[CI] [GHA] Create dependency trees and freeze Python dependencies in custom actions

.github/actions/coverage_toolkit/requirements-ci.txt

@@ -1,4 +1,8 @@
 coverage==7.13.5
+iniconfig==2.3.0
+packaging==26.3
+pluggy==1.6.0
+Pygments==2.20.0
 pytest==9.0.3
 pytest-cov==7.1.0
 PyYAML==6.0.3

.github/actions/create_manifest/requirements.txt

@@ -1,2 +1,5 @@
-GitPython~=3.1.43
-pyyaml~=6.0.1
+gitdb==4.0.12
+GitPython==3.1.59
+packaging==26.3
+PyYAML==6.0.3
+smmap==5.0.3

.github/actions/handle_docker/requirements.txt

@@ -1,3 +1,4 @@
-ghapi==1.0.9
 # pin fastcore CVS-179495
-fastcore==1.12.1
+fastcore==1.12.1
+ghapi==1.0.9
+packaging==26.3

.github/actions/openvino_provider/requirements.txt

@@ -1 +1,6 @@
-requests~=2.33
+certifi==2026.7.22
+charset-normalizer==3.4.9
+idna==3.18
+packaging==26.3
+requests==2.34.2
+urllib3==2.7.0

.github/actions/smart-ci/requirements.txt

@@ -1,4 +1,10 @@
-ghapi==1.0.4
+attrs==26.1.0
 fastcore==1.12.1
-pyyaml==6.0.1
+ghapi==1.0.4
 jsonschema==4.19.1
+jsonschema-specifications==2025.9.1
+packaging==26.3
+PyYAML==6.0.1
+referencing==0.37.0
+rpds-py==2026.6.3
+typing_extensions==4.16.0

.github/actions/store_artifacts/requirements.txt

@@ -1,2 +1,5 @@
-GitPython~=3.1.43
-pyyaml~=6.0.1
+gitdb==4.0.12
+GitPython==3.1.59
+packaging==26.3
+PyYAML==6.0.3
+smmap==5.0.3

.github/dependency_review.yml

@@ -26,3 +26,6 @@ allow-dependencies-licenses:
   - 'pkg:pypi/pytz@2026.3.post1' # MIT license, but dependency review flags it as MIT AND ZPL-2.1: https://github.com/stub42/pytz/blob/release_2026.3.post1/LICENSE.txt
 
   - 'pkg:npm/@sinclair/typebox@0.34.49' # It has only an MIT license, but the dependency check actions reports it as MIT AND Zlib, see https://github.com/sinclairzx81/sinclair-typebox?tab=License-1-ov-file
+  - 'pkg:pypi/gitdb@4.0.12' # BSD License per PyPI/GitHub, but flagged as BSD-2-Clause AND BSD-3-Clause AND GPL-1.0-or-later: https://github.com/gitpython-developers/gitdb
+  - 'pkg:pypi/cffi@2.1.1' # MIT license, but SPDX detection reports the more permissive MIT-0: https://github.com/python-cffi/cffi
+  - 'pkg:pypi/wrapt@2.3.0' # BSD-2-Clause per PyPI, but flagged as BSD-2-Clause AND BSD-3-Clause AND Python-2.0 AND Ruby: https://github.com/GrahamDumpleton/wrapt

.github/dockerfiles/docker_tag

@@ -1 +1 @@
-pr-37010
+pr-37363

.github/dockerfiles/ov_build/ubuntu_22_04_arm64_cross_compilation/Dockerfile

@@ -142,7 +142,7 @@ ENV PATH="$NVM_DIR/versions/node/v${NODE_VERSION}/bin/:${PATH}"
 
 # Install doxygen
 ENV DOXYGEN_HOME="/opt/doxygen"
-ENV DOXYGEN_VERSION='1.9.6'
+ENV DOXYGEN_VERSION='1.18.0'
 RUN mkdir -p ${DOXYGEN_HOME} && cd ${DOXYGEN_HOME} && wget https://www.doxygen.nl/files/doxygen-$DOXYGEN_VERSION.linux.bin.tar.gz && \
     tar -I pigz -xf doxygen-$DOXYGEN_VERSION.linux.bin.tar.gz && \
     rm -f doxygen-$DOXYGEN_VERSION.linux.bin.tar.gz

