Require hashes and wheels for dependencies

.github/workflows/self-smoke-test-action.yml

@@ -45,10 +45,12 @@ jobs:
       uses: actions/checkout@v3
       with:
         path: test
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.12
     - name: Install the packaging-related tools
-      run: python3 -m pip install build twine
-      env:
-        PIP_CONSTRAINT: test/requirements/runtime.txt
+      run: python3 -m pip install -r test/requirements/test.txt
     - name: Create the stub package importable directory
       run: mkdir -pv src/test_package
     - name: Populate the stub package `__init__.py`
@@ -61,7 +63,7 @@ jobs:
         CONTENTS: |
           [build-system]
           requires = [
-            "setuptools == 65.6.3",
+            "setuptools == 70.3.0",
           ]
           build-backend = "setuptools.build_meta"
 

.pip-tools.toml

@@ -2,3 +2,4 @@
 allow-unsafe = true
 resolver = "backtracking"
 strip-extras = true
+generate-hashes = true

Dockerfile

@@ -16,12 +16,10 @@ ENV PYTHONPATH "/root/.local/lib/python3.12/site-packages"
 
 COPY requirements requirements
 RUN \
-  PIP_CONSTRAINT=requirements/runtime-prerequisites.txt \
-    pip install --user --upgrade --no-cache-dir \
-      -r requirements/runtime-prerequisites.in && \
-  PIP_CONSTRAINT=requirements/runtime.txt \
-    pip install --user --upgrade --no-cache-dir --prefer-binary \
-      -r requirements/runtime.in
+  pip install --user --upgrade --no-cache-dir \
+      -r requirements/runtime-prerequisites.txt && \
+  pip install --user --upgrade --no-cache-dir --prefer-binary \
+      -r requirements/runtime.txt
 
 WORKDIR /app
 COPY LICENSE.md .

requirements/runtime-prerequisites.in

@@ -1 +1,3 @@
+--only-binary=:all:
+
 pip-with-requires-python

requirements/runtime-prerequisites.txt

@@ -2,11 +2,15 @@
 # This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
-#    pip-compile --allow-unsafe --config=../.pip-tools.toml --output-file=runtime-prerequisites.txt --strip-extras runtime-prerequisites.in
+#    pip-compile --allow-unsafe --config=../.pip-tools.toml --generate-hashes --output-file=runtime-prerequisites.txt --strip-extras runtime-prerequisites.in
 #
-pip-with-requires-python==1.0.1
+--only-binary :all:
+
+pip-with-requires-python==1.0.1 \
+    --hash=sha256:1d7dd1e498704b9de379e9e081acdd7ed28268af5f9f54b3367af05e7d2a7457
     # via -r runtime-prerequisites.in
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==24.0
+pip==24.0 \
+    --hash=sha256:ba0d021a166865d2265246961bec0152ff124de910c5cc39f1156ce3fa7c69dc
     # via pip-with-requires-python

requirements/runtime.in

@@ -1,3 +1,5 @@
+--only-binary=:all:
+
 twine
 
 # NOTE: Used to detect an ambient OIDC credential for OIDC publishing.

requirements/test.in

@@ -0,0 +1,5 @@
+--only-binary=:all:
+--constraint runtime.txt
+
+twine
+build