🔒 Lock down PEP 517 / PEP 660 build deps

Tox v4.14.1 regression ref: tox-dev/tox#3238

requirements/.gitignore

@@ -0,0 +1 @@
+!*.txt

requirements/dist-build-constraints.txt

@@ -0,0 +1,16 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    tox r -e pip-compile-build-lock --
+#
+packaging==24.1
+    # via setuptools-scm
+setuptools-scm==8.1.0
+    # via awx-plugins-core (pyproject.toml::build-system.requires)
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==73.0.0
+    # via
+    #   awx-plugins-core (pyproject.toml::build-system.requires)
+    #   setuptools-scm

requirements/tox-pip-compile.in

@@ -1 +1 @@
-pip-tools >= 6.14.0  # first to support config file
+pip-tools >= 7.4.0  # first to support build env dep extraction

tox.ini

@@ -76,6 +76,18 @@ set_env =
 wheel_build_env = .pkg
 
 
+[pkgenv]
+# NOTE: `[testenv:.pkg]` does not work due to a regression in tox v4.14.1
+# NOTE: so `[pkgenv]` is being used in place of it.
+# Refs:
+# * https://github.com/tox-dev/tox/pull/3237
+# * https://github.com/tox-dev/tox/issues/3238
+# * https://github.com/tox-dev/tox/issues/3292
+# * https://hynek.me/articles/turbo-charge-tox/
+set_env =
+  PIP_CONSTRAINT = requirements{/}dist-build-constraints.txt
+
+
 [testenv:cleanup-dists]
 description =
   Wipe the the dist{/} folder
@@ -96,19 +108,22 @@ package = skip
 
 
 [testenv:build-dists]
+allowlist_externals =
+  env
 description =
   Build dists with {basepython} and put them into the dist{/} folder
 depends =
   cleanup-dists
 deps =
   build ~= 1.2.1
 commands =
-  {envpython} \
-    {[python-cli-options]byte-errors} \
-    {[python-cli-options]max-isolation} \
-    {[python-cli-options]warnings-to-errors} \
-    -m build \
-      {posargs:}
+  env PIP_CONSTRAINT=requirements{/}dist-build-constraints.txt \
+    {envpython} \
+      {[python-cli-options]byte-errors} \
+      {[python-cli-options]max-isolation} \
+      {[python-cli-options]warnings-to-errors} \
+      -m build \
+        {posargs:}
 commands_post =
 package = skip
 
@@ -491,3 +506,47 @@ commands_post =
 package = skip
 set_env =
   CUSTOM_COMPILE_COMMAND = tox r -e {envname} -- {posargs:}
+
+
+[testenv:pip-compile-build-lock]
+description = Produce a PEP 517/660 build deps lock using {envpython}
+deps = {[testenv:pip-compile]deps}
+commands =
+  {envpython} \
+    {[python-cli-options]byte-warnings} \
+    {[python-cli-options]max-isolation} \
+    {[python-cli-options]warnings-to-errors} \
+    '-Wdefault{:}pkg_resources is deprecated as an API{:}DeprecationWarning' \
+    '-Wdefault{:}Unimplemented abstract methods{:}DeprecationWarning' \
+    -m piptools \
+      compile \
+      --only-build-deps \
+      --all-build-deps \
+      --output-file=requirements{/}dist-build-constraints.txt \
+      {posargs:}
+commands_post =
+  # NOTE: Invocations without posargs result in trailing spaces in the
+  # NOTE: `pip-tools` generated file headers. This snippet cleans them up.
+  {envpython} \
+    {[python-cli-options]byte-errors} \
+    {[python-cli-options]max-isolation} \
+    {[python-cli-options]warnings-to-errors} \
+    -c \
+      'import os, pathlib, re; \
+      project_root_path = pathlib.Path(r"{toxinidir}"); \
+      requirements_dir = project_root_path / "requirements"; \
+      [\
+        lock_file.write_text(\
+          re.sub(\
+            r"\s*?(?P<CRLF>(?:\r\n|\r|\n))+?", \
+            r"\g<CRLF>", \
+            lock_file.read_text(encoding="utf-8"), \
+            flags=re.MULTILINE,\
+          ), \
+          encoding="utf-8",\
+        ) \
+        for lock_file in requirements_dir.glob("*.txt")\
+      ]'
+set_env =
+  CUSTOM_COMPILE_COMMAND = tox r -e {envname} -- {posargs:}
+package = {[testenv:pip-compile]package}