.github/dockerfiles/ov_build/ubuntu_22_04_riscv/Dockerfile

@@ -43,34 +43,46 @@ RUN apt-get update && \
     # install compilers to build OpenVINO for RISC-V 64
     apt-get install gcc-riscv64-linux-gnu g++-riscv64-linux-gnu binutils-riscv64-linux-gnu && \
     apt-get install \
-        curl \
-        git \
-        cmake \
-        ccache \
-        ninja-build \
-        fdupes \
-        patchelf \
-        ca-certificates \
-        gpg-agent \
-        tzdata \
-        # parallel gzip
-        pigz \
-        # Python \
-        python3-dev \
-        python3-pip \
-        python3-venv \
-        python3-distutils \
-        # Compilers
-        gcc \
-        g++ \
-        # For clang-tidy validation
-        clang-format-18 \
-        clang-tidy-18 \
-        libomp-18-dev \
-        libncursesw6:riscv64 \
-        libtinfo6:riscv64 && \
+    curl \
+    git \
+    cmake \
+    ccache \
+    ninja-build \
+    fdupes \
+    patchelf \
+    ca-certificates \
+    gpg-agent \
+    tzdata \
+    procps \
+    # parallel gzip
+    pigz \
+    # Python \
+    python3-dev \
+    python3-pip \
+    python3-venv \
+    python3-distutils \
+    # Compilers
+    gcc \
+    g++ \
+    # For clang-tidy validation
+    clang-format-18 \
+    clang-tidy-18 \
+    libomp-18-dev && \
+    # Pin ncurses/tinfo to the jammy release-pocket version for both arches. The
+    # amd64 and riscv64 (ports) mirrors update these multiarch "same" packages on
+    # different schedules, so an updated version is often available for only one
+    # arch, causing a "Breaks" version conflict. The release-pocket version is the
+    # one version guaranteed to exist on both mirrors permanently.
+    NCURSES_VERSION=$(apt-cache madison libtinfo6 | awk -F'|' '$3 ~ / jammy\/main / {gsub(/ /, "", $2); print $2; exit}') && \
+    apt-get install --allow-downgrades \
+    libncurses6=${NCURSES_VERSION} \
+    libncursesw6=${NCURSES_VERSION} \
+    libtinfo6=${NCURSES_VERSION} \
+    libncurses6:riscv64=${NCURSES_VERSION} \
+    libncursesw6:riscv64=${NCURSES_VERSION} \
+    libtinfo6:riscv64=${NCURSES_VERSION} && \
     apt-get install \
-        libpython3-dev:riscv64 && \
+    libpython3-dev:riscv64 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 

.github/dockerfiles/ov_build/ubuntu_22_04_x64/Dockerfile

@@ -114,7 +114,7 @@ ENV PATH="$NVM_DIR/versions/node/v${NODE_VERSION}/bin/:${PATH}"
 
 # Install doxygen
 ENV DOXYGEN_HOME="/opt/doxygen"
-ENV DOXYGEN_VERSION='1.9.6'
+ENV DOXYGEN_VERSION='1.18.0'
 RUN mkdir -p ${DOXYGEN_HOME} && cd ${DOXYGEN_HOME} && wget https://www.doxygen.nl/files/doxygen-$DOXYGEN_VERSION.linux.bin.tar.gz && \
     tar -I pigz -xf doxygen-$DOXYGEN_VERSION.linux.bin.tar.gz && \
     rm -f doxygen-$DOXYGEN_VERSION.linux.bin.tar.gz

.github/dockerfiles/ov_test/ubuntu_22_04_riscv/Dockerfile

@@ -27,6 +27,7 @@ RUN apt-get update && \
         ca-certificates \
         gpg-agent \
         tzdata \
+        procps \
         # parallel gzip
         pigz \
         # Python

.github/scripts/dependabot_cleanup/requirements.txt

@@ -1 +1,13 @@
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.4.9
+cryptography==50.0.0
+idna==3.18
+packaging==26.3
+pycparser==3.0
 PyGithub==2.8.1
+PyJWT==2.13.0
+PyNaCl==1.6.2
+requests==2.34.2
+typing_extensions==4.16.0
+urllib3==2.7.0

.github/scripts/external_pr_labeller/requirements.txt

@@ -0,0 +1,15 @@
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.4.9
+cryptography==50.0.0
+Deprecated==1.3.1
+idna==3.18
+packaging==26.3
+pycparser==3.0
+PyGithub==2.2.0
+PyJWT==2.13.0
+PyNaCl==1.6.2
+requests==2.34.2
+typing_extensions==4.16.0
+urllib3==2.7.0
+wrapt==2.3.0

.github/scripts/workflow_rerun/requirements.txt

@@ -1,3 +1,14 @@
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.4.9
+cryptography==50.0.0
+idna==3.18
+packaging==26.3
+psycopg2-binary==2.9.12
+pycparser==3.0
 PyGithub==2.8.1
+PyJWT==2.13.0
+PyNaCl==1.6.2
 requests==2.34.2
-psycopg2-binary==2.9.12
+typing_extensions==4.16.0
+urllib3==2.7.0

.github/workflows/labeler.yml

@@ -32,7 +32,8 @@ jobs:
           sparse-checkout: '.github'
 
       - name: Install deps
-        run: pip3 install PyGithub==2.2.0
+        working-directory: ${{ github.workspace }}/.github/scripts/external_pr_labeller
+        run: pip3 install -r requirements.txt
 
       - name: Dump GitHub context
         env:
@@ -43,5 +44,5 @@ jobs:
         env:
           GITHUB_TOKEN: "${{ secrets.EXTERNAL_LABELLER_TOKEN }}"
         run: |
-          python3 ${{ github.workspace }}/.github/scripts/external_pr_labeller.py \
+          python3 ${{ github.workspace }}/.github/scripts/external_pr_labeller/external_pr_labeller.py \
           --repository-name ${GITHUB_REPOSITORY} --pr-number ${{ github.event.number }}