ci: hash-pin workflow installs and scope publish's write to its job (SEC-5)

.github/requirements/framework.in

@@ -0,0 +1,12 @@
+# The framework's runtime dependencies, installed hash-pinned before the framework itself
+# (`pip install --no-deps --no-build-isolation ./framework`). Mirrors `dependencies` in
+# open-coder-ai/chock's pyproject.toml at the ref chock-catalog/.framework-ref names, plus
+# its build backend. If that ref changes them, `pip check` in the workflow fails and this
+# file is updated and recompiled:
+#   pip-compile --allow-unsafe --generate-hashes --strip-extras \
+#     --output-file=.github/requirements/framework.txt .github/requirements/framework.in
+pyyaml>=6.0
+jsonschema>=4.18,<5
+referencing>=0.35,<0.38
+agentseam==0.3.5
+setuptools>=77

.github/validator/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "chock-plugin-validator",
+  "private": true,
+  "description": "Pins the Claude Code CLI whose `claude plugin validate` checks every package; installed with `npm ci` so the lockfile's integrity hashes are enforced.",
+  "dependencies": {
+    "@anthropic-ai/claude-code": "2.1.239"
+  }
+}

.github/workflows/generated-only.yml

@@ -67,7 +67,15 @@ jobs:
           python-version: '3.12'
 
       - name: Install the framework from source
-        run: pip install ./framework
+        # Dependencies come hash-pinned from this repo's lock; the framework itself is the
+        # checkout above, built into a wheel with the locked build backend and installed with
+        # --no-deps, so pip resolves nothing unpinned. `pip check` fails closed if the
+        # framework ref declares a dependency the lock does not satisfy.
+        run: |
+          pip install --require-hashes -r dist/.github/requirements/framework.txt
+          pip wheel --no-deps --no-build-isolation --wheel-dir wheels ./framework
+          pip install --no-deps wheels/*.whl
+          pip check
 
       - name: Verify the lockfile and index match the published tree
         working-directory: dist
@@ -89,11 +97,16 @@ jobs:
       - name: Validate every package with Claude Code's own validator
         run: |
           # Pinned: this binary IS the verification step, so a floating version means the
-          # check itself changes under us without review.
-          npm install -g @anthropic-ai/claude-code@2.1.239
+          # check itself changes under us without review. `npm ci` enforces the lockfile's
+          # integrity hashes; it installs outside dist so nothing lands in the published tree.
+          validator="$RUNNER_TEMP/validator"
+          mkdir -p "$validator"
+          cp dist/.github/validator/package.json dist/.github/validator/package-lock.json "$validator/"
+          npm ci --prefix "$validator"
+          claude="$validator/node_modules/.bin/claude"
           failed=0
           for d in dist/claude/*/; do
-            claude plugin validate "$d" || failed=1
+            "$claude" plugin validate "$d" || failed=1
           done
-          claude plugin validate dist || failed=1
+          "$claude" plugin validate dist || failed=1
           exit $failed

.github/workflows/publish.yml

@@ -39,11 +39,15 @@ on:
         default: true
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      # The one write this repository's automation needs: the job commits and pushes the
+      # regenerated tree. Scoped to this job rather than the workflow.
+      contents: write
     steps:
       - name: Check out this distribution repo
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
@@ -99,7 +103,15 @@ jobs:
           python-version: '3.12'
 
       - name: Install the framework
-        run: pip install ./framework
+        # Dependencies come hash-pinned from this repo's lock; the framework itself is the
+        # checkout above, built into a wheel with the locked build backend and installed with
+        # --no-deps, so pip resolves nothing unpinned. `pip check` fails closed if the
+        # framework ref declares a dependency the lock does not satisfy.
+        run: |
+          pip install --require-hashes -r dist/.github/requirements/framework.txt
+          pip wheel --no-deps --no-build-isolation --wheel-dir wheels ./framework
+          pip install --no-deps wheels/*.whl
+          pip check
 
       # A policy that cannot prove its claims does not get distributed. Running the
       # catalog's own bar again here means a broken policy cannot reach users through a ref
@@ -126,13 +138,18 @@ jobs:
       - name: Validate every package
         run: |
           # Pinned: this binary IS the verification step, so a floating version means the
-          # check itself changes under us without review.
-          npm install -g @anthropic-ai/claude-code@2.1.239
+          # check itself changes under us without review. `npm ci` enforces the lockfile's
+          # integrity hashes; it installs outside dist so nothing lands in the published tree.
+          validator="$RUNNER_TEMP/validator"
+          mkdir -p "$validator"
+          cp dist/.github/validator/package.json dist/.github/validator/package-lock.json "$validator/"
+          npm ci --prefix "$validator"
+          claude="$validator/node_modules/.bin/claude"
           failed=0
           for d in dist/claude/*/; do
-            claude plugin validate "$d" || failed=1
+            "$claude" plugin validate "$d" || failed=1
           done
-          claude plugin validate dist || failed=1
+          "$claude" plugin validate dist || failed=1
           exit $failed
 
       - name: Show what would change

.github/workflows/security.yml

@@ -2,7 +2,7 @@ name: Security checks
 
 # zizmor audits the workflows (adoption-day: two input-injection sites in publish.yml,
 # six credential-persisting checkouts, and two unpinned validator installs -- all fixed;
-# the three deliberate exceptions live in .github/zizmor.yml with their reasons).
+# the two deliberate exceptions live in .github/zizmor.yml with their reasons).
 # actionlint checks workflow correctness. ShellCheck is deliberately NOT run here: every
 # shell script in this repository is generated from the catalog and verified
 # byte-identical to its source by the generated-only check, and the catalog lints the

.github/zizmor.yml

@@ -12,11 +12,3 @@ rules:
     # Credential persistence there is the mechanism, not an oversight.
     ignore:
       - publish.yml
-  adhoc-packages:
-    # The claude-code CLI is npm-installed to run `claude plugin validate` -- there is no
-    # lockfile to install it from in a repo that contains no Node project. The material
-    # risk (a floating version changing the verification under us) is addressed by
-    # pinning the exact version in both install lines.
-    ignore:
-      - generated-only.yml
-      - publish.yml