Pin workflow actions to SHAs and install tig-cli from hash-locked deps (SonarCloud)

.github/workflows/build-publish-fullfeatured.yml

@@ -94,7 +94,7 @@ jobs:
       # in the daemon for the test step below to run it.
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -130,7 +130,7 @@ jobs:
 
       - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ steps.build-args.outputs.image }}
           tags: |

.github/workflows/build-publish-terrain-intelligence-generator.yml

@@ -69,19 +69,19 @@ jobs:
           df -h
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -126,7 +126,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: ./terrain-intelligence-generator/docker
           file: ./terrain-intelligence-generator/docker/Dockerfile
@@ -669,7 +669,7 @@ jobs:
           EOF
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           body_path: release-notes.md
           draft: false

.github/workflows/build-publish-visor-variants.yml

@@ -120,7 +120,7 @@ jobs:
       # to be in the daemon for the test step below to run it.
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -139,7 +139,7 @@ jobs:
 
       - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ steps.build-args.outputs.image }}
           tags: |

.github/workflows/calibration-demo.yml

@@ -46,7 +46,9 @@ jobs:
       # The demo runs every MARS program through tig, so the CLI is a
       # prerequisite, not an optional convenience.
       - name: Install tig-cli
-        run: pip install ./tig-cli
+        run: |
+          python -m pip install --only-binary :all: --require-hashes -r tig-cli/requirements.txt
+          python -m pip install --only-binary :all: --no-deps --no-build-isolation ./tig-cli
 
       - name: Run the demo against real VISOR calibration
         run: ./terrain-intelligence-generator/test-calibration-demo.sh "${IMAGE_TAG}"

.github/workflows/publish-test.yml

@@ -17,12 +17,13 @@ jobs:
           python-version: "3.12"
 
       - name: Install build tools
-        run: python -m pip install --upgrade pip build
+        run: |
+          python -m pip install --only-binary :all: --require-hashes -r tig-cli/requirements-release.txt
 
       - name: Build package
         run: |
           cd tig-cli
-          python -m build
+          python -m build --no-isolation
 
       - name: Upload distribution artifacts
         uses: actions/upload-artifact@v4
@@ -46,6 +47,6 @@ jobs:
           path: dist/
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/

.github/workflows/publish.yml

@@ -53,8 +53,8 @@ jobs:
 
       - name: Install package with dev deps
         run: |
-          python -m pip install --upgrade pip
-          python -m pip install -e ".[dev]"
+          python -m pip install --only-binary :all: --require-hashes -r requirements-dev.txt
+          python -m pip install --only-binary :all: --no-deps --no-build-isolation -e .
 
       - name: Run unit tests
         run: python -m pytest tests/ -v --no-cov -m "not integration"
@@ -84,10 +84,11 @@ jobs:
           fi
 
       - name: Install build tooling
-        run: python -m pip install --upgrade pip build twine
+        run: |
+          python -m pip install --only-binary :all: --require-hashes -r requirements-release.txt
 
       - name: Build sdist and wheel
-        run: python -m build
+        run: python -m build --no-isolation
 
       - name: Check distribution metadata
         run: python -m twine check dist/*
@@ -114,7 +115,7 @@ jobs:
           path: dist/
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
           packages-dir: dist/
@@ -135,6 +136,6 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           packages-dir: dist/

.github/workflows/release-visual-regression.yml

@@ -44,10 +44,12 @@ jobs:
           python-version: '3.11'
 
       - name: Install the tig CLI
-        run: pip install ./tig-cli
+        run: |
+          python -m pip install --only-binary :all: --require-hashes -r tig-cli/requirements.txt
+          python -m pip install --only-binary :all: --no-deps --no-build-isolation ./tig-cli
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/test.yml

@@ -33,8 +33,8 @@ jobs:
       - name: Install dependencies
         run: |
           cd tig-cli
-          python -m pip install --upgrade pip
-          python -m pip install -e ".[dev]"
+          python -m pip install --only-binary :all: --require-hashes -r requirements-dev.txt
+          python -m pip install --only-binary :all: --no-deps --no-build-isolation -e .
 
       - name: Run tests
         run: |
@@ -49,7 +49,7 @@ jobs:
 
       - name: Upload coverage
         if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
         with:
           file: ./tig-cli/coverage.xml
           fail_ci_if_error: false

tig-cli/pyproject.toml

@@ -23,6 +23,21 @@ dev = [
     "pytest-mock>=3.10.0",
 ]
 
+# Build and release tooling for CI, which builds with --no-build-isolation.
+# Everything is locked in uv.lock; CI installs from the hash-pinned exports
+# requirements.txt, requirements-dev.txt and requirements-release.txt. After
+# changing any dependency, run `uv lock` and the `uv export` command recorded
+# at the top of each requirements file.
+[dependency-groups]
+backend = [
+    "setuptools>=61.0",
+    "wheel",
+]
+release = [
+    "build",
+    "twine",
+]
+
 [build-system]
 requires = ["setuptools>=61.0", "wheel"]
 build-backend = "setuptools.build_meta"