From 09627c2b495ae918d850f459756cb92e986725f1 Mon Sep 17 00:00:00 2001
From: lvbaiqing <lvbaiqing@lvbaiqingdeMacBook-Air.local>
Date: Wed, 28 Oct 2026 20:44:54 +0800
Subject: [PATCH] fix(ci): use portable Python test lock

---
 .github/workflows/check.yml    | 19 ++++++++++++++++++-
 README.md                      |  5 ++++-
 scripts/requirements-test.lock | 11 ++++++-----
 3 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 7cff447..6270063 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -26,7 +26,8 @@ jobs:
       - run: cargo fmt --check
       - run: cargo clippy --all-targets --locked -- -D warnings
       - run: cargo test --locked
-      - run: python -m pip install -r scripts/requirements-test.lock
+      - run: python -m pip install --requirement scripts/requirements-test.lock
+      - run: python -m pip check
       - run: python scripts/check_contract.py
       - run: python scripts/interop_vectors.py
       - if: runner.os != 'Windows'
@@ -42,6 +43,22 @@ jobs:
         run: |
           cargo install cargo-audit --locked --version 0.22.2
           cargo audit --deny warnings
+  python-lock:
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.9', '3.14']
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: python -m pip install --requirement scripts/requirements-test.lock
+      - run: python -m pip check
+      - run: python scripts/interop_vectors.py
+      - run: python scripts/check_contract.py
+      - run: python -m unittest discover -s tests -p 'test_*.py'
   msrv:
     runs-on: ubuntu-latest
     steps:
diff --git a/README.md b/README.md
index 46b0777..d4a78b9 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,8 @@ cargo clippy --all-targets --locked -- -D warnings
 cargo test --locked
 cargo build --release --locked
 python3 -m venv .venv
-.venv/bin/python -m pip install -r scripts/requirements-test.lock
+.venv/bin/python -m pip install --requirement scripts/requirements-test.lock
+.venv/bin/python -m pip check
 .venv/bin/python scripts/interop_vectors.py
 .venv/bin/python scripts/check_contract.py
 .venv/bin/python -m unittest discover -s tests -p 'test_*.py'
@@ -50,6 +51,8 @@ cargo audit --deny warnings
 
 生产没有开发身份后门，运行必须提供与现有 OpenLess 登录一致的 GitHub OAuth 配置。合成身份仅存在于测试中；真实进程测试只向临时数据库注入一次测试会话。默认 restricted 模式，先用指定账号逐项测试。
 
+The test dependency lock is validated on Python 3.9 and 3.14 in CI. Keep the lock file intact when reproducing the staging checks; use `python -m pip check` after installation before running the contract scripts.
+
 ## 开源与许可
 
 Copyright (C) 2026 OpenLess contributors.
diff --git a/scripts/requirements-test.lock b/scripts/requirements-test.lock
index e68ce7b..4d9b612 100644
--- a/scripts/requirements-test.lock
+++ b/scripts/requirements-test.lock
@@ -1,11 +1,12 @@
 argon2-cffi==25.1.0
-argon2-cffi-bindings==26.1.0
+argon2-cffi-bindings==21.2.0
 attrs==26.1.0
-cffi==2.1.1
+cffi==2.0.0
 jsonschema==4.25.1
 jsonschema-specifications==2025.9.1
-pycparser==3.0
+pycparser==2.23
 PyNaCl==1.6.0
 PyYAML==6.0.3
-referencing==0.37.0
-rpds-py==2026.6.3
+referencing==0.36.2
+rpds-py==0.27.1
+typing-extensions==4.16.0