fix: ensure deterministic and reproducible workflow behavior

.github/workflows/pr-check-primary-codecov.yml

@@ -39,7 +39,7 @@ jobs:
 
       - name: Install dependencies
         run: |
-          uv sync --all-extras --dev
+          uv sync --frozen --all-groups --all-packages --all-extras
 
       - name: Generate Proto Files
         run: uv run python generate_proto.py

.github/workflows/pr-check-primary-codeql.yml

@@ -63,7 +63,7 @@ jobs:
 
             - name: Install dependencies
               if: matrix.language == 'python'
-              run: uv sync --all-extras --dev
+              run: uv sync --frozen --all-groups --all-packages --all-extras
 
             - name: Perform CodeQL Analysis
               uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.3.5

.github/workflows/pr-check-secondary-deps-test.yml

@@ -29,7 +29,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
+        with:
+          fetch-depth: 0 # ensure full git history for SCM-based versioning
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -44,7 +45,8 @@ jobs:
 
       - name: Install minimum dependencies and tooling
         run: |
-          uv sync --all-extras --resolution=lowest-direct
+         # Minimum-deps compatibility check: use a non-editable install for stable packaging behavior.
+          uv sync --all-extras --resolution=lowest-direct --no-editable
 
       - name: Show resolved core dependency versions
         run: |

.github/workflows/pr-check-secondary-examples.yml

@@ -27,7 +27,7 @@ jobs:
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 
       - name: Install dependencies
-        run: uv sync --all-extras
+        run: uv sync --frozen --all-groups --all-packages --all-extras
 
       - name: Generate Proto Files
         run: uv run python generate_proto.py

.github/workflows/pr-check-secondary-tck-test.yml

@@ -47,7 +47,7 @@ jobs:
           enable-cache: true
 
       - name: Install dependencies
-        run: uv sync --all-extras --dev
+        run: uv sync --frozen --all-groups --all-packages --all-extras
 
       - name: Generate Proto Files
         run: uv run generate_proto.py

.github/workflows/pr-check-secondary-unit-integration-test.yml

@@ -59,7 +59,7 @@ jobs:
           enable-cache: true
 
       - name: Install dependencies
-        run: uv sync --all-extras --dev
+        run: uv sync --frozen --all-groups --all-packages --all-extras
 
       - name: Generate Proto Files
         run: uv run generate_proto.py
@@ -122,7 +122,7 @@ jobs:
           enable-cache: true
 
       - name: Install dependencies
-        run: uv sync --all-extras --dev
+        run: uv sync --frozen --all-groups --all-packages --all-extras
 
       - name: Generate Proto Files
         run: uv run generate_proto.py

.github/workflows/publish.yml

@@ -35,8 +35,10 @@ jobs:
       - name: Upgrade pip
         run: pip install "pip==26.0.1"
 
+      # Dependency versions are pinned to ensure reproducible builds.
+      # These should be periodically reviewed and updated for ensuring smooth execution.
       - name: Install build, pdm-backend, and grpcio-tools
-        run: pip install build pdm-backend "grpcio-tools==1.76.0"
+        run: pip install build==1.5 pdm-backend==2.4.8 grpcio-tools==1.76.0
 
       - name: Generate Protobuf
         run: python generate_proto.py

.gitignore

@@ -35,7 +35,6 @@ src/hiero_sdk_python/hapi
 .hypothesis/
 
 # Lock files
-uv.lock
 pdm.lock
 pubkey.asc
 

pyproject.toml

@@ -62,15 +62,20 @@ lint = [
 default-groups = ["dev", "lint"]
 
 [build-system]
-requires = ["pdm-backend", "setuptools", "setuptools_scm", "grpcio-tools"]
+requires = [
+    "pdm-backend>=2.4.8,<3",
+    "setuptools>=82,<83",
+    "setuptools_scm>=7,<9",
+    "grpcio-tools>=1.76.0,<2"
+]
 build-backend = "pdm.backend"
 
 [tool.setuptools_scm]
 version_scheme = "python-simplified-semver"
 local_scheme = "dirty-tag"
 
-[tool.pdm]
-version = { source = "scm" }
+[tool.pdm.version]
+source = "scm"
 
 [tool.pdm.build]
 package-dir = "src"