Make check-deps deterministic

Author: Tooru

scripts/check-deps.sh

@@ -35,11 +35,16 @@ echo "Checking if lock files are up to date..."
 # Common pip-compile flags (must match compile-deps.sh)
 COMPILE_FLAGS="--quiet --strip-extras --generate-hashes --allow-unsafe"
 
-# Compile without modifying tracked files.
-# Note: pip-compile prints the generated requirements to STDERR in --dry-run mode.
-"${VENV_DIR}/bin/pip-compile" ${COMPILE_FLAGS} --dry-run --output-file=server/requirements.txt server/requirements.in 1>/dev/null 2>"${TEMP_DIR}/server-requirements.txt"
-"${VENV_DIR}/bin/pip-compile" ${COMPILE_FLAGS} --dry-run --output-file=harness/requirements.txt harness/requirements.in 1>/dev/null 2>"${TEMP_DIR}/harness-requirements.txt"
-"${VENV_DIR}/bin/pip-compile" ${COMPILE_FLAGS} --dry-run --output-file=requirements-dev.txt requirements-dev.in 1>/dev/null 2>"${TEMP_DIR}/dev-requirements.txt"
+# Seed temp outputs with current lockfiles so pip-compile reuses pinned versions
+# (pip-compile treats an existing output file as a constraints source unless --upgrade is used).
+cp server/requirements.txt "${TEMP_DIR}/server-requirements.txt"
+cp harness/requirements.txt "${TEMP_DIR}/harness-requirements.txt"
+cp requirements-dev.txt "${TEMP_DIR}/dev-requirements.txt"
+
+# Compile to temporary files (with hashes to match compile-deps.sh)
+"${VENV_DIR}/bin/pip-compile" ${COMPILE_FLAGS} --output-file="${TEMP_DIR}/server-requirements.txt" server/requirements.in
+"${VENV_DIR}/bin/pip-compile" ${COMPILE_FLAGS} --output-file="${TEMP_DIR}/harness-requirements.txt" harness/requirements.in
+"${VENV_DIR}/bin/pip-compile" ${COMPILE_FLAGS} --output-file="${TEMP_DIR}/dev-requirements.txt" requirements-dev.in
 
 strip_pip_compile_header() {
     awk 'BEGIN{started=0} started{print; next} /^[[:space:]]*$/{next} /^#/{next} {started=1; print}' "$1"
@@ -49,16 +54,19 @@ CHANGES=0
 
 if ! diff <(strip_pip_compile_header server/requirements.txt) <(strip_pip_compile_header "${TEMP_DIR}/server-requirements.txt") >/dev/null 2>&1; then
     echo "❌ server/requirements.txt is out of date"
+    diff -u <(strip_pip_compile_header server/requirements.txt) <(strip_pip_compile_header "${TEMP_DIR}/server-requirements.txt") | head -n 80 || true
     CHANGES=1
 fi
 
 if ! diff <(strip_pip_compile_header harness/requirements.txt) <(strip_pip_compile_header "${TEMP_DIR}/harness-requirements.txt") >/dev/null 2>&1; then
     echo "❌ harness/requirements.txt is out of date"
+    diff -u <(strip_pip_compile_header harness/requirements.txt) <(strip_pip_compile_header "${TEMP_DIR}/harness-requirements.txt") | head -n 80 || true
     CHANGES=1
 fi
 
 if ! diff <(strip_pip_compile_header requirements-dev.txt) <(strip_pip_compile_header "${TEMP_DIR}/dev-requirements.txt") >/dev/null 2>&1; then
     echo "❌ requirements-dev.txt is out of date"
+    diff -u <(strip_pip_compile_header requirements-dev.txt) <(strip_pip_compile_header "${TEMP_DIR}/dev-requirements.txt") | head -n 80 || true
     CHANGES=1
 fi