chore: unify dependency pinning setup

Author: paulschwoerer

.envrc

@@ -1,4 +1,27 @@
 ls venv &> /dev/null || python3 -mvenv venv || exit 1
 source venv/bin/activate || exit 1
-pip install -r requirements.txt || exit 1
+
+pip install pip-tools pip-audit|| exit 1
+
+if [ ! -f "requirements.txt" ]; then
+  echo "requirements.txt not found. Compiling from pyproject.toml..."
+  pip-compile -v --all-extras --generate-hashes --allow-unsafe --output-file=requirements.txt pyproject.toml || exit 1
+#   --allow-unsafe / --no-allow-unsafe
+#     Pin packages considered unsafe: distribute,
+#     pip, setuptools.
+#
+#     WARNING: Future versions of pip-tools will
+#     enable this behavior by default. Use --no-
+#     allow-unsafe to keep the old behavior. It is
+#     recommended to pass the --allow-unsafe now
+#     to adapt to the upcoming change.
+fi
+
+echo "Auditing locked dependencies..."
+# not using --strict because no vulnerability info can be found for http-request-recorder
+pip-audit --require-hashes -r requirements.txt || exit 1
+
+echo "Installing with strict hash verification..."
+pip install --require-hashes --only-binary :all: -r requirements.txt || exit 1
+
 pre-commit install

.github/workflows/slack-notification.yaml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Post to a Slack channel
         id: slack
-        uses: slackapi/slack-github-action@v1.23.0
+        uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 #v1.27.1
         with:
           channel-id: ${{ inputs.channel }}
           payload: |

.github/workflows/verify.yaml

@@ -10,43 +10,37 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c #v4.9.1
         with:
           python-version: '3.12'
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install ruff
+        run: pip install ruff
       - name: Lint with Ruff
         run: ruff check --output-format=github .
         continue-on-error: false
 
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c #v4.9.1
         with:
           python-version: '3.12'
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements.txt
+        run: pip install --require-hashes -r requirements.txt
       - name: Run tests
         run: python -m unittest
 
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c #v4.9.1
         with:
           python-version: '3.12'
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install build
+        run: pip install build
       - name: Build package
         run: python -m build
 

.pre-commit-config.yaml

@@ -1,11 +1,12 @@
+# pre-commit autoupdate --freeze
 repos:
-  - repo: https://github.com/charliermarsh/ruff-pre-commit
-    rev: 'v0.12.10'
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: '5e2fb545eba1ea9dc051f6f962d52fe8f76a9794'  # frozen: v0.15.13
     hooks:
       - id: ruff
         args: ['--fix']
 
   - repo: https://github.com/hhatto/autopep8
-    rev: 'v2.3.2'
+    rev: '4046ad49e25b7fa1db275bf66b1b7d60600ac391'  # frozen:  v2.3.2
     hooks:
       - id: autopep8

pyproject.toml

@@ -20,10 +20,10 @@ dependencies = []
 
 [project.optional-dependencies]
 jobd = [
-    "http_request_recorder @ https://github.com/sipgate/http-request-recorder/archive/96a89cef0b71faab11121af5b28a60aeb887af5a.zip"
+    "http_request_recorder @ https://github.com/sipgate/http-request-recorder/archive/bf99fe64fd67db9df845be0e8da7e2601d9c8eef.zip"
 ]
 rpc_matchers = [
-    "http_request_recorder @ https://github.com/sipgate/http-request-recorder/archive/96a89cef0b71faab11121af5b28a60aeb887af5a.zip"
+    "http_request_recorder @ https://github.com/sipgate/http-request-recorder/archive/bf99fe64fd67db9df845be0e8da7e2601d9c8eef.zip"
 ]
 db = [
     "SQLAlchemy~=2.0.43"