chore: Add dependency lockfile for reproducible builds#61
Merged
datasciencemonkey merged 3 commits intomainfrom Mar 12, 2026
Merged
chore: Add dependency lockfile for reproducible builds#61datasciencemonkey merged 3 commits intomainfrom
datasciencemonkey merged 3 commits intomainfrom
Conversation
Generated with uv pip compile. Pins all 145 transitive dependencies to exact versions with provenance comments. - requirements.txt: loose pins for development - requirements.lock: exact pins for deployment Regenerate with: uv pip compile requirements.txt -o requirements.lock Fixes #60 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Runs pip-audit against requirements.lock on every PR that touches dependency files. Catches known vulnerabilities before they merge to main. Also warns if lockfile is stale. Triggers on: - PRs modifying requirements.txt or requirements.lock - Pushes to main modifying the same Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Patch release: dependency lockfile + automated audit workflow. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
requirements.lockwith all 145 transitive dependencies pinned to exact versionsuv pip compile— includes provenance comments showing which package requires whatUsage
requirements.txtrequirements.lockuv pip install -r requirements.lock)Maintenance
Fixes #60
🤖 Generated with Claude Code