Martin Vogel 8a6a1047d6 ci(security): pin the ScanCode install; pluggy 1.7.0 breaks it ...

The license gate installed `scancode-toolkit` unpinned. pluggy 1.7.0
(uploaded to PyPI 2026-10-15 09:50 UTC) no longer finds the hookspecs that
plugincode 32.0.0 declares on a class (`@pre_scan_spec class
PreScanPlugin`), so scancode crashes at import with "ValueError: did not
find any 'pre_scan' hooks" and `security / license-gate` fails on every
run, whatever the tree. The last green gate started at 09:50:14 UTC;
every run since is red. `ci-ok` and the release `verify` job both need the
security workflow, so this blocks every PR and the release.

Install exactly scancode-toolkit 32.5.0 (the version every green run
used) with pluggy constrained to 1.6.0 through PIP_CONSTRAINT, which the
pip that pipx runs reads. The local hint in license-gate.sh names the
same command.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

2026-10-15 18:16:16 +02:00

..

_build.yml

build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2

2026-08-22 05:55:41 +00:00

_lint.yml

ci(lint): raise the lint job timeout from 30 to 45 minutes

2026-10-13 19:22:10 +02:00

_memwaste.yml

refactor(mem): route this branch's allocations through the memory core

2026-09-18 23:27:23 +02:00

_security.yml

ci(security): pin the ScanCode install; pluggy 1.7.0 breaks it

2026-10-15 18:16:16 +02:00

_smoke.yml

fix(ci): finish the single-composition sweep in the smoke workflow

2026-08-10 08:40:29 +02:00

_soak.yml

ci: select release binaries before smoke testing

2026-08-13 19:16:19 +02:00

_test.yml

ci: upload failing suite logs when a test job fails

2026-10-12 20:18:19 +02:00

bug-repro.yml

build(deps): bump actions/checkout from 7.0.0 to 7.0.1

2026-08-04 09:58:51 +00:00

cache-warm.yml

build(deps): bump actions/checkout from 7.0.0 to 7.0.1

2026-08-04 09:58:51 +00:00

codeql.yml

ci: analyse and score only the newest main commit

2026-10-04 22:06:47 +02:00

dco.yml

build(deps): bump actions/checkout from 7.0.0 to 7.0.1

2026-08-04 09:58:51 +00:00

dry-run.yml

feat(ci): seeded fuzz leg, and register both new legs as canonical entries

2026-09-18 03:31:42 +02:00

fast-repro.yml

build(deps): bump actions/checkout from 7.0.0 to 7.0.1

2026-08-04 09:58:51 +00:00

issue-labeler.yml

build(deps): bump actions/checkout from 7.0.0 to 7.0.1

2026-08-04 09:58:51 +00:00

label-actions.yml

ci: add issue-triage bots (stale, label-actions, area-labeler)

2026-06-24 01:18:29 +02:00

nightly-soak.yml

feat(ci): seeded fuzz leg, and register both new legs as canonical entries

2026-09-18 03:31:42 +02:00

pages.yml

build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1

2026-09-05 05:46:19 +00:00

pr-acknowledgement.yml

build(deps): bump actions/checkout from 7.0.0 to 7.0.1

2026-08-04 09:58:51 +00:00

pr.yml

ci(test-impact): give the engine full history; publish maps with an incomplete suite

2026-10-09 01:59:34 +02:00

release.yml

ci: pin the noble-dependent runners, and attest the SBOM without the wrapper

2026-09-27 23:47:35 +02:00

scorecard.yml

ci: analyse and score only the newest main commit

2026-10-04 22:06:47 +02:00

smoke.yml

docs(ci): avoid hard-coded MCP tool count

2026-09-20 21:37:43 +02:00

stale.yml

build(deps): bump actions/stale from 10.4.0 to 11.0.0

2026-08-08 05:42:37 +00:00

test-impact-artifact.yml

ci(test-impact): give the engine full history; publish maps with an incomplete suite

2026-10-09 01:59:34 +02:00