ci: hash-pin pip deps + pin wasmtime (Scorecard Pinned-Dependencies) - #58
Merged
Merged
Conversation
Clears the hashable Pinned-Dependencies findings: - wasmtime: replace 'curl | bash' of the unpinned install script with a pinned release download (v45.0.0) + sha256 verification (the one genuine finding). - pip test/tool deps: hash-pin pytest/numpy/maturin (ordvec-python/requirements-dev.txt via 'uv pip compile --universal --generate-hashes --python-version 3.9') and zizmor (.github/zizmor-requirements.txt), installed with 'pip install --require-hashes -r' in python.yml, release-python.yml, and zizmor.yml. The remaining 'pip install dist/*.whl|*.tar.gz' lines install freshly-built local artifacts (no stable hash) and are dismissed in code scanning by design. Verified: zizmor --offline clean, actionlint clean (incl. shellcheck on the wasmtime step), YAML valid. Requirements files are Dependabot-maintained.
Nelson Spence (Fieldnote-Echo)
requested a review
from Navi Bot (project-navi-bot)
as a code owner
May 25, 2026 19:42
Review Summary by QodoPin pip and wasmtime dependencies for supply chain security
WalkthroughsDescription• Replace unpinned wasmtime install script with pinned v45.0.0 release + SHA256 verification • Hash-pin pytest, numpy, maturin dependencies via requirements-dev.txt file • Hash-pin zizmor workflow audit tool via dedicated requirements file • Update CI workflows to use pip install --require-hashes for dependency verification Diagramflowchart LR
A["Unpinned Dependencies"] -->|"Replace curl bash"| B["Pinned wasmtime v45.0.0"]
A -->|"Hash-pin via uv"| C["requirements-dev.txt"]
A -->|"Hash-pin via uv"| D["zizmor-requirements.txt"]
B -->|"SHA256 verification"| E["Supply Chain Security"]
C -->|"pip --require-hashes"| E
D -->|"pip --require-hashes"| E
File Changes1. .github/workflows/ci.yml
|
Code Review by Qodo
1.
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds two new requirements files containing hash-pinned dependencies to satisfy OpenSSF Scorecard Pinned-Dependencies checks. Specifically, it introduces .github/zizmor-requirements.txt for the zizmor workflow-audit CI job and ordvec-python/requirements-dev.txt for the ordvec-python development and testing environment. There are no review comments, and I have no feedback to provide.
project-navi-bot
previously approved these changes
May 25, 2026
The wasmtime download hardcoded the x86_64-linux tarball, so the wasm job would fail if its runner were ever switched to ARM Ubuntu. Derive the arch from `uname -m` and select the matching tarball + pinned sha256 (x86_64 and aarch64), erroring out on anything else. Preserves the curl|bash -> pinned download hardening.
project-navi-bot
approved these changes
May 25, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the hashable OpenSSF Scorecard Pinned-Dependencies alerts (#1–#4, #6).
curl | bashof the unpinned install script in the wasm job with a pinned release download (v45.0.0) +sha256sum -cverification.ordvec-python/requirements-dev.txt, generated byuv pip compile --universal --generate-hashes --python-version 3.9so one file covers the 3.9–3.13 × OS matrix via environment markers) and zizmor (.github/zizmor-requirements.txt); installed withpip install --require-hashes -r …inpython.yml,release-python.yml, andzizmor.yml.#5 (
pip install dist/*.tar.gz) installs the freshly-built local sdist — no stable hash by design — so it's dismissed in code scanning rather than fixed.Verified locally:
zizmor --offlineclean,actionlintclean (incl. shellcheck on the new wasmtime step), YAML valid. Requirements files are Dependabot-maintained.