From 1e73ce56fb731ce155bca8a80a7a67d250978b04 Mon Sep 17 00:00:00 2001 From: randypanding <66171646@users.noreply.github.com> Date: Wed, 19 Aug 2026 05:02:40 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20gate=20=E7=9A=84=20pyyaml=20=E5=8D=87?= =?UTF-8?q?=E7=BA=A7=E4=B8=BA=E7=89=88=E6=9C=AC+sha256=20=E5=8F=8C?= =?UTF-8?q?=E9=94=9A=E5=AE=9A=EF=BC=88ADR-0011=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit scorecard 对 pip 命令要求哈希锚定（pipCommand not pinned by hash）—— 新版 pip 的 --hash 仅支持 requirements 文件形态，故改为 .github/requirements-gate.txt（pyyaml==6.0.3 + cp312 manylinux x86_64 wheel 的 sha256）经 --require-hashes 安装。 --- .github/requirements-gate.txt | 1 + .github/workflows/gate.yml | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .github/requirements-gate.txt diff --git a/.github/requirements-gate.txt b/.github/requirements-gate.txt new file mode 100644 index 0000000..0a4c9b0 --- /dev/null +++ b/.github/requirements-gate.txt @@ -0,0 +1 @@ +pyyaml==6.0.3 --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index 3b04162..e896bbb 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -26,7 +26,11 @@ jobs: python-version: "3.12" - name: YAML 全量解析（governance + standards） run: | - pip install pyyaml==6.0.3 -q # 版本钉死（scorecard PinnedDependencies；ADR-0011 版本钉死遗留项） + # 版本+sha256 双锚定（scorecard PinnedDependencies pipCommand not pinned by hash； + # ADR-0011 版本钉死遗留项）。新版 pip 的 --hash 仅支持 requirements 文件形态， + # 故经 .github/requirements-gate.txt 下发；哈希对应 cp312 manylinux x86_64 wheel + # （本 job 固定 python 3.12 + ubuntu-latest），升级版本须同步换哈希 + pip install -q --require-hashes -r .github/requirements-gate.txt python3 - <<'EOF' import glob, sys, yaml files = glob.glob("governance/**/*.yaml", recursive=True) + glob.glob("standards/**/*.yaml", recursive=True)