ci(security): pin the ScanCode install; pluggy 1.7.0 breaks it

.github/scancode-constraints.txt

@@ -0,0 +1,5 @@
+# Constraints for the ScanCode install of the license gate (PIP_CONSTRAINT).
+# pluggy 1.7.0 (2026-10-15) no longer finds plugincode 32.0.0's class-level
+# hookspecs: scancode then crashes at import with "did not find any
+# 'pre_scan' hooks" and the gate fails on every run.
+pluggy==1.6.0

.github/workflows/_security.yml

@@ -38,7 +38,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install ScanCode Toolkit
-        run: pipx install scancode-toolkit
+        # Pinned: an unpinned install picked up pluggy 1.7.0, which breaks
+        # scancode at import (see .github/scancode-constraints.txt).
+        env:
+          PIP_CONSTRAINT: ${{ github.workspace }}/.github/scancode-constraints.txt
+        run: pipx install scancode-toolkit==32.5.0
       - name: "Gate self-test (a planted violation must be detected)"
         run: scripts/license-gate.sh --selftest
       - name: "License compliance gate (one finding fails)"

scripts/license-gate.sh

@@ -13,7 +13,8 @@ set -euo pipefail
 # the ScanCode pass for runtime; their per-directory license files ARE
 # scanned, and layer 1 guarantees each grammar carries one.
 #
-# Requires: scancode (pipx install scancode-toolkit), python3.
+# Requires: scancode (PIP_CONSTRAINT=.github/scancode-constraints.txt
+# pipx install scancode-toolkit==32.5.0, as CI does), python3.
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
@@ -79,7 +80,7 @@ echo "OK: every vendored source directory is covered by a license file"
 
 echo "=== License gate 2/2: ScanCode detection ==="
 if ! command -v scancode &>/dev/null; then
-    echo "FAIL: scancode not installed (pipx install scancode-toolkit)"
+    echo "FAIL: scancode not installed (PIP_CONSTRAINT=.github/scancode-constraints.txt pipx install scancode-toolkit==32.5.0)"
     exit 1
 fi