ci: install CI dependencies from hash-pinned locks

.github/workflows/ci.yml

@@ -31,14 +31,22 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+        # Third-party dependencies come from the hash-pinned lock first; the
+        # local package then goes in with --no-deps, because pip cannot
+        # hash-pin an editable install in the same invocation.
+        run: |
+          python -m pip install --require-hashes -r requirements/dev.txt
+          python -m pip install --no-deps -e .
 
       - name: Security scan
         # --skip-editable: pip-audit resolves the editable install of this package
         # against PyPI and fails when the version is not published yet, so without
         # it no version-bump PR can ever pass CI. Dependencies are still audited.
         #
-        run: pip install bandit pip-audit && bandit -r src/ -c pyproject.toml && pip-audit --skip-editable
+        # bandit and pip-audit are already in the dev extra above, so the
+        # scan runs against the same pinned versions rather than fetching
+        # whatever is current at scan time.
+        run: bandit -r src/ -c pyproject.toml && pip-audit --skip-editable
 
       - name: Lint
         run: ruff check src/ tests/
@@ -67,12 +75,17 @@ jobs:
           python-version: "3.12"
 
       - name: Install cMCP dependencies
-        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+        # Third-party dependencies come from the hash-pinned lock first; the
+        # local package then goes in with --no-deps, because pip cannot
+        # hash-pin an editable install in the same invocation.
+        run: |
+          python -m pip install --require-hashes -r requirements/dev.txt
+          python -m pip install --no-deps -e .
 
       - name: Install AGT as isolated CI tooling
         run: |
           python -m venv .agt-venv
-          .agt-venv/bin/python -m pip install --upgrade pip "agent-governance-toolkit>=4.1"
+          .agt-venv/bin/python -m pip install --require-hashes -r requirements/agt.txt
           .agt-venv/bin/python -m pip install --no-deps -e .
 
       - name: Generate evidence file
@@ -119,7 +132,12 @@ jobs:
           python-version: "3.12"
 
       - name: Install dependencies
-        run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]"
+        # Third-party dependencies come from the hash-pinned lock first; the
+        # local package then goes in with --no-deps, because pip cannot
+        # hash-pin an editable install in the same invocation.
+        run: |
+          python -m pip install --require-hashes -r requirements/dev.txt
+          python -m pip install --no-deps -e .
 
       - name: Run benchmark (software-only, CI gate p99 < 5ms)
         run: python -m cmcp_runtime.benchmarks --provider software-only --calls 10000 --out benchmarks/

.github/workflows/docs-check.yml

@@ -21,6 +21,10 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
-      - run: python -m pip install -r requirements-docs.txt -e .
+      # The runtime dependencies too: this job imports the package, and the
+      # docs lock alone does not carry httpx and friends.
+      - run: python -m pip install --require-hashes -r requirements/docs.txt
+      - run: python -m pip install --require-hashes -r requirements/dev.txt
+      - run: python -m pip install --no-deps -e .
       - run: python -m mkdocs build --strict
       - run: python scripts/check_docs_quickstart.py

.github/workflows/docs.yml

@@ -42,8 +42,9 @@ jobs:
 
       - name: Install docs dependencies
         run: |
-          pip install -r requirements-docs.txt
-          pip install -e ".[dev]"
+          pip install --require-hashes -r requirements/docs.txt
+          pip install --require-hashes -r requirements/dev.txt
+          pip install --no-deps -e .
 
       - name: Configure git for gh-deploy
         run: |

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install build
-        run: python -m pip install build twine
+        run: python -m pip install --require-hashes -r requirements/release.txt
 
       - name: Build distributions
         run: python -m build
@@ -91,7 +91,7 @@ jobs:
       - name: Install AGT as isolated release tooling
         run: |
           python -m venv .agt-venv
-          .agt-venv/bin/python -m pip install --upgrade pip "agent-governance-toolkit>=4.1"
+          .agt-venv/bin/python -m pip install --require-hashes -r requirements/agt.txt
           .agt-venv/bin/python -m pip install --no-deps -e .
 
       - name: Generate evidence file

requirements/agt.in

@@ -0,0 +1,6 @@
+# The governance scanner, installed into its own venv on purpose: AGT 4.1
+# constrains cryptography below 49 while the runtime requires 50+, so the
+# scanner's resolution must not touch the package under test. Compile with:
+#   uv pip compile requirements/agt.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/agt.txt
+agent-governance-toolkit>=4.1