Merge pull request #4268 from luarss/topic/pin-deps-orfs

chore: pin deps to SHA256 hashes via pip-compile

Author: vvbandeira

.github/requirements/requirements.in

@@ -0,0 +1,4 @@
+firebase-admin
+pyyaml
+tclint==0.7.0
+yamlfix==1.19.1

.github/requirements/requirements_lock.txt

@@ -15,10 +15,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
+
       - name: Install Dependencies
         run: |
           python3 -m venv venv
-          venv/bin/pip install tclint==0.7.0
+          venv/bin/pip install -r .github/requirements/requirements_lock.txt
 
       - name: Lint
         run: |

.github/workflows/github-actions-lint-tcl.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Install Python Packages
         run: |
           python3 -m venv venv
-          venv/bin/pip install firebase-admin
+          venv/bin/pip install -r .github/requirements/requirements_lock.txt
       - name: Execute Python Script Update
         env:
           CREDS_FILE: ${{ secrets.CREDS_FILE }}

.github/workflows/github-actions-update-rules.yml

@@ -20,10 +20,14 @@ jobs:
           flow/scripts/variables.json
           docs/user/FlowVariables.md
           yamlfix.toml
+          .github/requirements/requirements_lock.txt
+    - uses: actions/setup-python@v6
+      with:
+        python-version: "3.10"
     - name: Install dependencies
       run: |
         python3 -m venv venv
-        venv/bin/pip install --quiet pyyaml yamlfix==1.19.1
+        venv/bin/pip install --quiet -r .github/requirements/requirements_lock.txt
     - name: Run generate-variables-docs.py
       run: |
         venv/bin/python3 flow/scripts/generate-variables-docs.py

.github/workflows/github-actions-yaml-test.yml

@@ -8,7 +8,7 @@ version: 2
 build:
   os: ubuntu-22.04
   tools:
-    python: "3.7"
+    python: "3.10"
 
 # Build documentation in the "docs/" directory with Sphinx
 sphinx:
@@ -19,4 +19,4 @@ sphinx:
 # See https://docs.readthedocs.io/en/stable/guides/reproducible-builds.html
 python:
    install:
-   - requirements: docs/requirements.txt
+   - requirements: docs/requirements_lock.txt

.readthedocs.yaml

@@ -8,6 +8,7 @@ FROM $fromImage
 WORKDIR /tmp/installer/etc
 
 COPY DependencyInstaller.sh .
+COPY requirements-common_lock.txt .
 
 COPY InstallerOpenROAD.sh \
        /tmp/installer/tools/OpenROAD/etc/DependencyInstaller.sh

docker/Dockerfile.dev

@@ -1,4 +1,4 @@
-git+https://github.com/executablebooks/sphinx-external-toc.git@v0.3.1
+sphinx-external-toc==0.3.1
 sphinx
 sphinx-autobuild
 myst-parser

docs/requirements.txt docs/requirements.indocs/requirements.txt renamed to docs/requirements.in

@@ -2,13 +2,16 @@
 
 set -euo pipefail
 
-# Make sure we are on the correct folder before beginning
+# Capture the script's absolute directory before any cd
 if [[ "$OSTYPE" == "darwin"* ]]; then
-    cd "$(dirname $(perl -e 'use Cwd "abs_path";print abs_path(shift)' $0))/../"
+    _script_dir="$(dirname $(perl -e 'use Cwd "abs_path";print abs_path(shift)' $0))"
 else
-    cd "$(dirname $(readlink -f $0))/../"
+    _script_dir="$(dirname $(readlink -f $0))"
 fi
 
+# Make sure we are on the correct folder before beginning
+cd "${_script_dir}/../"
+
 # package versions
 klayoutVersion=0.30.7
 if [[ "$OSTYPE" == "darwin"* ]]; then
@@ -36,23 +39,24 @@ _installPipCommon() {
         source /opt/rh/rh-python38/enable
         set -u
     fi
-    local pkgs="pandas numpy firebase_admin click pyyaml yamlfix"
+    local lockfile
+    lockfile="${_script_dir}/requirements-common_lock.txt"
     if [[ "$OSTYPE" == "darwin"* ]]; then
         if [[ "$EUID" -eq 0 ]]; then
             echo "Error: Do NOT run with sudo."
             exit 1
         fi
         if [[ -n "${VIRTUAL_ENV:-}" ]]; then
-            pip3 install --no-cache-dir -U $pkgs
+            pip3 install --no-cache-dir -r "$lockfile"
         else
             echo "Error: Activate a virtual environment on macOS."
             exit 1
         fi
     else
         if [[ $(id -u) == 0 ]]; then
-            pip3 install --no-cache-dir -U $pkgs
+            pip3 install --no-cache-dir -r "$lockfile"
         else
-            pip3 install --no-cache-dir --user -U $pkgs
+            pip3 install --no-cache-dir --user -r "$lockfile"
         fi
     fi
 }