6801212a2ed488c205e0a810b4592  # main
         with:
           tool-cache: true
           android: true
@@ -55,7 +59,7 @@ jobs:
         run: |
           docker system prune -a -f
 
-      - uses: uraimo/run-on-arch-action@v3
+      - uses: uraimo/run-on-arch-action@fd7aa8593480287702b446a273a68f788a9bad3a  # v3
         name: Run commands
         id: runcmd
         with:
@@ -90,7 +94,7 @@ jobs:
                 --requirements python/requirements.txt \
                 --install-non-eudsl
             pip install -r python/requirements_notebook.txt
-            pip install -r python/requirements_dev.txt
+            python -m pip install --require-hashes -r python/requirements_dev.lock
 
             VERSION=$(utils/clone-llvm.sh --get-wheel-version)
             pip -q download mlir==$VERSION \

.github/workflows/buildAndTestAieToolsHsaBuildOnly.yml

@@ -1,5 +1,9 @@
 name: Build and Test with AIE tools with HSA backend and build only tests
 
+permissions:
+  contents: read
+  packages: read
+
 on:
 #  push:
 #    branches:
@@ -41,7 +45,7 @@ jobs:
     steps:
 
       - name: Free disk space
-        uses: descriptinc/free-disk-space@main
+        uses: descriptinc/free-disk-space@1b4b157593c6801212a2ed488c205e0a810b4592  # main
         with:
           tool-cache: true
           android: true
@@ -55,7 +59,7 @@ jobs:
         run: |
           docker system prune -a -f
 
-      - uses: uraimo/run-on-arch-action@v3
+      - uses: uraimo/run-on-arch-action@fd7aa8593480287702b446a273a68f788a9bad3a  # v3
         name: Run commands
         id: runcmd
         with:
@@ -114,7 +118,7 @@ jobs:
                 --requirements python/requirements.txt \
                 --install-non-eudsl
             pip install -r python/requirements_notebook.txt
-            pip install -r python/requirements_dev.txt
+            python -m pip install --require-hashes -r python/requirements_dev.lock
 
             VERSION=$(utils/clone-llvm.sh --get-wheel-version)
             pip -q download mlir==$VERSION \

.github/workflows/buildAndTestMulti.yml

@@ -1,5 +1,8 @@
 name: Compile across platforms
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -69,12 +72,12 @@ jobs:
       # Clone the repo and its submodules. Do shallow clone to save clone
       # time.
       - name: Get the project repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
         with:
           fetch-depth: 2
           submodules: "true"
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: '3.12'
 
@@ -85,10 +88,10 @@ jobs:
               --requirements python/requirements.txt \
               --install-non-eudsl
           pip install -r python/requirements_notebook.txt
-          pip install -r python/requirements_dev.txt
+          python -m pip install --require-hashes -r python/requirements_dev.lock
 
       - name: Setup Cpp
-        uses: aminya/setup-cpp@1f17f92d6a52bfcb1a25348e2c526c2e5cbb1134
+        uses: aminya/setup-cpp@1f17f92d6a52bfcb1a25348e2c526c2e5cbb1134  # v1.8.0
         with:
           compiler: ${{ matrix.COMPILER }}
           vcvarsall: ${{ contains(matrix.OS, 'windows') }}

.github/workflows/buildAndTestPythons.yml

@@ -1,5 +1,8 @@
 name: Build and Test across Python versions
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -44,12 +47,12 @@ jobs:
       # Clone the repo and its submodules. Do shallow clone to save clone
       # time.
       - name: Get the project repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
         with:
           fetch-depth: 2
           submodules: "true"
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
           python-version: ${{ matrix.python_version }}
 
@@ -60,7 +63,7 @@ jobs:
               --requirements python/requirements.txt \
               --install-non-eudsl
           pip install -r python/requirements_notebook.txt
-          pip install -r python/requirements_dev.txt
+          python -m pip install --require-hashes -r python/requirements_dev.lock
 
       - name: Install packages
         run: |
@@ -75,7 +78,7 @@ jobs:
           unzip -q mlir-*.whl
 
       - name: Ccache for C++ compilation
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639  # v1.2
         with:
           # Since there are now several compilation jobs running in parallel,
           # use a different key per job to avoid a ccache writing race condition

.github/workflows/buildAndTestRyzenAI.yml

@@ -1,5 +1,8 @@
 name: Build and Test with AIE tools on Ryzen AI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -67,15 +70,15 @@ jobs:
       NPU_CACHE_HOME: ${{ github.workspace }}/iron-cache-${{ matrix.runner_type }}-${{ github.run_id }}
       PIP_CACHE_DIR: ${{ github.workspace }}/.pip-cache-${{ matrix.runner_type }}-${{ github.run_id }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
         with:
           submodules: "true"
 
