[CI] [GHA] Create dependency trees and freeze Python dependencies in GHA workflows

.github/actions/coverage_toolkit/requirements-ci.txt

@@ -1,4 +1,8 @@
 coverage==7.13.5
+iniconfig==2.3.0
+packaging==26.3
+pluggy==1.6.0
+Pygments==2.20.0
 pytest==9.0.3
 pytest-cov==7.1.0
 PyYAML==6.0.3

.github/actions/create_manifest/requirements.txt

@@ -1,2 +1,5 @@
-GitPython~=3.1.43
-pyyaml~=6.0.1
+gitdb==4.0.12
+GitPython==3.1.59
+packaging==26.3
+PyYAML==6.0.3
+smmap==5.0.3

.github/actions/handle_docker/requirements.txt

@@ -1,3 +1,4 @@
-ghapi==1.0.9
 # pin fastcore CVS-179495
-fastcore==1.12.1
+fastcore==1.12.1
+ghapi==1.0.9
+packaging==26.3

.github/actions/openvino_provider/requirements.txt

@@ -1 +1,6 @@
-requests~=2.33
+certifi==2026.7.22
+charset-normalizer==3.4.9
+idna==3.18
+packaging==26.3
+requests==2.34.2
+urllib3==2.7.0

.github/actions/smart-ci/requirements.txt

@@ -1,4 +1,10 @@
-ghapi==1.0.4
+attrs==26.1.0
 fastcore==1.12.1
-pyyaml==6.0.1
+ghapi==1.0.4
 jsonschema==4.19.1
+jsonschema-specifications==2025.9.1
+packaging==26.3
+PyYAML==6.0.1
+referencing==0.37.0
+rpds-py==2026.6.3
+typing_extensions==4.16.0

.github/actions/store_artifacts/requirements.txt

@@ -1,2 +1,5 @@
-GitPython~=3.1.43
-pyyaml~=6.0.1
+gitdb==4.0.12
+GitPython==3.1.59
+packaging==26.3
+PyYAML==6.0.3
+smmap==5.0.3

.github/dependency_review.yml

@@ -26,3 +26,6 @@ allow-dependencies-licenses:
   - 'pkg:pypi/pytz@2026.3.post1' # MIT license, but dependency review flags it as MIT AND ZPL-2.1: https://github.com/stub42/pytz/blob/release_2026.3.post1/LICENSE.txt
 
   - 'pkg:npm/@sinclair/typebox@0.34.49' # It has only an MIT license, but the dependency check actions reports it as MIT AND Zlib, see https://github.com/sinclairzx81/sinclair-typebox?tab=License-1-ov-file
+  - 'pkg:pypi/gitdb@4.0.12' # BSD License per PyPI/GitHub, but flagged as BSD-2-Clause AND BSD-3-Clause AND GPL-1.0-or-later: https://github.com/gitpython-developers/gitdb
+  - 'pkg:pypi/cffi@2.1.1' # MIT license, but SPDX detection reports the more permissive MIT-0: https://github.com/python-cffi/cffi
+  - 'pkg:pypi/wrapt@2.3.0' # BSD-2-Clause per PyPI, but flagged as BSD-2-Clause AND BSD-3-Clause AND Python-2.0 AND Ruby: https://github.com/GrahamDumpleton/wrapt

