chore: pin requirements with hashed lock file

.github/workflows/pr-validation.yml

@@ -4,10 +4,12 @@ on:
   push:
     paths:
       - "**/*.py"
+      - "requirements.in"
       - "requirements.txt"
   pull_request:
     paths:
       - "**/*.py"
+      - "requirements.in"
       - "requirements.txt"
 
 concurrency:
@@ -24,7 +26,16 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: "3.10"
+          python-version: "3.14"
+
+      - name: Verify requirements.txt is in sync with requirements.in
+        run: |
+          pip install pip-tools
+          pip-compile --generate-hashes --output-file=requirements.txt requirements.in
+          if ! git diff --exit-code requirements.txt; then
+            echo "::error::requirements.txt is out of sync with requirements.in. Run: pip-compile --generate-hashes --output-file=requirements.txt requirements.in"
+            exit 1
+          fi
 
       - name: Install dependencies
         run: pip install -r requirements.txt

README.md

@@ -4,7 +4,7 @@ A Python-based test suite for validating Vectara API functionality. Designed for
 
 ## Prerequisites
 
-- Python 3.9 or higher
+- Python 3.14 (matches the lock file resolver; install with `pip install -r requirements.txt` also works on 3.9+ since the lock file contains markers for older versions)
 - Vectara Personal API key
 
 ## Installation
@@ -13,6 +13,16 @@ A Python-based test suite for validating Vectara API functionality. Designed for
 pip install -r requirements.txt
 ```
 
+`requirements.txt` is a pinned, hashed lock file generated from `requirements.in`. To add or bump a dependency:
+
+1. Edit `requirements.in` (loose constraints).
+2. Regenerate the lock:
+   ```bash
+   pip install pip-tools
+   pip-compile --generate-hashes --output-file=requirements.txt requirements.in
+   ```
+3. Commit both files. CI verifies they stay in sync.
+
 ## Running Tests
 
 ### Quick Start

requirements.in

@@ -0,0 +1,28 @@
+# Vectara API Test Suite Dependencies (loose constraints)
+#
+# To regenerate the pinned lock file (requirements.txt):
+#   pip install pip-tools
+#   pip-compile --generate-hashes --output-file=requirements.txt requirements.in
+#
+# The lock file is what gets installed. CI verifies it is in sync with this file.
+
+# HTTP client
+requests>=2.31.0
+
+# Testing framework
+pytest>=7.4.0
+pytest-html>=4.1.0
+pytest-json-report>=1.5.0
+pytest-xdist>=3.5.0
+
+# Configuration management
+pyyaml>=6.0.1
+
+# Rich console output
+rich>=13.7.0
+
+# Date/time handling
+python-dateutil>=2.8.2
+
+# JSON schema validation
+jsonschema>=4.21.0