ci: install build script tools from hash-locked requirements by TheGupta2012 · Pull Request #466 · qBraid/pyqasm

TheGupta2012 · 2026-10-26T07:57:27Z

Summary of changes

Fixes the six Scorecard Pinned-Dependencies alerts on the build scripts in bin/. Each pip install now uses a lock file in .github/requirements/ with --require-hashes:

Script	Lock	Locks
`bin/build_sdist.sh`	`sdist.txt`	build, twine, tomli
`bin/cibw/build_wheels.sh`	`cibuildwheel.txt`	cibuildwheel
`bin/cibw/pre_build.sh`	`pre-build.txt`	setuptools, wheel, cython, tomli
`bin/cibw/pre_build.sh` (pre-release only)	`pre-release.txt`	toml-cli, qbraid-core

The two pip install --upgrade pip lines are removed. They were unpinned installs too, and the build environments already ship a pip that reads these files.

Nothing builds differently. The locks pin the versions the last CI run on main installed: cibuildwheel 4.3.4, Cython 3.3.0, setuptools 84.2.1, wheel 0.48.0 and tomli 2.5.0. pre_build.sh runs as cibuildwheel's before-build step for each Python from 3.10 to 3.14, on Linux, Windows and macOS. That is why pre-build.txt and pre-release.txt are universal locks from Python 3.10. Dependabot's existing uv entry picks up the new .in files, and .gitattributes already collapses the .txt files in diffs.

Merge order

Merge #465 first. Until it lands, Dependabot's weekly uv update fails on the exact qbraid-core pin in lab-env-tools.in. This PR adds qbraid-core to pre-release.in, so it depends on that fix too. Both PRs add a CHANGELOG line in the same spot, so the second one to merge needs a rebase.

Validation

Each lock installs with real pip --require-hashes:
- pre-build.txt and pre-release.txt on Python 3.10 to 3.14.
- sdist.txt on 3.10, 3.11 and 3.14.
- cibuildwheel.txt on 3.11.
Each lock also resolves with uv pip install --dry-run --require-hashes for x86_64-manylinux_2_28, x86_64-pc-windows-msvc, aarch64-apple-darwin and x86_64-apple-darwin.
I ran the scripts end to end in a throwaway git copy:
- build_sdist.sh built the sdist and passed twine check.
- pre_build.sh passed on Python 3.10.
- pre_build.sh with PRE_RELEASE_BUILD=true passed on 3.11 and stamped 1.3.0a0.
With the locked cibuildwheel, all 20 build identifiers in the release matrix resolve (--print-build-identifiers).

This PR's CI runs the wheel builds through pre_build.sh and the sdist job. The pre-release path runs only in pre-release.yml. It is covered by the local run above.

argus-eye · 2026-10-26T07:57:31Z

Argus review

Auto-review is off for this repo. Tick the box below to run a review on this PR.

Running Argus review...

Estimated cost

Files changed: 12
Diff lines (±): 1473
Historical avg: ~337.3k tokens · ~$1.20 · across last 17 review(s)

Tip: you can also comment @argus-eye review at any time.

coderabbitai · 2026-10-26T07:57:36Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: qBraid/pyqasm
Branch: ci/pin-build-script-installs
File: .coderabbit.yaml
Commit: 932b9e0
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 2e91eca9-cba8-4cd5-ac4b-0d111c623159

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Scorecard flags the six pip installs in the wheel and sdist build scripts, because none check hashes. Each now installs from a lock file in .github/requirements/ with --require-hashes: - build_sdist.sh installs build, twine and tomli from sdist.txt. - cibw/build_wheels.sh installs cibuildwheel from cibuildwheel.txt. - cibw/pre_build.sh installs setuptools, wheel, cython and tomli from pre-build.txt, and for a pre-release toml-cli and qbraid-core from pre-release.txt. The locks pin the versions CI installs today, so nothing builds differently. They include cibuildwheel 4.3.4, Cython 3.3.0, setuptools 84.2.1 and wheel 0.48.0. pre_build.sh runs as cibuildwheel's before-build step for every Python from 3.10 to 3.14, on Linux, Windows and macOS, so pre-build.txt and pre-release.txt are universal from Python 3.10. Dependabot's uv entry picks up the new .in files. The two `pip install --upgrade pip` lines go away, since they were unpinned installs too. The pip that ships in the build environments already reads these files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

argus-eye

Argus · 10/10 — No findings

Argus reviewed 12 files and checked 3 for bugs, security, architecture, and regressions. Custom agent ponytail-review also ran. The diff matches the stated goal.

