fix: grab correct version of pip build dependencies

.pre-commit-config.yaml

@@ -31,3 +31,9 @@ repos:
       - id: go-imports
       - id: no-go-testing
       - id: golangci-lint
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.2
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format

dependency/actions/compile/constraints.py

@@ -0,0 +1,25 @@
+# Copyright (c) 2013-Present CloudFoundry.org Foundation, Inc. All Rights Reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+import sys
+from subprocess import check_call
+
+import tomllib
+
+file_path = sys.argv[1]
+
+with open(file_path, "rb") as f:
+    data = tomllib.load(f)
+    for entry in data["build-system"]["requires"]:
+        name, constraints = entry.split(" ")
+        check_call(
+            [
+                "pip3",
+                "--cache-dir=/tmp-cache/",
+                "download",
+                "--no-binary",
+                ":all:",
+                f"{name}{constraints}",
+            ]
+        )

dependency/actions/compile/entrypoint

@@ -61,25 +61,23 @@ function main() {
   echo "target=${target}"
   echo "download_dir=${download_dir}"
 
-  pip3 --version
-  # "pip download pip" with older pips have seen failures that say "has inconsistent name: filename has 'pip', but metadata has 'unknown'"
-  pip3 install --upgrade pip
   pip3 --version
   python3 --version
 
   pushd "${download_dir}" > /dev/null
     mkdir -p /tmp/pip-cache/
     pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: pip=="${version}"
-    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: wheel
-    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: setuptools
-    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: flit_core
 
     # Use globbing to detect the pip tarball
     # https://github.com/paketo-buildpacks/pip/issues/334
     tar --extract \
       --strip-components=1 \
       --file pip-*.tar.gz
 
+    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: wheel
+    pip3 --cache-dir=/tmp/pip-cache/ download --no-binary :all: setuptools
+    python3 /constraints.py pyproject.toml
+
     tar --create \
       --gunzip \
       --verbose \

dependency/actions/compile/noarch.Dockerfile

@@ -1,14 +1,14 @@
+FROM ubuntu:noble
 # Copyright (c) 2013-Present CloudFoundry.org Foundation, Inc. All Rights Reserved.
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM ubuntu:jammy
-
-ENV DEBIAN_FRONTEND noninteractive
-ENV LC_CTYPE = 'en_US.UTF'
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LC_CTYPE='en_US.UTF'
 
 RUN apt-get update && apt install python3-pip -y
 
 COPY entrypoint /entrypoint
+COPY constraints.py /constraints.py
 
 ENTRYPOINT ["/entrypoint"]

dependency/retrieval/go.mod

@@ -5,6 +5,8 @@ go 1.26.5
 // This is required because of a breaking change in a newer version
 replace github.com/ekzhu/minhash-lsh => github.com/ekzhu/minhash-lsh v0.0.0-20171225071031-5c06ee8586a1
 
+replace github.com/go-enry/go-license-detector/v4 => github.com/go-enry/go-license-detector/v4 v4.3.0
+
 require (
 	github.com/Masterminds/semver/v3 v3.5.0
 	github.com/google/go-github/v81 v81.0.0
@@ -25,7 +27,7 @@ require (
 	github.com/ekzhu/minhash-lsh v0.0.0-20190924033628-faac2c6342f8 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
-	github.com/go-enry/go-license-detector/v4 v4.3.1 // indirect
+	github.com/go-enry/go-license-detector/v4 v4.3.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.9.1 // indirect
 	github.com/go-git/go-git/v5 v5.19.2 // indirect