use pdm-build-locked (#3001)

* use pdm-build-locked

* add fragment & test

* use backend approach

* update release test

* use GH actions syntax

* undo build changes

* delete test workflow

.github/workflows/release.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Test Build
         run: |
-          python -m pip install dist/*.whl
+          python -m pip install "pdm[locked] @ file://$(ls ${GITHUB_WORKSPACE}/dist/*.whl)"
           pdm --help
 
       - name: Publish package distributions to PyPI

news/3001.feature.md

@@ -0,0 +1,17 @@
+PDM is now published with optional pinned dependencies using the pdm plugin [pdm-build-locked](https://pdm-build-locked.readthedocs.io/).
+
+To install pdm with its dependencies pinned to the versions it was tested with, run:
+
+```bash
+
+    pipx install pdm[locked]
+```
+
+To install optional dependency group copier:
+
+```bash
+
+    pipx install pdm[locked,copier-locked]
+```
+
+This feature is entirely optional. Installing pdm without the extra will work the same way as before this change.

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["pdm-backend"]
+requires = ["pdm-backend", "pdm-build-locked"]
 build-backend = "pdm.backend"
 
 [project]
@@ -85,6 +85,7 @@ includes = ["src/pdm"]
 source-includes = ["tests", "typings", "CHANGELOG.md", "LICENSE", "README.md", "tox.ini"]
 # editables backend doesn't work well with namespace packages
 editable-backend = "path"
+locked = true
 
 [tool.pdm.scripts]
 pre_release = "python tasks/max_versions.py"