fix: gate 的 pyyaml 升级为版本+sha256 双锚定（ADR-0011）

[randypanding]

改了什么

• 新增 .github/requirements-gate.txt（pyyaml==6.0.3 + sha256 哈希）
• gate.yml：pip install pyyaml==6.0.3 → pip install --require-hashes -r .github/requirements-gate.txt

为什么

• chore: scorecard 姿态修复——pyyaml 钉版/LICENSE/dependabot/安全策略链接（ADR-0011） #55 落地版本钉死后，scorecard 新告警 feat: agent schema v2 + CODEOWNERS + drift-check §9（ADR-0010 配套） #13「pipCommand not pinned by hash」——版本锚定不够，要求哈希锚定
• 新版 pip 的 --hash 仅支持 requirements 文件形态（CLI 不接受），故经文件下发

怎么验证

• 哈希取自 PyPI 官方 6.0.3 的 cp312 manylinux x86_64 wheel（gate 固定 python 3.12 + ubuntu-latest）
• 本 PR 的 gate 运行即验证安装路径
• 合并后 scorecard 重跑，告警 feat: agent schema v2 + CODEOWNERS + drift-check §9（ADR-0010 配套） #13 消除

风险 / 回滚

• 低：单依赖哈希锁；升级 pyyaml 须同步换哈希（文件内有注释说明）；revert 即可

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 30 minutes

Limit details: You’ve used all 3 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cc2cc4b5-c2e2-44e5-b22c-20ae6ed15fa3

📥 Commits

Reviewing files that changed from the base of the PR and between 3904e9c and 1e73ce5.

📒 Files selected for processing (2)

• .github/requirements-gate.txt
• .github/workflows/gate.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pyyaml@​6.0.3

View full report

[qodo-code-review]

PR Summary by Qodo

Pin gate PyYAML installation by version and SHA-256

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Pins the gate’s PyYAML artifact with an official SHA-256 hash.
• Uses pip’s hash-enforcement mode to satisfy Scorecard dependency checks.
• Preserves the existing Python 3.12 Ubuntu validation environment.

Diagram

graph TD
  A["Gate workflow"] --> B["pip installer"] --> C["PyYAML wheel"] --> E["YAML validation"]
  D["Hash lock"] --> B

Loading

High-Level Assessment

The requirements-file approach is optimal because pip hash enforcement is designed around requirements entries, while the gate has a fixed Python and runner environment. An inline hash is unsupported, and introducing a broader lockfile tool would add unnecessary maintenance for one CI-only dependency.

Files changed (2) +6 / -1

Other (2) +6 / -1

requirements-gate.txtLock PyYAML version and wheel hash +1/-0

Lock PyYAML version and wheel hash

• Adds a pip requirements entry pinning PyYAML 6.0.3 to the approved CPython 3.12 manylinux x86_64 wheel SHA-256 hash.

.github/requirements-gate.txt

gate.ymlEnforce hashed dependency installation in the gate +5/-1

Enforce hashed dependency installation in the gate

• Replaces direct PyYAML installation with '--require-hashes' using the gate requirements file. Documents the Scorecard requirement, runtime assumptions, and upgrade procedure.

.github/workflows/gate.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