Niels Lohmann b2626e25f6 ci: pin pip dependencies by hash (#6046) ...

Add sha256 hashes for every release file to the requirements of the
astyle and natvis tools, and install Meson in the ubuntu workflow from a
new hashed requirements file with --require-hashes instead of an
unpinned "pip install meson". pip verifies all installs from these files
once they contain hashes, including the ones of the Makefile and
cmake/ci.cmake. Addresses the Scorecard Pinned-Dependencies alerts for
ubuntu.yml; the check_amalgamation.yml flags follow once develop has the
hashes.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

2026-11-10 07:08:25 +01:00

..

.astylerc

Overwork astyle call (#4573)

2024-12-29 17:06:03 +01:00

requirements.txt

ci: pin pip dependencies by hash (#6046)

2026-11-10 07:08:25 +01:00