use lock file in production

.github/workflows/builder.yml

@@ -157,6 +157,8 @@ jobs:
               homeassistant/package_constraints.txt
 
             sed -i "s|home-assistant-frontend==.*||" requirements_all.txt
+            # Drop the released pin from the lock file; the nightly wheel is installed separately
+            sed -i "/^home-assistant-frontend==/,/^[^[:space:]#]/ { /^home-assistant-frontend==/d; /^[[:space:]#]/d }" requirements_all.lock
           fi
 
           if [[ "$(ls home_assistant_intents*.whl)" =~ ^home_assistant_intents-(.*)-py3-none-any.whl$ ]]; then
@@ -175,6 +177,8 @@ jobs:
               homeassistant/package_constraints.txt
 
             sed -i "s|home-assistant-intents==.*||" requirements_all.txt requirements.txt
+            # Drop the released pin from the lock file; the nightly wheel is installed separately
+            sed -i "/^home-assistant-intents==/,/^[^[:space:]#]/ { /^home-assistant-intents==/d; /^[[:space:]#]/d }" requirements_all.lock
           fi
 
       - name: Download translations

Dockerfile

@@ -29,24 +29,19 @@ COPY rootfs /
 COPY --from=ghcr.io/alexxit/go2rtc:1.9.14@sha256:675c318b23c06fd862a61d262240c9a63436b4050d177ffc68a32710d9e05bae /usr/local/bin/go2rtc /bin/go2rtc
 
 ## Setup Home Assistant Core dependencies
-COPY --parents requirements.txt homeassistant/package_constraints.txt homeassistant/
+COPY --parents requirements_all.lock home_assistant_frontend-* home_assistant_intents-* homeassistant/
 RUN \
     # Verify go2rtc can be executed
     go2rtc --version \
-    # Install uv at the version pinned in the requirements file
-    && pip3 install --no-cache-dir "uv==$(awk -F'==' '/^uv==/{print $2}' homeassistant/requirements.txt)" \
-    && uv pip install \
-        --no-build \
-        -r homeassistant/requirements.txt
-
-COPY requirements_all.txt home_assistant_frontend-* home_assistant_intents-* homeassistant/
-RUN \
-    if ls homeassistant/home_assistant_*.whl 1> /dev/null 2>&1; then \
+    # Install uv at the version pinned in the lock file
+    && pip3 install --no-cache-dir "uv==$(awk -F'[= ;]+' '/^uv==/{print $2}' homeassistant/requirements_all.lock)" \
+    && if ls homeassistant/home_assistant_*.whl 1> /dev/null 2>&1; then \
         uv pip install homeassistant/home_assistant_*.whl; \
     fi \
     && uv pip install \
         --no-build \
-        -r homeassistant/requirements_all.txt
+        --require-hashes \
+        -r homeassistant/requirements_all.lock
 
 ## Setup Home Assistant Core
 COPY --parents LICENSE* README* homeassistant/ pyproject.toml homeassistant/