[dtaivpp]

Installs pip from a hash-pinned bootstrap file (.github/pip-bootstrap.txt, pip 26.2.2) before any other pip command in the jobs that run pip: the OCR runtime smoke job in ci.yml and the wheel build job in publish-pypi.yml.

The bootstrap file uses --require-hashes and --only-binary=:all:, so the pip upgrade itself is verified against the pinned wheel hash. Existing action pins are unchanged.

Verified in a python:3.12-slim container (pip 25.0.1): python -m pip install --no-cache-dir -r .github/pip-bootstrap.txt results in pip 26.2.2.

No image or deployment is affected; the change takes effect on the next workflow run.

---

Summary by cubic

Pins the pip version used in CI to pip 26.2.2 by installing it from a hash-pinned bootstrap file (.github/pip-bootstrap.txt) before any other pip command. The bootstrap uses --require-hashes and --only-binary=:all:, so the upgrade is verified against the pinned wheel hash.

The bootstrap step runs in the OCR runtime smoke job in ci.yml and the wheel build job in publish-pypi.yml. Existing action pins are unchanged, and the change takes effect on the next workflow run without affecting any image or deployment.

^{Written for commit a57ca6e. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 3 files

Confidence score: 4/5

• In .github/workflows/publish-pypi.yml, upgrading pip on the host does not affect the pip used inside maturin-action’s manylinux container, so Linux builds may still use an unintended version. Bootstrap or pin pip inside the container too if consistent versions are required.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/publish-pypi.yml">

<violation number="1" location=".github/workflows/publish-pypi.yml:113">
P2: This upgrades only the host runner's pip; `maturin-action` runs Linux builds in a manylinux container, whose `python3 -m pip` installs remain unpinned. Bootstrap pip inside the action's Linux container as well if all wheel-build tooling must use this pinned version.</violation>
</file>

<sub>Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This upgrades only the host runner's pip; maturin-action runs Linux builds in a manylinux container, whose python3 -m pip installs remain unpinned. Bootstrap pip inside the action's Linux container as well if all wheel-build tooling must use this pinned version.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/publish-pypi.yml, line 113:

<comment>This upgrades only the host runner's pip; `maturin-action` runs Linux builds in a manylinux container, whose `python3 -m pip` installs remain unpinned. Bootstrap pip inside the action's Linux container as well if all wheel-build tooling must use this pinned version.</comment>

<file context>
@@ -109,6 +109,9 @@ jobs:
           python-version: '3.12'
 
+      - name: Bootstrap pip
+        run: python -m pip install --no-cache-dir -r .github/pip-bootstrap.txt
+
       - name: Build wheel
</file context>

[capy-ai]

No rebuild needed after merge: the CI and PyPI publish workflows use the pinned pip on their next run. The red OCR runtime smoke fails in the rustup toolchain install, before any Python step.