ci: install CI dependencies from hash-pinned locks

.github/workflows/ci.yml

@@ -26,7 +26,12 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install package and dev deps
-        run: pip install -e ".[dev]"
+        # Third-party dependencies come from the hash-pinned lock first; the
+        # local package then goes in with --no-deps, because pip cannot
+        # hash-pin an editable install in the same invocation.
+        run: |
+          pip install --require-hashes -r requirements/dev.txt
+          pip install --no-deps -e .
 
       - name: Lint
         run: ruff check src tests scripts

.github/workflows/docs.yml

@@ -48,8 +48,9 @@ jobs:
 
       - name: Install docs dependencies
         run: |
-          pip install -r requirements-docs.txt
-          pip install -e ".[dev]"
+          pip install --require-hashes -r requirements/docs.txt
+          pip install --require-hashes -r requirements/dev.txt
+          pip install --no-deps -e .
 
       - name: Configure git for gh-deploy
         run: |

.github/workflows/publish.yml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Build wheel and sdist
         run: |
-          pip install hatchling
+          pip install --require-hashes -r requirements/build.txt
           python -m hatchling build
 
       - name: Verify wheel as installed artifact

requirements/build.in

@@ -0,0 +1,4 @@
+# Build backend for the release path. Compile with:
+#   uv pip compile requirements/build.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/build.txt
+hatchling

requirements/build.txt

@@ -0,0 +1,26 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile requirements/build.in --generate-hashes --universal --python-version 3.11 -o requirements/build.txt
+hatchling==1.32.0 \
+    --hash=sha256:0bdbde4a52b06c37e3eca395f85a762bf0ef06fe374fd8ae429dc6be10230f5f \
+    --hash=sha256:0e17c9c3b9aa7c625acc8d0f5b622f107d5049af9ecf5ada4de1aada5be7cdbc
+    # via -r requirements/build.in
+packaging==26.3 \
+    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
+    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
+    # via hatchling
+pathspec==1.1.1 \
+    --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \
+    --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189
+    # via hatchling
+pluggy==1.6.0 \
+    --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
+    --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+    # via hatchling
+tomlkit==0.15.1 \
+    --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
+    --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
+    # via hatchling
+trove-classifiers==2026.6.1.19 \
+    --hash=sha256:ab4c4ec93cc4a4e7815fa759906e05e6bb3f2fbd92ea0f897288c6a43efd15b3 \
+    --hash=sha256:c5132b4b61a829d11cfbd2d72e97f20a45ed6edb95e45c5efdeb5e00836b2745
+    # via hatchling

requirements/dev.in

@@ -0,0 +1,17 @@
+# Runtime + dev dependencies, mirroring [project.dependencies] and the dev
+# extra. Installed with --require-hashes before the local package goes in with
+# --no-deps, because pip cannot hash-pin an editable install in the same
+# invocation. Compile with:
+#   uv pip compile requirements/dev.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/dev.txt
+pydantic>=2.13.5
+jsonschema>=4.26.0
+rfc3986-validator>=0.1.1
+cryptography>=42.0
+referencing>=0.28
+rfc8785>=0.1.4
+pytest>=9.1.1
+pytest-cov>=7.1.0
+ruff>=0.4
+mypy>=1.10
+types-jsonschema