From 43be292db27f04a12b00163e167f32a0f5816c84 Mon Sep 17 00:00:00 2001
From: Matthias Mair <code@mjmair.com>
Date: Thu, 10 Sep 2026 00:33:08 +0200
Subject: [PATCH] harden install steps (#12819)

* harden install steps

* Update qc_checks.yaml

* remove restriction on a non-prebuild dep

* fix merge diff
---
 .github/workflows/docker.yaml        |  2 +-
 .github/workflows/import_export.yaml |  6 +++---
 .github/workflows/qc_checks.yaml     | 12 ++++++------
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
index a92ad07489..d25d661a3f 100644
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -175,7 +175,7 @@ jobs:
           python-version: ${{ env.python_version }}
       - name: Version Check
         run: |
-          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
           python3 .github/scripts/version_check.py
           echo "git_commit_hash=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
           echo "git_commit_date=$(git show -s --format=%ci)" >> $GITHUB_ENV
diff --git a/.github/workflows/import_export.yaml b/.github/workflows/import_export.yaml
index ae933a0fdf..ca261382bd 100644
--- a/.github/workflows/import_export.yaml
+++ b/.github/workflows/import_export.yaml
@@ -94,7 +94,7 @@ jobs:
           invoke dev.setup-test -i
       - name: Create Plugin Data
         run: |
-          pip install -U inventree-dummy-app-plugin==0.1.0
+          pip install --only-binary :all: -U inventree-dummy-app-plugin==0.1.0
           invoke migrate
           cd src/backend/InvenTree && python manage.py create_dummy_data
       - name: Export Postgres Dataset
@@ -166,7 +166,7 @@ jobs:
           invoke dev.setup-test -i
       - name: Create Plugin Data
         run: |
-          pip install -U inventree-dummy-app-plugin==0.1.0
+          pip install --only-binary :all: -U inventree-dummy-app-plugin==0.1.0
           invoke migrate
           cd src/backend/InvenTree && python manage.py create_dummy_data
       - name: Seed Content-Excludes Test Data
@@ -230,7 +230,7 @@ jobs:
           invoke dev.setup-test -i
       - name: Create Plugin Data
         run: |
-          pip install -U inventree-dummy-app-plugin==0.1.0
+          pip install --only-binary :all: -U inventree-dummy-app-plugin==0.1.0
           invoke migrate
           cd src/backend/InvenTree && python manage.py create_dummy_data
       - name: Export Postgres Dataset (plugin installed)
diff --git a/.github/workflows/qc_checks.yaml b/.github/workflows/qc_checks.yaml
index 64a23d7774..bd8d16fb50 100644
--- a/.github/workflows/qc_checks.yaml
+++ b/.github/workflows/qc_checks.yaml
@@ -114,7 +114,7 @@ jobs:
         uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
       - name: Check Version
         run: |
-          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
           python3 .github/scripts/version_check.py
 
   typecheck:
@@ -155,8 +155,8 @@ jobs:
           python-version: ${{ env.python_version }}
       - name: Check Config
         run: |
-          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
-          pip install --require-hashes -r docs/requirements.txt
+          pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes --only-binary :all: -r docs/requirements.txt
           python docs/ci/check_mkdocs_config.py
       - name: Check Links
         uses: tcort/github-action-markdown-link-check@e047c5b37f24ab722bbef1a27b6fab7f96bc4068 # v1
@@ -204,7 +204,7 @@ jobs:
         env:
           API: ${{ needs.paths-filter.outputs.api }}
         run: |
-          pip install --require-hashes -r contrib/dev_reqs/requirements.txt >/dev/null 2>&1
+          pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt >/dev/null 2>&1
           version="$(python3 .github/scripts/version_check.py --show-api-version --decrement-api=${API} 2>&1)"
           echo "API Version: $version"
           url="https://raw.githubusercontent.com/inventree/schema/main/export/${version}/api.yaml"
@@ -238,7 +238,7 @@ jobs:
         id: version
         if: github.ref == 'refs/heads/master' && needs.paths-filter.outputs.api == 'true'
         run: |
-          pip install --require-hashes -r contrib/dev_reqs/requirements.txt >/dev/null 2>&1
+          pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt >/dev/null 2>&1
           version="$(python3 .github/scripts/version_check.py --show-api-version 2>&1)"
           echo "API Version: $version"
           echo "version=$version" >> "$GITHUB_OUTPUT"
@@ -354,7 +354,7 @@ jobs:
         run: |
           pip uninstall pytest-django -y
           cd ${WRAPPER_NAME}
-          pip install .
+          pip install . --only-binary :all:
         if: needs.paths-filter.outputs.submit-performance == 'true'
       - name: Performance Reporting
         uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1