Pin all the downstream repos (#13244)

* Pin all the downstream repos

A bump script to follow

* attempt to fix matrix

Author: alex

.github/downstream.d/aws-encryption-sdk.sh

@@ -2,9 +2,7 @@
 
 case "${1}" in
     install)
-        git clone --depth=1 https://github.com/awslabs/aws-encryption-sdk-python
         cd aws-encryption-sdk-python
-        git rev-parse HEAD
         uv pip install -e .
         uv pip install -r test/upstream-requirements-py311.txt
         ;;

.github/downstream.d/certbot-josepy.sh

@@ -2,9 +2,7 @@
 
 case "${1}" in
     install)
-        git clone --depth=1 https://github.com/certbot/josepy
         cd josepy
-        git rev-parse HEAD
         curl -sSL https://install.python-poetry.org | python3 -
         "${HOME}/.local/bin/poetry" self add poetry-plugin-export
         "${HOME}/.local/bin/poetry" export -f constraints.txt --dev --without-hashes -o constraints.txt

.github/downstream.d/certbot.sh

@@ -2,9 +2,7 @@
 
 case "${1}" in
     install)
-        git clone --depth=1 https://github.com/certbot/certbot
         cd certbot
-        git rev-parse HEAD
         uv pip install pip
         tools/pip_install.py -e ./acme[test]
         tools/pip_install.py -e ./certbot[test]

.github/downstream.d/dynamodb-encryption-sdk.sh

@@ -2,9 +2,7 @@
 
 case "${1}" in
     install)
-        git clone --depth=1 https://github.com/awslabs/aws-dynamodb-encryption-python
         cd aws-dynamodb-encryption-python
-        git rev-parse HEAD
         uv pip install -e .
         uv pip install -r test/upstream-requirements-py311.txt
         ;;

.github/downstream.d/mitmproxy.sh

@@ -2,9 +2,7 @@
 
 case "${1}" in
     install)
-        git clone --depth=1 https://github.com/mitmproxy/mitmproxy
         cd mitmproxy
-        git rev-parse HEAD
         uv pip install -r <(uv export --locked) -e .
         ;;
     run)

.github/downstream.d/paramiko.sh

@@ -2,9 +2,7 @@
 
 case "${1}" in
     install)
-        git clone --depth=1 https://github.com/paramiko/paramiko
         cd paramiko
-        git rev-parse HEAD
         uv --version
         uv sync --inexact --active
         ;;

.github/downstream.d/pyopenssl-release.sh

@@ -2,10 +2,7 @@
 
 case "${1}" in
     install)
-        VERSION=$(curl https://pypi.org/pypi/pyOpenSSL/json | jq -r .info.version)
-        git clone https://github.com/pyca/pyopenssl
         cd pyopenssl
-        git checkout "$VERSION"
         uv pip install -e ".[test]"
         ;;
     run)

.github/downstream.d/pyopenssl.sh

@@ -2,9 +2,7 @@
 
 case "${1}" in
     install)
-        git clone --depth=1 https://github.com/pyca/pyopenssl
         cd pyopenssl
-        git rev-parse HEAD
         uv pip install -e ".[test]"
         ;;
     run)

.github/downstream.d/scapy.sh

@@ -2,9 +2,7 @@
 
 case "${1}" in
     install)
-        git clone --depth=1 https://github.com/secdev/scapy
         cd scapy
-        git rev-parse HEAD
         uv pip install tox
         ;;
     run)

.github/downstream.d/sigstore.sh

@@ -4,9 +4,8 @@ case "${1}" in
     install)
         # NOTE: placed in /tmp to avoid inscrutable pytest failures
         # with 'unrecognized arguments: --benchmark-disable'
-        git clone --depth=1 https://github.com/sigstore/sigstore-python /tmp/sigstore-python
+        cp -r sigstore-python /tmp/sigstore-python
         cd /tmp/sigstore-python
-        git rev-parse HEAD
         uv pip install pip
         pip install -e ".[test]"
         ;;