Files
Classic298 1c58242b4f feat: build the Docker image from locked, hash-verified dependencies (#33981)
The image used to install only the directly pinned packages and resolved everything below them fresh from PyPI on every build, so the same commit could produce different images. The standard and slim images now install from lock files that pin every package with hashes, except PyTorch and its few own dependencies, which still come from the PyTorch index so the CPU and CUDA variants keep working. A new CI check fails when a requirements file changes without regenerating its lock, and the script that regenerates them sits next to the requirements.

Fixes #33979
2026-11-09 21:42:59 +09:00

9 lines
457 B
Bash
Executable File

#!/usr/bin/env bash
# Regenerates the Dockerfile lock files; torch is overridden out because the Dockerfile installs it from the PyTorch index.
set -euo pipefail
cd "$(dirname "$0")"
flags=(--universal --python-version 3.12 --generate-hashes --no-header --quiet)
uv pip compile requirements-slim.txt "${flags[@]}" -o requirements-slim.lock
uv pip compile requirements.txt "${flags[@]}" --override <(echo "torch; python_version < '0'") -o requirements.lock