Add UV_REQUIRE_HASHES environment variable (#3125)

Closes https://github.com/astral-sh/uv/issues/3117.

README.md

@@ -469,6 +469,8 @@ uv accepts the following command-line arguments as environment variables:
 - `UV_INDEX_STRATEGY`: Equivalent to the `--index-strategy` command-line argument. For example, if
   set to `unsafe-any-match`, uv will consider versions of a given package available across all
   index URLs, rather than limiting its search to the first index URL that contains the package.
+- `UV_REQUIRE_HASHES`: Equivalent to the `--require-hashes` command-line argument. If set to `true`,
+  uv will require that all dependencies have a hash specified in the requirements file.
 
 In each case, the corresponding command-line argument takes precedence over an environment variable.
 

crates/uv/src/cli.rs

@@ -669,7 +669,8 @@ pub(crate) struct PipSyncArgs {
     /// - Editable installs are not supported.
     /// - Local dependencies are not supported, unless they point to a specific wheel (`.whl`) or
     ///   source archive (`.zip`, `.tar.gz`), as opposed to a directory.
-    #[arg(long, overrides_with("no_require_hashes"))]
+    #[arg(long,         env = "UV_REQUIRE_HASHES",
+        value_parser = clap::builder::BoolishValueParser::new(), overrides_with("no_require_hashes"))]
     pub(crate) require_hashes: bool,
 
     #[arg(long, overrides_with("require_hashes"), hide = true)]
@@ -1010,7 +1011,8 @@ pub(crate) struct PipInstallArgs {
     /// - Editable installs are not supported.
     /// - Local dependencies are not supported, unless they point to a specific wheel (`.whl`) or
     ///   source archive (`.zip`, `.tar.gz`), as opposed to a directory.
-    #[arg(long, overrides_with("no_require_hashes"))]
+    #[arg(long,         env = "UV_REQUIRE_HASHES",
+        value_parser = clap::builder::BoolishValueParser::new(), overrides_with("no_require_hashes"))]
     pub(crate) require_hashes: bool,
 
     #[arg(long, overrides_with("require_hashes"), hide = true)]