fix(github action): add lockfiles script for py requirements

.github/workflows/develop-build.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 

.github/workflows/main-docs.yml

@@ -24,22 +24,22 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.x'
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements-docs.txt
+          pip install --require-hashes --no-deps -r requirements-docs.lock
 
       - name: Build HTML
         run: |
           cd docs
           make html
 
       - name: Setup Pages
-        uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # v4
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload artifact
         uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
@@ -57,4 +57,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.gitignore

@@ -8,3 +8,4 @@ scratch/**
 !scratch/README.md
 .DS_Store
 **/.DS_Store
+.claude/settings.local.json

VERSION

@@ -1 +1 @@
-v0.12.1
+v0.12.2

docs/source/contributor_dev_docs.rst

@@ -54,11 +54,50 @@ Sphinx has been configured to generate the following formats:
 Dependencies
 ~~~~~~~~~~~~
 
-To install the dependencies, ensure that the following command dev step up is executed and if not run the following command in the root directory of the repository:
+The documentation build dependencies are pinned in ``requirements-docs.lock``,
+a hashed lockfile generated from ``requirements-docs.txt``. Installing from the
+lockfile (rather than the unpinned ``requirements-docs.txt``) guarantees a
+reproducible build and lets ``pip`` verify each package against its expected
+hash.
+
+To install the documentation dependencies, run the following command from the
+root directory of the repository:
+
+.. code-block:: bash
+
+   pip install --require-hashes --no-deps -r requirements-docs.lock
+
+.. note::
+
+   ``--require-hashes`` makes ``pip`` verify the SHA-256 hash of every
+   downloaded wheel/sdist against the hash recorded in the lockfile.
+   ``--no-deps`` is safe (and recommended) here because the lockfile already
+   contains the complete, fully-resolved transitive dependency set.
+
+If you have already installed the full dev dependencies via
+``requirements-dev.lock`` (see :doc:`contributor_dev_env`), you do **not** need
+to install the documentation dependencies separately —
+``requirements-dev.lock`` already includes everything in
+``requirements-docs.lock``.
+
+Updating dependencies / regenerating the lockfile
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If you add, remove, or bump a documentation dependency, edit
+``requirements-docs.txt`` (the unhashed source-of-truth file) and then
+regenerate the lockfile by running the helper script from the root of the
+repository:
 
 .. code-block:: bash
 
-   pip install -r requirements-dev.txt
+   ./scripts/generate_lockfiles.sh
+
+This script regenerates ``requirements.lock``, ``requirements-dev.lock``, and
+``requirements-docs.lock`` from their corresponding ``.txt`` files using
+``pip-compile`` (from the ``pip-tools`` package, which you can install with
+``pip install pip-tools``). Commit the regenerated ``.lock`` files alongside
+your change to ``requirements-docs.txt`` in the same pull request so that CI
+and other contributors stay in sync.
 
 Building the Documentation
 ~~~~~~~~~~~~~~~~~~~~~~~~~~

docs/source/contributor_dev_env.rst

@@ -9,11 +9,33 @@ Setting up for development as a contributor to the Lakeflow Framework
 Once you have cloned the Lakeflow Framework repository, you'll need to follow the steps below to set up the framework.
 
 1. **Install requirements**
-
-   Install the required dev dependencies from the root directory by running the following command (you may also want to use a virtual environment, venv for this by running ``python -m venv .venv/`` before running the command below to install dev requirements. See more `Python Virtual Environments <https://docs.python.org/3/tutorial/venv.html>`_): 
-   ```bash
-   pip install -r requirements-dev.txt
-   ```
+
+   The dev dependencies are pinned and hash-verified in
+   ``requirements-dev.lock`` (generated from ``requirements-dev.txt``).
+   Installing from the lockfile guarantees a reproducible environment that
+   matches what CI uses.
+
+   Install them from the root directory by running the following command (you
+   may also want to use a virtual environment for this by running
+   ``python -m venv .venv/`` first. See `Python Virtual Environments
+   <https://docs.python.org/3/tutorial/venv.html>`_ for more details):
+
+   .. code-block:: bash
+
+      pip install --require-hashes --no-deps -r requirements-dev.lock
+
+   ``requirements-dev.lock`` includes everything in ``requirements-docs.lock``
+   too, so you do not need a separate install step for building the
+   documentation.
+
+   If you change a dependency in any of the ``requirements*.txt`` files,
+   regenerate all three lockfiles with the helper script from the repo root:
+
+   .. code-block:: bash
+
+      ./scripts/generate_lockfiles.sh
+
+   See :doc:`contributor_dev_docs` for more details on the lockfiles.
 2. **Set up VS Code extentions**
 
    Once you open the Lakeflow Framework workspace in VS Code for the first time, VS Code will prompt you to install the recommended extensions.