Pin the build backend to hashes

.github/workflows/release.yml

@@ -154,7 +154,8 @@ jobs:
           mkdir -p "${dist_dir}"
           shopt -s nullglob
 
-          uv build --wheel --sdist --out-dir "${dist_dir}" --no-create-gitignore
+          uv build --wheel --sdist --out-dir "${dist_dir}" --no-create-gitignore \
+            --build-constraints build-requirements.txt --require-hashes
           project_wheels=("${dist_dir}"/*.whl)
           if [[ "${#project_wheels[@]}" -ne 1 ]]; then
             echo "::error title=Unexpected wheel count::Expected one project wheel, found ${#project_wheels[@]}."

.github/workflows/validate.yml

@@ -74,7 +74,7 @@ jobs:
               esac
 
               case "${changed_file}" in
-                .python-version|LICENSE|README.md|pyproject.toml|uv.lock|src/*)
+                .python-version|LICENSE|README.md|build-requirements.txt|pyproject.toml|uv.lock|src/*)
                   package_changed=true
                   ;;
               esac
@@ -246,7 +246,9 @@ jobs:
         run: python -m pip install "uv==${UV_VERSION}"
 
       - name: Build distributions
-        run: uv build --wheel --sdist --out-dir dist --no-create-gitignore
+        run: |
+          uv build --wheel --sdist --out-dir dist --no-create-gitignore \
+            --build-constraints build-requirements.txt --require-hashes
 
       - name: Smoke test installed wheel
         run: |

AGENTS.md

@@ -60,6 +60,9 @@ uv run python -m unittest discover -s tests
 - The release workflow builds from the tag and checks that wheel and source
   distribution filenames match the tag version before publishing.
 - Do not make the release workflow edit `pyproject.toml` or `uv.lock`.
+- `build-requirements.txt` pins the build backend and everything it installs
+  to hashes. `uv build` fails on any build requirement missing from it, so a
+  new entry in `build-system.requires` needs the file regenerated.
 - The release workflow fails when `uv.lock` is behind the latest releases
   `pyproject.toml` allows. Before tagging, merge open Renovate PRs and run the
   freshness check on `origin/main`. If it lists updates, tick the lock file

build-requirements.txt

@@ -0,0 +1,34 @@
+# Hash-pinned build requirements, used by `uv build --build-constraints`.
+# Renovate updates the pins. To regenerate from scratch:
+#   printf 'hatchling\nhatch-vcs\n' | uv pip compile - --universal \
+#     --python-version 3.11 --generate-hashes --no-header --no-annotate
+hatch-vcs==0.5.0 \
+    --hash=sha256:0395fa126940340215090c344a2bf4e2a77bcbe7daab16f41b37b98c95809ff9 \
+    --hash=sha256:b49677dbdc597460cc22d01b27ab3696f5e16a21ecf2700fb01bc28e1f2a04a7
+hatchling==1.33.0 \
+    --hash=sha256:415290b84f464d2884303fca8974d38e7b85579069fab02a15db0828fbb1446d \
+    --hash=sha256:4c422bd4d554fcff5de5b73e9596f85e41e9f97f7e553d8f7595ecb31a627bef
+packaging==26.3 \
+    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
+    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
+pathspec==1.1.1 \
+    --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \
+    --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189
+pluggy==1.7.0 \
+    --hash=sha256:7dd7b0d8832ba3cb632c306926ded123429211b83641b35dc5c41ad2d34f9bec \
+    --hash=sha256:d1eaa46ebb595891b860ab086b4d09c8588af65ebd4361b8e8f4bb8920b90ba8
+setuptools==84.2.1 \
+    --hash=sha256:3ff8b3b5492a0aa66960f4419365a86b84e013070d4313e4d4a6894f5d64d6bc \
+    --hash=sha256:ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2
+setuptools-scm==10.3.4 \
+    --hash=sha256:82f34c3e3084fc2b57d397200637cc13f2338004052d2fee47baa5f0e902464e \
+    --hash=sha256:a69f28bfc245608781205e912faae437c2b2165773afa4e7b979d77447a69dd2
+tomlkit==0.15.2 \
+    --hash=sha256:05562412163a3037b94497385fb7f9204c637bc605af7a48199e41cf2272f437 \
+    --hash=sha256:83e32755ba1d20d9340bd069ee97e9f6232ba2346b63ffcba425de01f7e327a6
+trove-classifiers==2026.9.21.13 \
+    --hash=sha256:0a9ebc8d4e2f3e8a22848c5258033035bec17a3012ac3fea16dbaa764489eb71 \
+    --hash=sha256:8b1ff4f9c191b1040b71c37f1e445ab99732911e3cd91de52838453a854d7a17
+vcs-versioning==2.6.0 \
+    --hash=sha256:22e9159288e2d8bca2fa6f6c31c34c9c66aec157f60e9e526f5d160d2516d60f \
+    --hash=sha256:f8bebd1302ebc12e67ceb30fc7dd698ec969414b6fa43b30c3f14ac9b1e72c41

renovate.json

@@ -12,6 +12,12 @@
   },
   "osvVulnerabilityAlerts": true,
   "packageRules": [
+    {
+      "matchFileNames": [
+        "build-requirements.txt"
+      ],
+      "groupName": "build requirements"
+    },
     {
       "matchPackageNames": [
         "python"