build(deps): bootstrap hash-locked pip 26.2

.github/workflows/fuzz.yml

@@ -33,6 +33,12 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Bootstrap pinned pip
+        run: python -m pip install --require-hashes -r requirements-pip-bootstrap.txt
+
+      - name: Verify pip bootstrap
+        run: python -c 'from importlib.metadata import version; assert version("pip") == "26.2"'
+
       - name: Install fuzz dependencies
         # Hash-pinned per OpenSSF Scorecard Pinned-Dependencies. Sources:
         # fuzz/requirements-property.in (recompile with uv pip compile --generate-hashes).
@@ -59,6 +65,12 @@ jobs:
         with:
           python-version: "3.11"
 
+      - name: Bootstrap pinned pip
+        run: python -m pip install --require-hashes -r requirements-pip-bootstrap.txt
+
+      - name: Verify pip bootstrap
+        run: python -c 'from importlib.metadata import version; assert version("pip") == "26.2"'
+
       - name: Install Atheris
         # Hash-pinned per OpenSSF Scorecard Pinned-Dependencies. Sources:
         # fuzz/requirements-atheris.in (recompile with uv pip compile --generate-hashes).

.github/workflows/security.yml

@@ -62,6 +62,12 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Bootstrap pinned pip
+        run: python -m pip install --require-hashes -r requirements-pip-bootstrap.txt
+
+      - name: Verify pip bootstrap
+        run: python -c 'from importlib.metadata import version; assert version("pip") == "26.2"'
+
       - name: Install audit and SBOM tools
         run: python -m pip install --require-hashes -r requirements-security-ci.txt
 

fuzz/requirements-atheris.in

@@ -3,7 +3,7 @@
 # while the central OpenCode coverage-evidence image runs a newer CPython
 # (3.13+) where only 3.1.0 is published. Pin per interpreter with environment
 # markers so a single hash lock satisfies both --require-hashes installs.
+# pip itself is hash-pinned separately in ../requirements-pip-bootstrap.txt.
 # Compile: uv pip compile fuzz/requirements-atheris.in --generate-hashes --python-version 3.11 --universal -o fuzz/requirements-atheris.txt
-pip
 atheris==3.0.0; python_version < "3.13"
 atheris==3.1.0; python_version >= "3.13"

fuzz/requirements-atheris.txt

@@ -11,7 +11,3 @@ atheris==3.1.0 ; python_full_version >= '3.13' \
     --hash=sha256:ec5e11f21a4c197fe91f7aea2b2de88e623c73a21fc07b105ac6329a1588457b \
     --hash=sha256:f8a9f51ce8369026e8eb7b7174835e8c4c85a1a6db5d9add36c15100779d2a39
     # via -r fuzz/requirements-atheris.in
-pip==26.1.2 \
-    --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab \
-    --hash=sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605
-    # via -r fuzz/requirements-atheris.in

requirements-pip-bootstrap.in

@@ -0,0 +1,3 @@
+# Repository-wide installer bootstrap. Compile with:
+# uv pip compile --generate-hashes requirements-pip-bootstrap.in -o requirements-pip-bootstrap.txt
+pip==26.2

requirements-pip-bootstrap.txt

@@ -0,0 +1,6 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile --generate-hashes requirements-pip-bootstrap.in -o requirements-pip-bootstrap.txt
+pip==26.2 \
+    --hash=sha256:2d8542afcc84cdd8e846c2b36b2861fad1da376dd98f8e7113e9108a3c331690 \
+    --hash=sha256:931c303696af6fa3417112103b1cad26890e5a07eccb5b99783700e33f2b8aad
+    # via -r requirements-pip-bootstrap.in

requirements-security-ci.in

@@ -1,2 +1,4 @@
+# Security tool dependencies. pip itself is bootstrapped first from the
+# repository-wide hash lock in requirements-pip-bootstrap.txt.
 pip-audit==2.10.1
 cyclonedx-bom==7.3.0

tests/test_repository_security_metadata.py

@@ -42,6 +42,8 @@ def test_security_workflow_covers_core_repository_security_process():
         "github/codeql-action/analyze@v4",
         "python_supply_chain:",
         "actions/setup-python@v6",
+        "python -m pip install --require-hashes -r requirements-pip-bootstrap.txt",
+        "from importlib.metadata import version; assert version(\"pip\") == \"26.2\"",
         "python -m pip install --require-hashes -r requirements-security-ci.txt",
         "python -m pip install --require-hashes -r requirements.lock",
         "python -m pip install --no-deps -e .",
@@ -125,6 +127,17 @@ def test_python_lockfile_uses_hash_pinning():
     assert "sqlalchemy==" in lock_text
 
 
+def test_pip_bootstrap_lockfile_uses_hash_pinning():
+    lock_text = read_text("requirements-pip-bootstrap.txt")
+    input_text = read_text("requirements-pip-bootstrap.in")
+
+    assert "uv pip compile" in lock_text
+    assert "pip==26.2" in input_text
+    assert "pip==26.2" in lock_text
+    assert "--hash=sha256:2d8542afcc84cdd8e846c2b36b2861fad1da376dd98f8e7113e9108a3c331690" in lock_text
+    assert "--hash=sha256:931c303696af6fa3417112103b1cad26890e5a07eccb5b99783700e33f2b8aad" in lock_text
+
+
 def test_security_tool_lockfile_uses_hash_pinning():
     lock_text = read_text("requirements-security-ci.txt")
 
@@ -142,5 +155,6 @@ def test_security_tool_lockfile_uses_hash_pinning():
     test_security_policy_documents_reporting_and_automation()
     test_database_design_avoids_plaintext_prompt_output_storage()
     test_python_lockfile_uses_hash_pinning()
+    test_pip_bootstrap_lockfile_uses_hash_pinning()
     test_security_tool_lockfile_uses_hash_pinning()
     print("ok")