.github/dockerfiles/docker_tag

@@ -1 +1 @@
-pr-37010
+pr-37363

.github/dockerfiles/ov_build/ubuntu_22_04_riscv/Dockerfile

@@ -43,34 +43,43 @@ RUN apt-get update && \
     # install compilers to build OpenVINO for RISC-V 64
     apt-get install gcc-riscv64-linux-gnu g++-riscv64-linux-gnu binutils-riscv64-linux-gnu && \
     apt-get install \
-        curl \
-        git \
-        cmake \
-        ccache \
-        ninja-build \
-        fdupes \
-        patchelf \
-        ca-certificates \
-        gpg-agent \
-        tzdata \
-        # parallel gzip
-        pigz \
-        # Python \
-        python3-dev \
-        python3-pip \
-        python3-venv \
-        python3-distutils \
-        # Compilers
-        gcc \
-        g++ \
-        # For clang-tidy validation
-        clang-format-18 \
-        clang-tidy-18 \
-        libomp-18-dev \
-        libncursesw6:riscv64 \
-        libtinfo6:riscv64 && \
+    curl \
+    git \
+    cmake \
+    ccache \
+    ninja-build \
+    fdupes \
+    patchelf \
+    ca-certificates \
+    gpg-agent \
+    tzdata \
+    # parallel gzip
+    pigz \
+    # Python \
+    python3-dev \
+    python3-pip \
+    python3-venv \
+    python3-distutils \
+    # Compilers
+    gcc \
+    g++ \
+    # For clang-tidy validation
+    clang-format-18 \
+    clang-tidy-18 \
+    libomp-18-dev && \
+    # Pin ncurses/tinfo to the jammy release-pocket version for both arches. The
+    # amd64 and riscv64 (ports) mirrors update these multiarch "same" packages on
+    # different schedules, so an updated version is often available for only one
+    # arch, causing a "Breaks" version conflict. The release-pocket version is the
+    # one version guaranteed to exist on both mirrors permanently.
+    NCURSES_VERSION=$(apt-cache madison libtinfo6 | awk -F'|' '$3 ~ / jammy\/main / {gsub(/ /, "", $2); print $2; exit}') && \
+    apt-get install --allow-downgrades \
+    libncursesw6=${NCURSES_VERSION} \
+    libtinfo6=${NCURSES_VERSION} \
+    libncursesw6:riscv64=${NCURSES_VERSION} \
+    libtinfo6:riscv64=${NCURSES_VERSION} && \
     apt-get install \
-        libpython3-dev:riscv64 && \
+    libpython3-dev:riscv64 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 

.github/scripts/dependabot_cleanup/requirements.txt

@@ -1 +1,13 @@
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.4.9
+cryptography==50.0.0
+idna==3.18
+packaging==26.3
+pycparser==3.0
 PyGithub==2.8.1
+PyJWT==2.13.0
+PyNaCl==1.6.2
+requests==2.34.2
+typing_extensions==4.16.0
+urllib3==2.7.0

.github/scripts/external_pr_labeller/requirements.txt

@@ -0,0 +1,15 @@
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.4.9
+cryptography==50.0.0
+Deprecated==1.3.1
+idna==3.18
+packaging==26.3
+pycparser==3.0
+PyGithub==2.2.0
+PyJWT==2.13.0
+PyNaCl==1.6.2
+requests==2.34.2
+typing_extensions==4.16.0
+urllib3==2.7.0
+wrapt==2.3.0

.github/scripts/workflow_rerun/requirements.txt

@@ -1,3 +1,14 @@
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.4.9
+cryptography==50.0.0
+idna==3.18
+packaging==26.3
+psycopg2-binary==2.9.12
+pycparser==3.0
 PyGithub==2.8.1
+PyJWT==2.13.0
+PyNaCl==1.6.2
 requests==2.34.2
-psycopg2-binary==2.9.12
+typing_extensions==4.16.0
+urllib3==2.7.0

.github/workflows/job_build_windows.yml

@@ -137,7 +137,7 @@ jobs:
           # python3 -m pip install -r ${{ env.OPENVINO_REPO }}/src/frontends/paddle/tests/requirements.txt
 
           # For getting rid of SSL issues during model downloading for unit tests
-          python3 -m pip install certifi
+          python3 -m pip install certifi==2026.7.22 packaging==26.3
 
       #
       # Build

.github/workflows/job_jax_models_tests.yml

@@ -103,7 +103,7 @@ jobs:
 
       - name: Install prerequisites and JAX tests requirements for precommit
         run: |
-          python3 -m pip install pytest-xdist[psutil]
+          python3 -m pip install execnet==2.1.2 iniconfig==2.3.0 packaging==26.3 pluggy==1.6.0 psutil==7.2.2 Pygments==2.20.0 pytest==9.1.1 pytest-xdist==3.8.0
           python3 -m pip install -r ${{ env.INSTALL_TEST_DIR }}/requirements_jax
 
