fix(ci): use requirements file for pip hash verification in release smoke test and clusterfuzz build.sh script

.clusterfuzzlite/build.sh

@@ -10,6 +10,7 @@ set -euo pipefail
 cd /src/pkg-defender
 
 # Install the project and atheris
-pip install "uv==0.5.1" --hash=sha256:4d1ec4a1bc19b523a84fc1bf2a92e9c4d982c831d3da450af71fc3057999d456 --require-hashes
+printf '%s\n' 'uv==0.5.1 --hash=sha256:4d1ec4a1bc19b523a84fc1bf2a92e9c4d982c831d3da450af71fc3057999d456' > /tmp/uv-requirements.txt
+pip install -r /tmp/uv-requirements.txt --require-hashes
 uv pip install --system --no-deps .
 uv pip install --system "atheris==2.3.0"

.github/workflows/release.yml

@@ -542,7 +542,8 @@ jobs:
           VERSION="${{ needs.validate.outputs.version }}"
           echo "Smoke testing pkg-defender==${VERSION}"
           python -m venv /tmp/smoke-venv
-          /tmp/smoke-venv/bin/pip install "uv==0.5.1" --hash=sha256:4d1ec4a1bc19b523a84fc1bf2a92e9c4d982c831d3da450af71fc3057999d456 --require-hashes
+          printf '%s\n' 'uv==0.5.1 --hash=sha256:4d1ec4a1bc19b523a84fc1bf2a92e9c4d982c831d3da450af71fc3057999d456' > /tmp/uv-requirements.txt
+          /tmp/smoke-venv/bin/pip install -r /tmp/uv-requirements.txt --require-hashes
 
           echo "Waiting for pkg-defender==${VERSION} to appear on PyPI..."
           timeout 120 bash -c '

CHANGELOG.md

@@ -8,6 +8,18 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [1.0.7] - 2026-07-23
+
+### Fixed
+
+- `pip install` with `--hash=<sha>` CLI flag rejected by pip ≥26.1.2 — root
+  cause: `--hash` is a per-requirement option valid only inside pip requirements
+  files, not as a CLI flag. Moved `--hash` into a temp requirements file
+  (`printf '%s\n' 'uv==0.5.1 --hash=...' > /tmp/uv-requirements.txt && pip
+  install -r /tmp/uv-requirements.txt --require-hashes`) in
+  `.clusterfuzzlite/build.sh` and `.github/workflows/release.yml`, preserving
+  SHA256 pinning and OpenSSF Scorecard Pinned-Dependencies compliance.
+
 ## [1.0.6] - 2026-07-21
 
 ### Added

docs/man/pkgd.1

@@ -1,6 +1,6 @@
 .\" Automatically generated by Pandoc 3.10
 .\"
-.TH "PKGD" "1" "July 20, 2026" "pkg\-defender 1.0.6" "User Commands"
+.TH "PKGD" "1" "July 23, 2026" "pkg\-defender 1.0.7" "User Commands"
 .SH NAME
 pkgd \(em supply chain attack defense CLI
 .SH SYNOPSIS

docs/man/pkgd.1.md

@@ -1,7 +1,7 @@
 ---
 title: PKGD(1)
-date: "July 20, 2026"
-footer: "pkg-defender 1.0.6"
+date: "July 23, 2026"
+footer: "pkg-defender 1.0.7"
 header: "User Commands"
 ---
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pkg-defender"
-version = "1.0.6"
+version = "1.0.7"
 description = "Stop supply chain attacks before they reach your machine or CI pipeline"
 requires-python = ">=3.11"
 license = "Apache-2.0"

src/pkg_defender/__init__.py

@@ -25,4 +25,4 @@
 
             __version__ = _v
         except ImportError:
-            __version__ = "1.0.6"  # Tier 4: hardcoded fallback
+            __version__ = "1.0.7"  # Tier 4: hardcoded fallback