[jothimani-rajendran]

What

SEC-4 (org-plan plan/sec-scan-2026-10-16.md). Scorecard Pinned-Dependencies flagged four workflow installs that resolved from PyPI or fetched an unpinned build backend:

• demo-gif.yml (both jobs) and quickstart.yml: pip install .
• ci.yml policies job: pip install --no-deps ./.framework (build isolation fetched an unpinned setuptools)

Each now installs its dependencies and build backend from a hash-pinned file (--require-hashes), builds the wheel with --no-build-isolation, and installs that wheel with --no-deps. Installs stay non-editable.

• requirements/install.in / .txt (new): runtime deps (jsonschema, pyyaml) plus hatchling.
• requirements/chock.in / .txt: adds setuptools>=77, chock's build backend. Only that one package was added; no existing pin moved.

Both files were generated with the repo's existing pip-compile --generate-hashes --allow-unsafe --strip-extras command and header, on Python 3.12.

Scanner results, measured locally before → after

• Scorecard v5.2.1 --local, Pinned-Dependencies: 8 (5 warnings) → 9 (1 warning). All other file checks are unchanged: Token-Permissions 10, Fuzzing 0, License 9.
• The one remaining warning is docs/quickstart.sh:4. That file is generated from the README and runs the end-user pip install context-report. This PR leaves it alone.
• zizmor 1.31.1 --offline: no findings, before and after (4 suppressions unchanged). Online audits were not run: the available token got a 401.
• actionlint 1.7.7: clean.
• CodeQL 2.27.1, python-security-and-quality with .github/codeql/codeql-config.yml: 0 results. The actions-security-and-quality suite, which codeql.yml does not configure, also returned 0 results.

Write permissions (unchanged)
None were added or widened. These remain because each job needs them:

• release.yml: contents: write to attach the dist files and Sigstore bundles to the Release.
• demo-gif.yml render-and-commit: contents: write to push the regenerated GIF to the non-main branch.
• codeql.yml, scorecard.yml, security.yml: security-events: write to upload SARIF.
• pages.yml: Pages deploy.
• stale.yml: labels and closes stale issues and PRs.

Definition of done

• python -m ruff check . and python -m ruff format --check . clean (no Python changed)
• python -m pytest -q green (CI)
• Schema changes: none
• chock check and chock sync --repo . --check clean. I ran them locally with chock v0.9.0 installed the new way.

The new install path was also checked locally on Python 3.12: pip check reported no broken requirements, and docs/quickstart.sh ran end to end (well-formed and bound: True).

Claims

• No row semantics changed.

---

Generated by Claude Code