[charris]

Pip needs to be a secure version on account of the eMudhra compromise. This PR does that by creating a script to safely install the safe version, and then running the script where needed. Two files are affected:

• tools/wheels/bootstrap-pip.sh # install secure pip
• github/workflows/wheels.yml # runs the script where needed

Only the sdist build needs fixing, the other pip calls occur in the cibuildwheel environment which is set up to use a safe pip by cibuildwheels >= 4.3.3.

Pair programmed with Grok.

[rgommers]

Thanks @charris. This works, and given that it's 2.5.x-only I think it's fine to merge this, because long-term maintainability isn't much of a concern.

The cleaner fix is probably to stop using the image's python/pip though, and directly install a known-good interpreter:

- name: Setup Python
  uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
  with:
    python-version: "3.14.9"

But either way, let's get this in - if you're happy with this fix, so am I.

[charris]

@rgommers There is no safe version of Python 3.12, which we still support in NumPy 3.5 and 3.6. The method here should be good at least until all the runners are safe. My thought is less about numpy-release, where either is a good solution, and more about numpy itself.