ci: hash-pin workflow installs and scope publish's write to its job (SEC-5)

[jothimani-rajendran]

SEC-5 (org-plan plan/sec-scan-2026-10-16.md): clear the code-scanning findings in this repo's workflows.

These workflows are hand-maintained in each plugin repo, not emitted by open-coder-ai/chock (the emitter writes the plugin trees, index, lockfile and PLUGINS.md; nothing under .github/workflows/), so the fix lands here.

Changes

• Hash-pinned framework install (generated-only.yml, publish.yml): dependencies install from .github/requirements/framework.txt (pip-compile --allow-unsafe --generate-hashes --strip-extras, Python 3.12, from framework.in) with --require-hashes. The framework checkout is built into a wheel with the locked setuptools (--no-build-isolation) and installed --no-deps; pip check fails closed if a future framework ref declares a dependency the lock does not satisfy.
• Validator via npm ci: @anthropic-ai/claude-code@2.1.239 now installs from a committed .github/validator/package-lock.json (integrity hashes enforced), into $RUNNER_TEMP so nothing lands in the published tree. The adhoc-packages zizmor exception that covered the old npm install -g is removed.
• publish.yml permissions: workflow default contents: read; contents: write only on the publish job, which commits and pushes the regenerated tree.

Write permissions kept (and why)

• publish job contents: write: it pushes the regenerated tree with the built-in token.
• security.yml zizmor job security-events: write: uploads the SARIF to code scanning.
• close-prs.yml pull-requests: write: comments on and closes fork PRs (unchanged).

Measured

Scorecard v5.2.1 --local --show-details aggregate 5.6 → 6.8:

Check	before	after
Pinned-Dependencies	5	10
Token-Permissions	0	10
Vulnerabilities	10	unmeasured (osv.dev blocked)

• zizmor 1.31.1 --offline with the repo config: no findings before and after, now with one fewer exception. Online audits locally: unmeasured (no token). The Security checks workflow (zizmor online + SARIF upload) is green on main.
• actionlint 1.7.7: clean.
• pip-audit on framework.txt: no known vulnerabilities; npm audit on the validator lock: 0 vulnerabilities.
• Locally (Python 3.12): the new install sequence installs chock 0.15.2 at the catalog's .framework-ref, pip check clean, chock check passes on catalog main, and claude plugin validate passes on every package via npm ci.
• CodeQL: unmeasured; this repo has no codeql.yml.

Known red check

Generated-only is already red on main at "Regenerate from the catalog and diff": chock-catalog main has moved past the published tree, so it needs a publish run (owner). This PR does not change that step.

---

Generated by Claude Code

[jothimani-rajendran]

Generated-only / verify is red at Regenerate from the catalog and diff. That is not this PR's failure: Generated-only is also red on main (run 38492263248, head 7e1e808), because chock-catalog main has moved past the tree published here. The fix is the owner's: run publish.yml with dry_run: false. No code fix exists for this PR to carry.

The step this PR changes passes in CI: "Install the framework from source" (hash-pinned lock, then wheel --no-deps, then pip check) succeeded. The validator step is skipped after the diff fails. I checked the npm ci validator install locally instead, and claude plugin validate passed. A re-run would not help, because the failure is deterministic catalog drift.

---

Generated by Claude Code