Pin ruff and build pip installs by hash for OSSF scorecard compliance (#1864)

* Initial plan

* Pin pip commands with hashes for OSSF scorecard compliance

Add --require-hashes to all pip install commands across Dockerfiles,
CI workflows, and shell scripts. Generate locked requirements files
with hashes for e2e tests, docs, and sample deployments.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Revert requirements-locked.txt changes, keep only direct pip hash pinning

Remove all changes that involve requirements-locked.txt files per
user request. Retain direct pip install hash pinning for poetry,
ruff, build, and other version-pinned packages.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* fix: Remove --require-hashes/--hash from pip install commands

pip 26.0 removed the --hash CLI option. Hash verification via
command-line arguments is no longer supported; hashes can only be
specified in requirements files. Revert all pip install commands
to use simple version pinning (package==version) which is compatible
with all pip versions.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Pin pip commands by hash via requirements files for OSSF compliance

Use pip install --require-hashes with dedicated requirements files
instead of bare pip install commands. This satisfies the OSSF
scorecard pinned-dependencies check.

- Create requirements-poetry.txt, requirements-ruff.txt, and
  requirements-build.txt with SHA256 hashes
- Update all Dockerfiles to use hash-pinned poetry install
- Update ci.yml to use hash-pinned ruff, poetry, and build installs
- Update release.yml to use hash-pinned build install
- Update spark startup.sh to use hash-pinned requirements file

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Plan: inline hashes via /dev/stdin instead of separate files

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Inline pip hashes via printf|stdin, remove separate requirements files

Replace requirements-poetry.txt, requirements-ruff.txt, and
requirements-build.txt with inline printf|pip install -r /dev/stdin.
pip --hash only works inside requirements files, not as a CLI flag,
so piping through /dev/stdin is the most inline approach possible.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Simplify ruff hash: use single linux x86_64 hash instead of all 17 platform hashes

The lint job runs only on ubuntu-slim (x86_64), so only the
manylinux_2_17_x86_64 wheel hash is needed.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Fix Windows Dockerfiles: use PowerShell for hash-pinned pip install

The printf|/dev/stdin pattern is Unix-only and doesn't work on
Windows Server Core. Use PowerShell Set-Content to write a temp
requirements file instead. The hash is correct — poetry is a pure
Python wheel (py3-none-any), same on all platforms.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Fix CI: remove --no-deps from poetry and build pip installs

poetry and build have transitive dependencies (cleo, pyproject_hooks,
etc.) that must be installed. --no-deps prevented their installation,
causing ModuleNotFoundError: No module named 'cleo'.

ruff keeps --no-deps --require-hashes since it has zero Python deps.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Plan: move requirements files into .github/pipelines/

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Move CI requirements files to .github/pipelines/ directory

Organize all pip-compile generated requirements files under
.github/pipelines/ for ruff, poetry, and build tools. Replaces
inline printf hash approach with proper requirements files.

Component-level requirements-poetry.txt copies remain for Docker
build context (COPY requires files within build context).

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Remove unnecessary .in files from .github/pipelines/

The .in files are just pip-compile input files containing the direct
dependency name. This info is already in the header comment of each
generated .txt file, making the .in files redundant.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Share single requirements-poetry.txt via Docker --build-context

Replace 4 identical copies of requirements-poetry.txt (713 lines each)
with a single file at the repo root. Dockerfiles use COPY --from=pipelines
to access it from a named build context, eliminating duplication.

Also consolidate requirements-ruff.txt and requirements-build.txt
at the repo root.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Rename Docker build context from 'pipelines' to 'root'

The requirements files are at the repo root, not in a pipelines
directory. Rename the named build context to 'root' for clarity.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Scope down to CI-only ruff and build hash pinning

Revert all Docker changes (Dockerfiles, docker-compose.yml, build
context). Keep hash-pinned pip installs only for ruff and build in
CI workflow. Requirements files live in .github/pipelines/.

Reverted: all 10 Dockerfiles, docker-compose.yml, release.yml,
poetry install in ci.yml, spark startup.sh.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Add 0BSD to allowed licenses in dependency-review

Ruff's SPDX license expression is '0BSD AND Apache-2.0 AND
BSD-3-Clause AND MIT'. The 0BSD component was not in the allow
list, causing the dependency review to fail. 0BSD is a permissive
public-domain-equivalent license.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

* Fix dependency-review: allow ruff's full compound SPDX license

The dependency-review-action doesn't decompose compound SPDX
expressions. Ruff's license '0BSD AND Apache-2.0 AND BSD-3-Clause
AND MIT' must be listed as a complete expression in allow-licenses.

Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: SharonHart <15013757+SharonHart@users.noreply.github.com>
Co-authored-by: Sharon Hart <sharonh.dev@gmail.com>

Author: Copilot

.github/pipelines/requirements-build.txt

@@ -0,0 +1,18 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file=requirements-build.txt requirements-build.in
+#
+build==1.2.2.post1 \
+    --hash=sha256:1d61c0887fa860c01971625baae8bdd338e517b836a2f70dd1f7aa3a6b2fc5b5 \
+    --hash=sha256:b36993e92ca9375a219c99e606a122ff365a760a2d4bba0caa09bd5278b608b7
+    # via -r requirements-build.in
+packaging==26.0 \
+    --hash=sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4 \
+    --hash=sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529
+    # via build
+pyproject-hooks==1.2.0 \
+    --hash=sha256:1e859bd5c40fae9448642dd871adf459e5e2084186e8d2c2a79a824c970da1f8 \
+    --hash=sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913
+    # via build

.github/pipelines/requirements-ruff.txt

@@ -0,0 +1,26 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file=requirements-ruff.txt requirements-ruff.in
+#
+ruff==0.9.2 \
+    --hash=sha256:1a605fdcf6e8b2d39f9436d343d1f0ff70c365a1e681546de0104bef81ce88df \
+    --hash=sha256:3292c5a22ea9a5f9a185e2d131dc7f98f8534a32fb6d2ee7b9944569239c648d \
+    --hash=sha256:492a5e44ad9b22a0ea98cf72e40305cbdaf27fac0d927f8bc9e1df316dcc96eb \
+    --hash=sha256:71cbe22e178c5da20e1514e1e01029c73dc09288a8028a5d3446e6bba87a5145 \
+    --hash=sha256:80605a039ba1454d002b32139e4970becf84b5fee3a3c3bf1c2af6f61a784347 \
+    --hash=sha256:82b35259b0cbf8daa22a498018e300b9bb0174c2bbb7bcba593935158a78054d \
+    --hash=sha256:8b6a9701d1e371bf41dca22015c3f89769da7576884d2add7317ec1ec8cb9c3c \
+    --hash=sha256:8efd9da7a1ee314b910da155ca7e8953094a7c10d0c0a39bfde3fcfd2a015684 \
+    --hash=sha256:9cc53e68b3c5ae41e8faf83a3b89f4a5d7b2cb666dff4b366bb86ed2a85b481f \
+    --hash=sha256:a1b63fa24149918f8b37cef2ee6fff81f24f0d74b6f0bdc37bc3e1f2143e41c6 \
+    --hash=sha256:af1e9e9fe7b1f767264d26b1075ac4ad831c7db976911fa362d09b2d0356426a \
+    --hash=sha256:b338edc4610142355ccf6b87bd356729b62bf1bc152a2fad5b0c7dc04af77bfe \
+    --hash=sha256:b5eceb334d55fae5f316f783437392642ae18e16dcf4f1858d55d3c2a0f8f5d0 \
+    --hash=sha256:b9aab82bb20afd5f596527045c01e6ae25a718ff1784cb92947bff1f83068b00 \
+    --hash=sha256:c547f7f256aa366834829a08375c297fa63386cbe5f1459efaf174086b564247 \
+    --hash=sha256:c5e1d6abc798419cf46eed03f54f2e0c3adb1ad4b801119dedf23fcaf69b55b5 \
+    --hash=sha256:d18bba3d3353ed916e882521bc3e0af403949dbada344c20c16ea78f47af965e \
+    --hash=sha256:fbd337bac1cfa96be615f6efcd4bc4d077edbc127ef30e2b8ba2a27e18c054d4
+    # via -r requirements-ruff.in

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
           python-version: '3.11'
 
       - name: Install ruff
-        run: pip install ruff==0.9.2
+        run: pip install --no-deps --require-hashes -r .github/pipelines/requirements-ruff.txt
 
       - name: Run ruff check
         run: ruff check
@@ -55,7 +55,7 @@ jobs:
         uses: actions/dependency-review-action@c74b580d73376b7750d3d2a50bfb8adc2c937507 # v4.5.0
         with:
           fail-on-severity: low
-          allow-licenses: MIT, Apache-2.0, BSD-3-Clause
+          allow-licenses: MIT, Apache-2.0, BSD-3-Clause, 0BSD, 0BSD AND Apache-2.0 AND BSD-3-Clause AND MIT
           comment-summary-in-pr: on-failure
 
   test:
@@ -168,7 +168,7 @@ jobs:
       - name: Build wheel package
         working-directory: ${{ matrix.component.path }}
         run: |
-          pip install build==1.2.2.post1
+          pip install --require-hashes -r ${{ github.workspace }}/.github/pipelines/requirements-build.txt
           python -m build --wheel
 
   build-platform-images:

docs/samples/deployments/spark/setup/startup.sh

@@ -3,4 +3,4 @@
 pip install presidio-analyzer==2.2.361
 pip install presidio-anonymizer==2.2.361
 pip install azure-storage-blob==12.25.0
-python -m spacy download en_core_web_lg
+python -m spacy download en_core_web_lg

presidio-image-redactor/Dockerfile.dev

@@ -13,4 +13,4 @@ RUN apt-get update \
 RUN apt-get update  \
 && apt-get install ffmpeg libsm6 libxext6  -y
 
-RUN pip install poetry==2.3.2
+RUN pip install poetry==2.3.2