[CLIENT-4036] CI/CD: Lock pip dependencies

.github/workflows/build-wheels.yml

@@ -311,11 +311,15 @@ jobs:
         CIBW_ENVIRONMENT_LINUX: LD_LIBRARY_PATH=/usr/local/lib64
         CIBW_ENVIRONMENT_PASS_LINUX: ${{ inputs.unoptimized && 'UNOPTIMIZED' || '' }}
         CIBW_BUILD: ${{ env.BUILD_IDENTIFIER }}
-        CIBW_BUILD_FRONTEND: build
+        CIBW_BUILD_FRONTEND: build[uv]
         CIBW_BEFORE_ALL_LINUX: >
           yum install libyaml-devel -y
         # delvewheel is not enabled by default but we do need to repair the wheel
-        CIBW_BEFORE_BUILD_WINDOWS: "pip install delvewheel==1.*"
+        CIBW_BEFORE_BUILD_WINDOWS: >
+          PYTHON_TAG=${{ matrix.python-tag }}
+          PYTHON_VERSION="${PYTHON_TAG/cp/}"
+          PYTHON_VERSION="${PYTHON_VERSION/3/3.}"
+          uv sync -p $PYTHON_VERSION
         # We want to check that our wheel links to the new openssl 3 install, not the system default
         # This assumes that ldd prints out the "soname" for the libraries
         # We can also manually verify the repair worked by checking the repaired wheel's compatibility tag

.github/workflows/create-pylock-file.yml

@@ -0,0 +1,41 @@
+permissions:
+  contents: write
+
+on:
+  workflow_dispatch:
+
+jobs:
+  create-lock-file-for-windows:
+    # Should be same environment used to build wheels on Windows
+    runs-on: windows-2022
+    strategy:
+      matrix:
+        python-version:
+          - '3.10'
+          - '3.11'
+          - '3.12'
+          - '3.13'
+          - '3.14'
+      fail-fast: false
+      max-parallel: 1
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        ref: ${{ github.ref }}
+    - run: pip install delvewheel -c requirements.txt
+      working-directory: .github/workflows
+    - run: |
+        pip lock delvewheel -o pylock-${{ matrix.python-version }}.toml
+        git add pylock-${{ matrix.python-version }}.toml
+      working-directory: .github
+    - name: Commit lock file
+      uses: step-security/git-auto-commit-action@905c3cd6e9ed2b67b4d46ff401fdb6d745d0ff9d # v7.1.0
+      with:
+        commit_message: 'Generate lock file'
+        commit_author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+        branch: ${{ github.ref }}

.github/workflows/requirements.txt

@@ -1,4 +1,4 @@
 parver==0.5
 crudini==0.9.4
-delocate==0.10.4
 mypy==1.17.1
+pytest-cov==4.1.0

requirements.txt

@@ -1 +1,2 @@
 build==1.2.2.post1
+delvewheel==1.11.2

test/requirements.txt

@@ -1,3 +1 @@
 pytest==7.4.0
-# To generate coverage reports in the Github Actions pipeline
-pytest-cov==4.1.0