       - name: JAX/Flax Models Tests from Hugging Face

.github/workflows/job_python_api_tests.yml

@@ -114,7 +114,7 @@ jobs:
         if: ${{ fromJSON(inputs.affected-components).Python_API.test && inputs.python-version != '3.14t' }} # Explanation for `3.14t` is in the 178162 ticket
         run: |
           python3 -m pip uninstall -y numpy
-          python3 -m pip install "numpy~=1.26.0"
+          python3 -m pip install numpy==1.26.4 packaging==26.3
           python3 -m pip install -r ${INSTALL_TEST_DIR}/bindings/python/requirements_test.txt
           # for 'template' extension
           export LD_LIBRARY_PATH=${INSTALL_TEST_DIR}/:$LD_LIBRARY_PATH

.github/workflows/job_python_unit_tests.yml

@@ -88,7 +88,7 @@ jobs:
       - name: Install Python API tests dependencies
         run: |
           # To enable pytest parallel features
-          python3 -m pip install pytest-xdist[psutil]
+          python3 -m pip install execnet==2.1.2 iniconfig==2.3.0 packaging==26.3 pluggy==1.6.0 psutil==7.2.2 Pygments==2.20.0 pytest==9.1.1 pytest-xdist==3.8.0
           python3 -m pip install -r ${INSTALL_TEST_DIR}/bindings/python/requirements_test.txt
 
       - name: Install Python Layer tests dependencies and for OVC unit tests

.github/workflows/job_samples_tests.yml

@@ -133,7 +133,7 @@ jobs:
           # Install Python benchmark_app by installing openvino-*.whl
           python3 -m pip install --ignore-installed PyYAML -r $INSTALL_TEST_DIR/smoke_tests/requirements.txt
           # Install pytest-timeout to abort hanging samples and dump tracebacks
-          python3 -m pip install pytest-timeout==2.4.0
+          python3 -m pip install iniconfig==2.3.0 packaging==26.3 pluggy==1.6.0 Pygments==2.20.0 pytest==9.1.1 pytest-timeout==2.4.0
           export LD_LIBRARY_PATH=${IE_APP_PATH}:$LD_LIBRARY_PATH
 
           source ${INSTALL_DIR}/setupvars.sh

.github/workflows/labeler.yml

@@ -32,7 +32,8 @@ jobs:
           sparse-checkout: '.github'
 
       - name: Install deps
-        run: pip3 install PyGithub==2.2.0
+        working-directory: ${{ github.workspace }}/.github/scripts/external_pr_labeller
+        run: pip3 install -r requirements.txt
 
       - name: Dump GitHub context
         env:
@@ -43,5 +44,5 @@ jobs:
         env:
           GITHUB_TOKEN: "${{ secrets.EXTERNAL_LABELLER_TOKEN }}"
         run: |
-          python3 ${{ github.workspace }}/.github/scripts/external_pr_labeller.py \
+          python3 ${{ github.workspace }}/.github/scripts/external_pr_labeller/external_pr_labeller.py \
           --repository-name ${GITHUB_REPOSITORY} --pr-number ${{ github.event.number }}

.github/workflows/linux_riscv_conan.yml

@@ -175,7 +175,7 @@ jobs:
           python3 -m venv ${OPENVINO_BUILD_DIR}/env
           source ${OPENVINO_BUILD_DIR}/env/bin/activate
           python3 -m pip install -r ${OPENVINO_REPO}/src/bindings/python/wheel/requirements-dev.txt
-          python3 -m pip install conan
+          python3 -m pip install certifi==2026.7.22 charset-normalizer==3.4.9 colorama==0.4.6 conan==2.31.2 distro==1.9.0 fasteners==0.20 idna==3.18 Jinja2==3.1.6 MarkupSafe==3.0.3 packaging==26.3 patch-ng==1.19.1 python-dateutil==2.9.0.post0 PyYAML==6.0.3 requests==2.34.2 six==1.17.0 urllib3==2.7.0
 
       - name: Create conan_toolchain.cmake file
         run: |

.github/workflows/windows_conditional_compilation.yml

@@ -127,7 +127,7 @@ jobs:
       - name: Install certifi
         run: |
           # For getting rid of SSL issues during model downloading for unit tests
-          python3 -m pip install certifi
+          python3 -m pip install certifi==2026.7.22 packaging==26.3
 
       #
       # Build