Compile requirements.lock on the lowest supported Python, and verify it once

The Windows job could never install from this lockfile and the Linux/macOS
jobs could never verify it, for the same underlying reason: pip-compile
resolves version-conditional dependencies for the interpreter it runs on and
emits no markers, so 3.10 and 3.11 produce genuinely different files — 135
lines apart, argon2-cffi-bindings among them.

Which direction matters. A 3.10 resolution is a superset: it carries
async-timeout, which aiohttp requires below 3.11, and installs cleanly under
--require-hashes on 3.11. A 3.11 resolution is missing it, so on 3.10 pip
tries to fetch async-timeout unpinned and --require-hashes refuses — which is
exactly how the Windows job died. So the lockfile is now compiled on 3.10,
the minimum in pyproject's `python = ">=3.10,<3.13"`, and verified to install
on both 3.10 and 3.11.

Verification moves out of the build matrix into its own job pinned to that
same interpreter. Regenerate-and-diff answers "did this file really come from
src/requirements.txt", which is one question about one artifact and wants
asking once, on the interpreter that produced it — not once per matrix entry
on whichever Python that entry happens to use. Every platform still installs
with --require-hashes, which is the part that had to stay everywhere.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

.github/workflows/python-ci.yml

@@ -9,6 +9,39 @@ on:
     - cron: '0 3 * * *'
 
 jobs:
+  # Regenerating the lockfile and diffing it proves the committed file really
+  # came from src/requirements.txt. It has to happen on ONE interpreter, and
+  # specifically on LOCK_PYTHON below, so it cannot ride the build matrix.
+  #
+  # pip-compile resolves version-conditional dependencies for the interpreter
+  # it runs on, and the result carries no markers. Python 3.10 needs
+  # async-timeout (aiohttp requires it below 3.11) and 3.11 does not, so the
+  # two resolutions are genuinely different files -- 135 lines apart,
+  # argon2-cffi-bindings among them. One committed lockfile cannot equal both.
+  #
+  # Compiling on the LOWEST supported version is what makes a single lockfile
+  # work everywhere: 3.10's resolution is a superset, and it installs cleanly
+  # under --require-hashes on 3.11. The reverse does not -- a 3.11 lockfile
+  # is missing async-timeout, so on 3.10 pip tries to fetch it unpinned and
+  # --require-hashes refuses. Both halves of that were failing here: the diff
+  # could never match on one platform, and the install could never succeed on
+  # the other.
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          # Must equal the minimum in pyproject's `python = ">=3.10,<3.13"`.
+          # Raising that floor means regenerating requirements.lock here.
+          python-version: "3.10"
+      - name: Verify the lockfile matches src/requirements.txt
+        run: |
+          python -m pip install --upgrade pip
+          pip install pip-tools
+          pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt
+          git diff --exit-code requirements.lock
+
   secret-scan:
     name: Secret Scan
     runs-on: ubuntu-latest
@@ -76,22 +109,6 @@ jobs:
           key: ${{ runner.os }}-pip-${{ hashFiles('requirements.lock') }}
           restore-keys: |
             ${{ runner.os }}-pip-
-      # Regenerating the lockfile and diffing it proves the committed file
-      # really came from src/requirements.txt. It can only be done on ONE
-      # interpreter: pip-compile resolves version-conditional dependencies
-      # per Python version, so 3.10 and 3.11 produce genuinely different
-      # files (argon2-cffi-bindings among others), and a single committed
-      # lockfile cannot equal both. Run as written across this matrix the
-      # check was unsatisfiable -- whichever version the lockfile was built
-      # on, the other job failed. Linux/3.11 is the canonical generator, so
-      # the verification lives there.
-      - name: Verify the lockfile matches src/requirements.txt
-        if: runner.os == 'Linux'
-        run: |
-          python -m pip install --upgrade pip
-          pip install pip-tools
-          pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt
-          git diff --exit-code requirements.lock
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

requirements.lock

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.11
+# This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
 #    pip-compile --generate-hashes --output-file=requirements.lock src/requirements.txt
@@ -181,6 +181,10 @@ argon2-cffi-bindings==25.1.0 \
     --hash=sha256:da0c79c23a63723aa5d782250fbf51b768abca630285262fb5144ba5ae01e520 \
     --hash=sha256:e2fd3bfbff3c5d74fef31a722f729bf93500910db650c925c2d6ef879a7e51cb
     # via argon2-cffi
+async-timeout==5.0.1 \
+    --hash=sha256:39e3809566ff85354557ec2398b55e096c8364bacac9405a7a1fa429e77fe76c \
+    --hash=sha256:d9321a7a3d5a6a5e187e824d2fa0793ce379a202935782d555d6e9d2735677d3
+    # via aiohttp
 attrs==26.1.0 \
     --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \
     --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32
@@ -1010,6 +1014,13 @@ ed25519-blake2b-fork==1.4.2 \
     --hash=sha256:f3cc0523703bd1e5ccb4ca332d75b1011e74ad5b4c89c0cc7098a2d8a9588979 \
     --hash=sha256:fc13ddb5968e3b16fd6ed4fd6433b005a6e8c435bdc7f9214f1032f51a62ca17
     # via bip-utils
+exceptiongroup==1.3.1 \
+    --hash=sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219 \
+    --hash=sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598
+    # via
+    #   anyio
+    #   hypothesis
+    #   pytest
 execnet==2.1.2 \
     --hash=sha256:63d83bfdd9a23e35b9c6a3261412324f964c2ec8dcd8d3c6916ee9373e0befcd \
     --hash=sha256:67fba928dd5a544b783f6056f449e5e3931a5c378b128bc18501f7ea79e296ec
@@ -2464,6 +2475,10 @@ toga-dummy==0.5.6 \
     --hash=sha256:5f34d8620bfcc6569aa9f3abbfebe9b5fc3d5d6b410e63fd91290ef88b5bac76 \
     --hash=sha256:7d6f43c5cca7300767850ba57d9e808ead58763012ffeb753ba5d05beefe2ef9
     # via -r src/requirements.txt
+toml==0.10.2 \
+    --hash=sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b \
+    --hash=sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f
+    # via mutmut
 tomli==2.4.1 \
     --hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \
     --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \
@@ -2512,7 +2527,10 @@ tomli==2.4.1 \
     --hash=sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf \
     --hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \
     --hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049
-    # via -r src/requirements.txt
+    # via
+    #   -r src/requirements.txt
+    #   coverage
+    #   pytest
 travertino==0.5.6 \
     --hash=sha256:9eafb6f7db785f7fde8a10054418288e67299094fe3dd4cb09ed9c7a96572791 \
     --hash=sha256:ebe7d196398bd48bea9a2acc8c095f5ecff1f1dc081d33b8040810ef9f93b0d9
@@ -2529,14 +2547,19 @@ typing-extensions==4.16.0 \
     #   aiosignal
     #   anyio
     #   bip-utils
+    #   cryptography
+    #   exceptiongroup
     #   fastapi
     #   limits
+    #   multidict
     #   pydantic
     #   pydantic-core
+    #   pyjwt
     #   pytoniq-core-fork
     #   starlette
     #   textual
     #   typing-inspection
+    #   uvicorn
 typing-inspection==0.4.4 \
     --hash=sha256:547274fa6b0a561ccf549cc9524b999a578e737d015d8709d021f9d0d13bea47 \
     --hash=sha256:65b8397ba37ccbce054456aaccddfc91e6e3083c92824df348d96ca832f3f147