Adopt pip-compile for Python dependency management

[jonasbn]

Summary

• Follow-up to Bump bracex from 2.5.post1 to 3.0.1 to fix glob source matching #379 (kept separate per request). Where Bump bracex from 2.5.post1 to 3.0.1 to fix glob source matching #379 is the immediate patch for Strange problem with source matching with 0.63.0 #378, this PR is the structural fix so this class of bug (a hand-edited transitive pin silently falling out of sync with what its own dependency tree needs) can't recur.
• Adds requirements.in as the source of truth for genuinely direct dependencies (pyspelling, pymdown-extensions — the latter is used directly via pymdownx.superfences in this repo's own spellcheck.yaml and examples/markdown.yml).
• requirements.txt is now generated from requirements.in via pip-compile (pip-tools) instead of hand-maintained. It's still a fully pinned file installed as-is by the Dockerfile — no Dockerfile changes needed.
• This run is a minimal-diff regeneration: only bracex/wcmatch move (to the same compatible pair as Bump bracex from 2.5.post1 to 3.0.1 to fix glob source matching #379 — bracex==3.0.1, wcmatch==11.0); every other package stays at its currently pinned version. A full --upgrade resolve was available but intentionally not used here to avoid bundling unrelated version bumps (beautifulsoup4, lxml, Markdown, PyYAML, six, soupsieve all have newer releases available) into a tooling-adoption PR — those stay as their own deliberate, individually-reviewed PRs as before.
• backrefs and zipp are dropped. Neither shows up anywhere in the resolved dependency graph for pyspelling + pymdown-extensions on Python 3.14 (verified via each package's own declared metadata) — they were stale manual pins (the zipp comment even said "not directly required, pinned by Snyk to avoid a vulnerability"), not active dependencies, so removing them is not a security regression.
• .github/dependabot.yml's pip entry already sets versioning-strategy: lockfile-only, which is specifically designed for a requirements.in (manifest) + generated requirements.txt (lockfile) pair. No change needed there — this PR just makes that existing setting apply the way it was presumably intended, so Dependabot should now be able to bump transitive pins like bracex on its own going forward.
• Documents the new workflow in CLAUDE.md (Development Commands + Key Files + Dependabot Gotchas).

Does removing zipp reintroduce a vulnerability?

No. zipp>=3.19.1 was originally pinned in PR #204 (changelog 0.39.0) to patch CVE-2024-5569, because at the time pyspelling pulled in importlib-metadata, which depends on zipp.

That chain no longer exists:

• pyspelling==2.12.1's own declared metadata (Requires-Dist) lists only beautifulsoup4, html5lib, lxml, markdown, pyyaml, soupsieve, wcmatch — no importlib-metadata, conditional or otherwise.
• The full pip3 list inside the rebuilt image (13 packages total) has neither importlib-metadata nor zipp.

So zipp isn't installed in the image at all, pinned or not — a package that's absent can't be exploited through this image. The old pin was a vestigial defensive measure for a dependency edge that pyspelling has since dropped (likely once its minimum Python requirement rose past the point of needing the importlib-metadata backport). Same reasoning applies to backrefs, which was never a declared dependency of pymdown-extensions at the pinned version.

Verification

• Built the image locally with the regenerated requirements.txt (docker build -t jonasbn/github-action-spellcheck:pipcompile .) and confirmed installed versions match (bracex==3.0.1, wcmatch==11.0, no backrefs/zipp).
• Reran the Strange problem with source matching with 0.63.0 #378/Bump bracex from 2.5.post1 to 3.0.1 to fix glob source matching #379 repro (arkq/bluez-alsa's .github/spellcheck.yaml, pattern **/*.{c,h}|!build/**) against this image — passes.
• Ran the non-interactive smoke test against this repo's own spellcheck.yaml — passes.
• pre-commit run on the changed files — passes.

Test plan

• Regenerate requirements.txt via pip-compile with a minimal diff
• Confirm backrefs/zipp are genuinely unused (checked each package's declared metadata)
• Rebuild locally and rerun the Strange problem with source matching with 0.63.0 #378 repro against the reporter's real config
• Smoke test against this repo's own spellcheck.yaml
• pre-commit hooks pass
• CLAUDE.md documents the new pip-compile workflow

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR formalizes Python dependency management for the Docker image by introducing a pip-tools (pip-compile) workflow: requirements.in becomes the direct-dependency manifest, and requirements.txt is treated as the generated, fully pinned lockfile to prevent transitive pin drift (the root cause class behind #378/#379).

Changes:

• Add requirements.in to explicitly declare direct dependencies (pyspelling, pymdown-extensions).
• Regenerate requirements.txt via pip-compile (minimal diff) to pin a compatible bracex==3.0.1 / wcmatch==11.0 pair and remove stale pins (backrefs, zipp).
• Document the new dependency update workflow and Dependabot expectations in CLAUDE.md.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
requirements.txt	Switch to a pip-compile-generated, fully pinned lockfile (including bracex/wcmatch correction and removal of stale pins).
requirements.in	Introduce a manifest for direct Python dependencies used to generate requirements.txt.
CLAUDE.md	Document the pip-compile workflow and clarify how Dependabot’s lockfile-only strategy aligns with requirements.in/requirements.txt.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jonasbn]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts by merging origin/master into this branch and fixing requirements.txt. Addressed in commit 6f4f174.

[jonasbn]

Looks good