fix(ci): replace --require-hashes with pinned versions for pip installs

Author: markuslf

.github/workflows/docs.yml

@@ -32,7 +32,7 @@ jobs:
           python-version: '3.12'
 
       - name: 'Install dependencies'
-        run: 'pip install --require-hashes --requirement docs-requirements.txt'
+        run: 'pip install mkdocs==1.6.1 mkdocs-material==9.7.6'
 
       - name: 'Generate docs structure'
         run: 'python3 tools/build-docs'

.github/workflows/lf-build.yml

@@ -71,7 +71,7 @@ jobs:
       - name: 'Install Ansible Builder'
         run: |
           python3 -m pip install --upgrade pip
-          pip install --require-hashes --requirement build-requirements.txt
+          pip install ansible-builder==3.1.1
 
       - name: 'Strip badges from README.md (not rendered correctly on Galaxy)'
         run: |

.github/workflows/pre-commit-autoupdate.yml

@@ -28,7 +28,7 @@ jobs:
           python-version: '3.12'
 
       - name: 'Install pre-commit'
-        run: 'pip install --require-hashes --requirement pre-commit-requirements.txt'
+        run: 'pip install pre-commit==4.5.1'
 
       - name: 'Run pre-commit autoupdate'
         run: 'pre-commit autoupdate'

CHANGELOG.md

@@ -12,7 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-* **ci**: Fix `--require-hashes` pip installs by providing complete requirements files with all transitive dependencies pinned
+* **ci**: Fix pip installs by replacing `--require-hashes` with pinned versions to allow Dependabot updates
 * **role:mount**: Fix `when` condition for NFS/CIFS client package installation failing with multiple mounts and when `state` key is undefined
 
 ### Changed