What this PR does · 13 author checks

Fix the six Scorecard Pinned-Dependencies alerts in bin/ by installing build script tools from hash-locked requirements without changing how builds run.

Author's checks

Build script pip installs use lock files in .github/requirements/ with --require-hashes.
bin/build_sdist.sh installs build, twine and tomli from sdist.txt.
bin/cibw/build_wheels.sh installs cibuildwheel from cibuildwheel.txt.
bin/cibw/pre_build.sh installs setuptools, wheel, cython and tomli from pre-build.txt.
The pre-release branch of bin/cibw/pre_build.sh installs toml-cli and qbraid-core from pre-release.txt.
Remove both pip install --upgrade pip lines.
pre-build.txt and pre-release.txt install with pip --require-hashes on Python 3.10 through 3.14.
sdist.txt installs with pip --require-hashes on Python 3.10, 3.11 and 3.14; cibuildwheel.txt installs on 3.11.
All locks resolve with uv pip install --dry-run --require-hashes for the four listed Linux, Windows and macOS target platforms.
build_sdist.sh builds the sdist and passes twine check.
pre_build.sh passes on Python 3.10; with PRE_RELEASE_BUILD=true it passes on 3.11 and stamps 1.3.0a0.
All 20 build identifiers in the release matrix resolve with the locked cibuildwheel.
Merge #465 first and rebase the second PR to resolve the overlapping CHANGELOG addition.

_{usage: 325.9k tokens · 19 stages}

_{Contract: config/full · checked: bug_hunter, security, architecture, regression, single-pass review, ponytail-review · review took 1m34s}

Stage	Model	Tokens	Cost
Intent	`openai/gpt-6.1-sol`	5.8k	$0.0116
Triage	`openai/gpt-6.1-sol`	26.5k	$0.0299
Lead agent	`openai/gpt-6.1-sol`	3.6k	$0.0204
Review specialists (15)	`openai/gpt-6.1-sol`	170.6k	$0.3575
Review	`openai/gpt-6.1-sol`	119.5k	$0.2448

_{Dashboard → · @argus-eye help}

_{🧠 Learned: 1 PR summary · 1 architecture note}

build_wheels.sh already runs from the repo root: cibuildwheel builds the package in the current directory, and every workflow calls the script from there. Resolving the lock from the script's own folder added nothing, so the path is now the same plain one the script assumes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

codecov-commenter · 2026-10-26T08:10:02Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

TheGupta2012 · 2026-10-26T08:10:08Z

No findings from Argus, merging

TheGupta2012 force-pushed the ci/pin-build-script-installs branch from 04b446b to 13664c1 Compare October 26, 2026 07:57

This comment has been minimized.

Sign in to view

TheGupta2012 and others added 2 commits October 26, 2026 13:32

docs(changelog): note the hash-locked build script installs

8ce9746

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

TheGupta2012 force-pushed the ci/pin-build-script-installs branch from 13664c1 to 8ce9746 Compare October 26, 2026 08:02

argus-eye Bot reviewed Oct 26, 2026

View reviewed changes

TheGupta2012 merged commit a742796 into main Oct 26, 2026
17 checks passed

Navigation Menu

Repository navigation

ci: install build script tools from hash-locked requirements - #466

ci: install build script tools from hash-locked requirements#466
TheGupta2012 merged 3 commits into
mainfrom
ci/pin-build-script-installs

TheGupta2012 commented Oct 26, 2026

Uh oh!

argus-eye Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

Review skipped

Uh oh!

This comment has been minimized.

argus-eye Bot left a comment

Uh oh!

codecov-commenter commented Oct 26, 2026

Uh oh!

TheGupta2012 commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

TheGupta2012 commented Oct 26, 2026

Summary of changes

Merge order

Validation

Uh oh!

argus-eye Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Argus review

Uh oh!

coderabbitai Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

This comment has been minimized.

argus-eye Bot left a comment

Choose a reason for hiding this comment

Argus · 10/10 — No findings

Uh oh!

codecov-commenter commented Oct 26, 2026

Codecov Report

Uh oh!

TheGupta2012 commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

argus-eye Bot commented Oct 26, 2026 •

edited

Loading

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading