refactor: generate lock files with hashes for midstream and downstream builds

Replace the unpinned requirements.txt with two lock files produced by
`uv pip compile --generate-hashes`: one for midstream (PyPI, with
--torch-backend=cpu) and one for downstream (RHAI index, for Konflux
hermetic builds). This ensures reproducible installs with hash
verification on both build paths.

Key changes:
- build.py generates requirements-lock.txt (midstream) and
  requirements-lock-konflux.txt (downstream) based on build.env config
- Use UV_TORCH_BACKEND=cpu + UV_CONFIG_FILE=/dev/null in Containerfile
  to avoid multi-index hash incompleteness (uv#14000)
- Add build/run.sh wrapper to run build.py inside the base image
  container for consistent Linux-native resolution
- Move pymilvus/milvus-lite constraints to distribution/constraints.txt
- Update CI workflows to use the new lock files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: eoinfennessy

.github/workflows/create-or-update-release-branch.yml

@@ -127,7 +127,8 @@ jobs:
         id: commit
         run: |
           git add build/build.env Containerfile \
-            distribution/requirements.txt distribution/README.md
+            distribution/requirements-lock.txt distribution/requirements-lock-konflux.txt \
+            distribution/README.md
           if git diff --cached --quiet; then
             echo "::notice::No changes to commit — version may already be set to ${TAG}"
           else

.github/workflows/redhat-distro-container.yml

@@ -115,7 +115,7 @@ jobs:
         if: contains(fromJSON('["workflow_dispatch", "schedule"]'), github.event_name)
         env:
           OGX_VERSION: ${{ env.OGX_COMMIT_SHA }}
-        run: uv run --with ruamel.yaml build/build.py
+        run: ./build/run.sh
 
       - name: Build image for testing (${{ matrix.arch }})
         id: build
@@ -381,7 +381,7 @@ jobs:
         if: github.event_name == 'workflow_dispatch'
         env:
           OGX_VERSION: ${{ env.OGX_COMMIT_SHA }}
-        run: uv run --with ruamel.yaml build/build.py
+        run: ./build/run.sh
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

.github/workflows/test-pr-in-showroom.yml

@@ -101,10 +101,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building image: ogx-test:$TAG"
 
-          uv venv
-          source .venv/bin/activate
-          uv pip install 'ruamel.yaml>=0.18.0'
-          python3 build/build.py
+          ./build/run.sh
           podman build -f Containerfile -t "ogx-test:$TAG" .
 
       - name: Setup CI environment

.github/workflows/test-upstream-in-showroom.yml

@@ -45,10 +45,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building image with OGX_VERSION=main: ogx-test:$TAG"
 
-          uv venv
-          source .venv/bin/activate
-          uv pip install 'ruamel.yaml>=0.18.0'
-          python3 build/build.py
+          ./build/run.sh
           podman build -f Containerfile -t "ogx-test:$TAG" .
 
       - name: Setup CI environment

.pre-commit-config.yaml

@@ -46,14 +46,11 @@ repos:
     hooks:
       - id: pkg-gen
         name: Distribution Build
-        entry: ./build/build.py
-        language: python
+        entry: ./build/run.sh
+        language: script
         pass_filenames: false
         require_serial: true
         always_run: true
-        additional_dependencies:
-          - uv>=0.9.0
-          - ruamel.yaml>=0.18.0
 
       - id: doc-gen
         name: Distribution Documentation

Containerfile

@@ -2,11 +2,11 @@
 # by build/build.py - do not edit manually.
 FROM quay.io/opendatahub/odh-midstream-python-base-3-12:latest
 
-ENV UV_INDEX_STRATEGY=unsafe-best-match
+ENV UV_TORCH_BACKEND=cpu \
+    UV_CONFIG_FILE=/dev/null
 
-COPY distribution/constraints.txt ${APP_ROOT}/constraints.txt
-COPY distribution/requirements.txt ${APP_ROOT}/requirements.txt
-RUN uv pip install --constraint ${APP_ROOT}/constraints.txt -r ${APP_ROOT}/requirements.txt
+COPY distribution/requirements-lock.txt ${APP_ROOT}/requirements-lock.txt
+RUN uv pip install -r ${APP_ROOT}/requirements-lock.txt
 
 COPY --chmod=755 distribution/install-common.sh ${APP_ROOT}/install-common.sh
 ENV DOCLING_ARTIFACTS_PATH="${APP_ROOT}/.cache/docling/models"

Containerfile.in

@@ -1,10 +1,10 @@
 FROM quay.io/opendatahub/odh-midstream-python-base-3-12:latest
 
-ENV UV_INDEX_STRATEGY=unsafe-best-match
+ENV UV_TORCH_BACKEND=cpu \
+    UV_CONFIG_FILE=/dev/null
 
-COPY distribution/constraints.txt ${APP_ROOT}/constraints.txt
-COPY distribution/requirements.txt ${APP_ROOT}/requirements.txt
-RUN uv pip install --constraint ${APP_ROOT}/constraints.txt -r ${APP_ROOT}/requirements.txt
+COPY distribution/requirements-lock.txt ${APP_ROOT}/requirements-lock.txt
+RUN uv pip install -r ${APP_ROOT}/requirements-lock.txt
 
 COPY --chmod=755 distribution/install-common.sh ${APP_ROOT}/install-common.sh
 ENV DOCLING_ARTIFACTS_PATH="${APP_ROOT}/.cache/docling/models"

build/build.env

@@ -1,2 +1,3 @@
 OGX_VERSION=v1.1.3+rhaiv.0
 OGX_INSTALL_FROM_SOURCE=true
+RHAI_INDEX_URL=https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.5/cpu-ubi9/simple/