fix(ci): replace --require-hashes with pinned versions for pip installs

Author: markuslf

.github/workflows/docs.yml

@@ -29,7 +29,7 @@ jobs:
       - name: 'Install dependencies'
         run: |
           pip install --editable .
-          pip install --require-hashes --requirement /dev/stdin <<< "pdoc==16.0.0 --hash=sha256:070b51de2743b9b1a4e0ab193a06c9e6c12cf4151cf9137656eebb16e8556628"
+          pip install pdoc==16.0.0
 
       - name: 'Build documentation'
         run: 'pdoc --output-directory docs lib'

.github/workflows/pre-commit-autoupdate.yml

@@ -23,7 +23,7 @@ jobs:
           python-version: '3.12'
 
       - name: 'Install pre-commit'
-        run: 'pip install --require-hashes --requirement /dev/stdin <<< "pre-commit==4.5.1 --hash=sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77"'
+        run: 'pip install pre-commit==4.5.1'
 
       - name: 'Run pre-commit autoupdate'
         run: 'pre-commit autoupdate'

.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
           python-version: '3.12'
 
       - name: 'Install build tools'
-        run: 'pip install --require-hashes --requirement /dev/stdin <<< "build==1.4.2 --hash=sha256:7a4d8651ea877cb2a89458b1b198f2e69f536c95e89129dbf5d448045d60db88"'
+        run: 'pip install build==1.4.2'
 
       - name: 'Build package'
         run: 'python -m build'

CHANGELOG.md

@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+* Fix `--require-hashes` pip installs in CI workflows by using pinned versions instead
+
 ### Added
 
 * Add CONTRIBUTING