chore: use require-hashes option (#1078)

* chore: use require-hashes option

.kokoro/release/publish_javadoc.sh

@@ -28,7 +28,7 @@ fi
 pushd $(dirname "$0")/../../
 
 # install docuploader package
-python3 -m pip install gcp-docuploader
+python3 -m pip install --require-hashes -r .kokoro/requirements.txt
 
 # compile all packages
 mvn clean install -B -q -DskipTests=true

.kokoro/release/publish_javadoc11.sh

@@ -28,7 +28,7 @@ fi
 pushd $(dirname "$0")/../../
 
 # install docuploader package
-python3 -m pip install gcp-docuploader
+python3 -m pip install --require-hashes -r .kokoro/requirements.txt
 
 # compile all packages
 mvn clean install -B -q -DskipTests=true

.kokoro/release/stage.sh

@@ -16,7 +16,8 @@
 set -eo pipefail
 
 # Start the releasetool reporter
-python3 -m pip install gcp-releasetool
+requirementsFile=$(realpath $(dirname "${BASH_SOURCE[0]}")/../requirements.txt)
+python3 -m pip install --require-hashes -r $requirementsFile
 python3 -m releasetool publish-reporter-script > /tmp/publisher-script; source /tmp/publisher-script
 
 source $(dirname "$0")/common.sh

.kokoro/requirements.in

@@ -0,0 +1,33 @@
+gcp-docuploader==0.6.3
+google-crc32c==1.3.0
+googleapis-common-protos==1.56.3
+gcp-releasetool==1.8.7
+cachetools==4.2.4
+cffi==1.15.1
+jeepney==0.7.1
+jinja2==3.0.3
+markupsafe==2.0.1
+keyring==23.4.1
+packaging==21.3
+protobuf==3.19.5
+pyjwt==2.4.0
+pyparsing==3.0.9
+pycparser==2.21
+pyperclip==1.8.2
+python-dateutil==2.8.2
+requests==2.27.1
+certifi==2022.9.24
+importlib-metadata==4.8.3
+zipp==3.6.0
+google_api_core==2.8.2
+google-cloud-storage==2.0.0
+google-resumable-media==2.3.3
+google-cloud-core==2.3.1
+typing-extensions==4.1.1
+urllib3==1.26.12
+zipp==3.6.0
+rsa==4.9
+six==1.16.0
+attrs==22.1.0
+google-auth==2.11.0
+idna==3.4