ci: OSSF scorecard hardening (DPLAN-0243) — hash-pin all standalone workflow pip installs via .github/requirements/ locks (pip/lint/build/e2e/audit, pip-compile --generate-hashes, 11/11 target-env closure verified incl. Windows colorama marker fix) + provenance attestation on publish (attest-build-provenance v4.1.1 SHA-pinned, id-token+attestations perms) + dependabot pip ecosystem for the new locks. Editable -e . installs untouched byte-identical. 5/5 fresh-venv --require-hashes installs green, 5/5 YAML parse, pinned ruff matches repo lint. First SSH-signed commit (repo config wired this session).

2026-07-15 12:21:22 -07:00
parent 25fc02d07a
commit 9048666c65
15 changed files with 578 additions and 8 deletions
@@ -27,9 +27,11 @@ jobs:
      # 26.1.2). Upgrading removes the vulnerable version outright rather than
      # suppressing it — and 26.1.2 also resolves CVE-2026-3219 / CVE-2026-6357,
      # which is why those two stale --ignore-vuln entries are no longer needed.
+      # Both installs are hash-pinned (Scorecard: Pinned-Dependencies); pip.txt
+      # holds the >=26.1.2 floor the comment above requires.
      - run: |
-          python -m pip install --upgrade pip
-          pip install pip-audit
+          python -m pip install --require-hashes -r .github/requirements/pip.txt
+          python -m pip install --require-hashes -r .github/requirements/audit.txt
      - run: pip install -e .
      - name: Pip audit
        run: pip-audit --skip-editable