Add lint to ensure .github/ pypi dependencies are pinned (pytorch#64463)

Summary:
Example failing run: https://github.com/pytorch/pytorch/pull/64463/checks?check_run_id=3501249102

Pull Request resolved: pytorch#64463

Reviewed By: janeyx99

Differential Revision: D30744930

Pulled By: driazati

fbshipit-source-id: 4dd97054db1d4c776a4512bc3d664987cd7b6d23

.github/templates/bazel_ci_workflow.yml.j2

@@ -90,7 +90,7 @@ on:
         run: |
           COMMIT_TIME=$(git log --max-count=1 --format=%ct || echo 0)
           export COMMIT_TIME
-          pip3 install requests
+          pip3 install requests==2.26
           python3 -m tools.stats.upload_binary_size_to_scuba || exit 0
       - name: Test PyTorch
         run: |

.github/templates/linux_ci_workflow.yml.j2

@@ -170,7 +170,7 @@ jobs:
         run: |
           COMMIT_TIME=$(git log --max-count=1 --format=%ct || echo 0)
           export COMMIT_TIME
-          pip3 install requests
+          pip3 install requests==2.26
           python3 -m tools.stats.upload_binary_size_to_scuba || exit 0
       - name: Chown workspace
         run: |
@@ -232,7 +232,7 @@ jobs:
       image: python:3.9
     steps:
       - name: Install dependencies
-        run: pip install typing-extensions
+        run: pip install typing-extensions==3.10
       - name: Clone pytorch/pytorch
         uses: zhouzhuojie/checkout@05b13c9a0d21f08f6d5e64a1d5042246d13619d9
       - name: Generating test matrix
@@ -338,7 +338,7 @@ jobs:
       {%- if is_coverage %}
       - name: Report coverage
         run: |
-          python3 -mpip install codecov
+          python3 -mpip install codecov==2.1.12
           python3 -mcodecov
       {%- endif %}
       - name: Zip test reports for upload

.github/templates/windows_ci_workflow.yml.j2

@@ -170,7 +170,7 @@ jobs:
       image: python:3.9
     steps:
       - name: Install dependencies
-        run: pip install typing-extensions
+        run: pip install typing-extensions==3.10
       - name: Clone pytorch/pytorch
         uses: zhouzhuojie/checkout@05b13c9a0d21f08f6d5e64a1d5042246d13619d9
       - name: Generating test matrix

.github/workflows/build_linux_conda.yml

@@ -107,7 +107,7 @@ jobs:
         run: |
           COMMIT_TIME=$(git log --max-count=1 --format=%ct || echo 0)
           export COMMIT_TIME
-          pip3 install requests
+          pip3 install requests==2.26
           python3 -m tools.stats.upload_binary_size_to_scuba || exit 0
 
 concurrency:

.github/workflows/build_linux_libtorch.yml

@@ -106,7 +106,7 @@ jobs:
         run: |
           COMMIT_TIME=$(git log --max-count=1 --format=%ct || echo 0)
           export COMMIT_TIME
-          pip3 install requests
+          pip3 install requests==2.26
           python3 -m tools.stats.upload_binary_size_to_scuba || exit 0
 
 concurrency:

.github/workflows/build_linux_wheels.yml

@@ -105,7 +105,7 @@ jobs:
         run: |
           COMMIT_TIME=$(git log --max-count=1 --format=%ct || echo 0)
           export COMMIT_TIME
-          pip3 install requests
+          pip3 install requests==2.26
           python3 -m tools.stats.upload_binary_size_to_scuba || exit 0
 
 concurrency:

.github/workflows/lint.yml

@@ -64,6 +64,18 @@ jobs:
         run: |
           # shellcheck disable=SC2016
           (! git --no-pager grep -InP '# type:\s*ignore(?!\[)' -- '**.py' '**.pyi' ':(exclude)test/test_jit.py' || (echo 'The above lines have unqualified `type: ignore`; please convert them to `type: ignore[xxxx]`'; false))
+      - name: Ensure GitHub PyPi dependencies are pinned
+        if: always()
+        run: |
+          (! git --no-pager grep --color=always -InP \
+                '(pip|pip3|python -m pip|python3 -m pip|python3 -mpip|python -mpip) install ([a-z][\.a-z-0-9]*+(?!(=|.*\.whl))([[:blank:]]|))+' \
+                -- .github \
+                ':(exclude)**.rst' \
+                ':(exclude)**.py' \
+                ':(exclude)**.md' \
+                ':(exclude)**.diff' \
+                ':(exclude)third_party' ||
+            (echo "The above lines have unpinned PyPi installs; please pin them to a specific version: e.g. 'thepackage==1.2'"; false))
       # note that this next step depends on a clean checkout;
       # if you run it locally then it will likely to complain
       # about all the generated files in torch/test
@@ -287,7 +299,7 @@ jobs:
       - name: Install dependencies
         run: |
           set -eux
-          pip3 install typing-extensions --user # for tools/linter/translate_annotations.py
+          pip3 install typing-extensions==3.10 --user # for tools/linter/translate_annotations.py
           pip3 install -r requirements-flake8.txt --user
           flake8 --version
       - name: Run flake8
@@ -416,7 +428,7 @@ jobs:
       - name: Install dependencies
         run: |
           set -eux
-          pip3 install cmakelint --user
+          pip3 install cmakelint==1.4.1 --user
           cmakelint --version
       - name: Run cmakelint
         run: |
@@ -442,7 +454,7 @@ jobs:
           pip3 install numpy==1.20 --user # https://github.com/pytorch/pytorch/pull/60472
           pip3 install expecttest==0.1.3 mypy==0.812 --user
           # Needed to check tools/render_junit.py
-          pip3 install junitparser rich --user
+          pip3 install junitparser==2.1.1 rich==10.9.0 --user
       - name: Run autogen
         run: |
           set -eux

Makefile

@@ -85,6 +85,7 @@ quick_checks:
 		--step 'Ensure canonical include' \
 		--step 'Ensure no versionless Python shebangs' \
 		--step 'Ensure no unqualified noqa' \
+		--step 'Ensure GitHub PyPi dependencies are pinned' \
 		--step 'Ensure no unqualified type ignore' \
 		--step 'Ensure no direct cub include' \
 		--step 'Ensure correct trailing newlines' \