include hashes in requirements.txt

.github/workflows/pre_commit.yaml

@@ -55,7 +55,7 @@ jobs:
 
       - name: Compile requirements.txt
         run: |
-          uv pip compile pyproject.toml > requirements.txt
+          uv pip compile pyproject.toml --generate-hashes > requirements.txt
 
       - name: Validate requirements.txt
         run: |

README.md

@@ -214,5 +214,17 @@ To collaborate on this repository, please follow these steps:
 When updating python package dependencies in `pyproject.toml`, regenerate [requirements.txt](requirements.txt):
 
 ```
-uv pip compile pyproject.toml > requirements.txt
+uv pip compile pyproject.toml --generate-hashes > requirements.txt
 ```
+
+To regenerate `[requirements-build.txt](requirements-build.txt)` is currently a manual step.
+For this you need [pybuild-deps](https://pybuild-deps.readthedocs.io/en/latest/usage.html#pybuild-deps-compile) installed.
+
+Remove `kfp-pipeline-spec` from `requirement.txt`. And run:
+
+```bash
+pybuild-deps compile requirements.txt
+```
+
+> Note that, we do this because `kfp-pipeline-spec` only includes wheels and not the sources, this breaks
+> `pybuild-deps`, in the future we will need to a workaround (or get the package to include sdist) to automate this.

requirements-build.txt

@@ -0,0 +1,94 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pybuild-deps compile requirements.txt
+#
+calver==2022.6.26
+    # via trove-classifiers
+cython==3.0.11
+    # via pyyaml
+flit-core==3.10.1
+    # via
+    #   click
+    #   idna
+    #   jinja2
+    #   packaging
+    #   pathspec
+    #   wheel
+hatch-vcs==0.4.0
+    # via
+    #   filelock
+    #   platformdirs
+    #   virtualenv
+hatchling==1.27.0
+    # via
+    #   filelock
+    #   hatch-vcs
+    #   platformdirs
+    #   virtualenv
+maturin==1.8.1
+    # via ruff
+mypy==1.14.0
+    # via charset-normalizer
+mypy-extensions==1.0.0
+    # via mypy
+packaging==24.2
+    # via setuptools-scm
+pathspec==0.12.1
+    # via hatchling
+pluggy==1.5.0
+    # via hatchling
+poetry-core==2.0.1
+    # via
+    #   docstring-parser
+    #   rsa
+semantic-version==2.10.0
+    # via setuptools-rust
+setuptools-rust==1.10.2
+    # via maturin
+setuptools-scm==8.1.0
+    # via
+    #   charset-normalizer
+    #   hatch-vcs
+    #   nodeenv
+    #   pluggy
+    #   setuptools-rust
+    #   setuptools-scm
+setuptools-scm==7.1.0
+    # via python-dateutil
+trove-classifiers==2025.1.15.22
+    # via hatchling
+types-psutil==6.1.0.20241221
+    # via mypy
+types-setuptools==75.8.0.20250110
+    # via mypy
+typing-extensions==4.12.2
+    # via
+    #   mypy
+    #   setuptools-scm
+wheel==0.45.1
+    # via
+    #   cachetools
+    #   distlib
+    #   google-crc32c
+    #   maturin
+    #   python-dateutil
+    #   pyyaml
+    #   tabulate
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==75.8.0
+    # via
+    #   cachetools
+    #   charset-normalizer
+    #   distlib
+    #   google-api-core
+    #   google-crc32c
+    #   markupsafe
+    #   maturin
+    #   proto-plus
+    #   pyasn1
+    #   pyasn1-modules
+    #   pyyaml
+    #   setuptools-scm