Pin ruff to a compatible release (~=0.16.0) (#16694)

The Black -> Ruff migration (AAP-85334) installs a bare, unpinned
`ruff` in four places: requirements_dev.txt, both tox.ini linters
envs, and the devel image Dockerfile. CI's api-lint job resolves the
latest release on every run.

Ruff treats minor releases as breaking by policy: that is where the
yearly formatter style guide lands (0.9.0, 0.15.0) and where rules are
promoted or change behavior. Left unpinned, the next minor turns
unrelated PRs and quiet stable branches red with no code change.

Pin to ~=0.16.0 everywhere, and add `required-version` to
[tool.ruff] so a developer's mismatched local ruff (pre-commit.sh uses
whatever is on PATH) is refused instead of silently reformatting.

Patch releases within 0.16.x still flow, so bug fixes arrive without
a bump; the floor moves through a reviewed PR when 0.17 lands.


Claude-Session: https://claude.ai/code/session_011rb7ruHixj48khUNXxxqPG

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

awxkit/tox.ini

@@ -26,7 +26,7 @@ commands =
 [testenv:lint]
 deps =
     {[testenv]deps}
-    ruff
+    ruff~=0.16.0
 commands =
     ruff check awxkit
     - coverage erase

pyproject.toml

@@ -7,6 +7,7 @@ build-backend = "setuptools.build_meta"
 # [tool.setuptools_scm]
 
 [tool.ruff]
+required-version = "~=0.16.0"
 line-length = 160
 extend-exclude = ["awx_collection"]
 

requirements/requirements_dev.txt

@@ -6,7 +6,7 @@ openapi-spec-validator  # OpenAPI 3.0 schema validation
 # pprofile - re-add once https://github.com/vpelletier/pprofile/issues/41 is addressed
 ipython>=7.31.1 # https://github.com/ansible/awx/security/dependabot/30
 unittest2
-ruff
+ruff~=0.16.0
 pytest!=7.0.0
 pytest-asyncio
 pytest-cov

tools/ansible/roles/dockerfile/templates/Dockerfile.j2

@@ -184,7 +184,7 @@ RUN dnf module -y enable nodejs:18 && dnf module -y install nodejs:18/common &&
     unzip
 
 RUN pip3.12 install -vv git+https://github.com/coderanger/supervisor-stdout.git@973ba19967cdaf46d9c1634d1675fc65b9574f6e
-RUN pip3.12 install -vv ruff setuptools-scm build
+RUN pip3.12 install -vv 'ruff~=0.16.0' setuptools-scm build
 
 # This package randomly fails to download.
 # It is nice to have in the dev env, but not necessary.

tox.ini

@@ -3,7 +3,7 @@ isolated_build = True
 
 [testenv:linters]
 deps =
-  ruff
+  ruff~=0.16.0
   yamllint
 allowlist_externals = make
 setenv =