       # Launch an ssh session via a proxy server if there is a need
       # for debug. This seems to live for 35 min max
       # https://github.com/mxschmitt/action-tmate
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
+        uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101  # v3
         # To run this, launch it manually on the default branch and
         # click on "launch_tmate_terminal_for_debug"
         if: github.event_name == 'workflow_dispatch'
@@ -93,7 +96,7 @@ jobs:
               --install-non-eudsl
           pip install -r python/requirements_notebook.txt
           pip install -r python/requirements_ml.txt
-          pip install -r python/requirements_dev.txt
+          python -m pip install --require-hashes -r python/requirements_dev.lock
 
           # Install llvm-aie (Peano) which is needed for unittests requiring compiling NPU code
           pip install -I llvm-aie -f https://github.com/Xilinx/llvm-aie/releases/expanded_assets/nightly
@@ -162,15 +165,15 @@ jobs:
       NPU_CACHE_HOME: ${{ github.workspace }}/iron-cache-${{ matrix.runner_type }}-${{ github.run_id }}
       PIP_CACHE_DIR: ${{ github.workspace }}/.pip-cache-${{ matrix.runner_type }}-${{ github.run_id }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
         with:
           submodules: "true"
 
       # Launch an ssh session via a proxy server if there is a need
       # for debug. This seems to live for 35 min max
       # https://github.com/mxschmitt/action-tmate
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
+        uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101  # v3
         # To run this, launch it manually on the default branch and
         # click on "launch_tmate_terminal_for_debug"
         if: github.event_name == 'workflow_dispatch'
@@ -185,7 +188,7 @@ jobs:
           # quick_setup changes directory to programming_examples, so we need to return to mlir-aie
           cd ..
           pip install --upgrade pip
-          pip install -r python/requirements_dev.txt
+          python -m pip install --require-hashes -r python/requirements_dev.lock
 
           ./utils/build-mlir-aie-from-wheels.sh
 

.github/workflows/buildAndTestRyzenAISw.yml

@@ -1,5 +1,9 @@
 name: Build and Test with Ryzen AI Sofware
 
+permissions:
+  contents: read
+  packages: read
+
 on:
   push:
     branches:
@@ -41,7 +45,7 @@ jobs:
     steps:
 
       - name: Free disk space
-        uses: descriptinc/free-disk-space@main
+        uses: descriptinc/free-disk-space@1b4b157593c6801212a2ed488c205e0a810b4592  # main
         with:
           tool-cache: true
           android: true
@@ -55,10 +59,10 @@ jobs:
         run: |
           docker system prune -a -f
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
         with:
           submodules: "true"
-      - uses: uraimo/run-on-arch-action@v3
+      - uses: uraimo/run-on-arch-action@fd7aa8593480287702b446a273a68f788a9bad3a  # v3
         name: Build and Test
         id: runcmd
         with:
@@ -98,6 +102,9 @@ jobs:
                 --requirements python/requirements.txt \
                 --install-non-eudsl
             pip install -r python/requirements_ml.txt
+            # Ryzen AI 1.3 SDK is cp310-only (see python3.10 sed above).
+            # requirements_dev.lock targets py>=3.11 (drops cibuildwheel 3.x
+            # transitively); fall back to the loose .txt here.
             pip install -r python/requirements_dev.txt
 
             VERSION=$(utils/clone-llvm.sh --get-wheel-version)

.github/workflows/buildAndTestVitis.yml

@@ -1,5 +1,8 @@
 name: Build and Test with Vitis 2025.1
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -63,15 +66,15 @@ jobs:
     env:
       NPU_CACHE_HOME: ${{ github.workspace }}/iron-cache-${{ matrix.runner_type }}-${{ github.run_id }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
         with:
           submodules: "true"
 
       # Launch an ssh session via a proxy server if there is a need
       # for debug. This seems to live for 35 min max
       # https://github.com/mxschmitt/action-tmate
       - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
+        uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101  # v3
         # To run this, launch it manually on the default branch and
         # click on "launch_tmate_terminal_for_debug"
         if: github.event_name == 'workflow_dispatch'
@@ -90,7 +93,7 @@ jobs:
               --install-non-eudsl
           pip install -r python/requirements_notebook.txt
           pip install -r python/requirements_ml.txt
-          pip install -r python/requirements_dev.txt
+          python -m pip install --require-hashes -r python/requirements_dev.lock
 
           # Install llvm-aie (Peano) which is needed for unittests requiring compiling NPU code
           pip install -I llvm-aie -f https://github.com/Xilinx/llvm-aie/releases/expanded_assets/nightly