🐛 ci: harden CI against SonarCloud vulnerability findings

.github/workflows/verify-all-samples.yml

@@ -99,14 +99,28 @@ jobs:
           ENTRY: ${{ matrix.sample.entry }}
         run: |
           set -euo pipefail
+          # `--no-build` is skipped only for python/semantic-kernel-tool-policy:
+          # its transitive dep pybars4 ships no wheel on PyPI (sdist only), so
+          # it must be built from source. `--locked` still applies. That
+          # example has a tests/ dir, so discover_samples.py always classifies
+          # it as `uv-pytest` — there is no `uv-main`/`py-script` case for it.
+          if [[ "$PWD" == *"semantic-kernel-tool-policy"* ]]; then
+            if [[ "$RUNNER" != "uv-pytest" ]]; then
+              echo "::error::semantic-kernel-tool-policy runner changed to $RUNNER — update this exception"
+              exit 1
+            fi
+            uv sync --extra dev --locked
+            uv run --locked pytest tests/ -v
+            exit 0
+          fi
           case "$RUNNER" in
             uv-pytest)
-              uv sync --extra dev
-              uv run pytest tests/ -v
+              uv sync --extra dev --locked --no-build
+              uv run --locked --no-build pytest tests/ -v
               ;;
             uv-main)
-              uv sync --extra dev
-              uv run python "$ENTRY" --mock
+              uv sync --extra dev --locked --no-build
+              uv run --locked --no-build python "$ENTRY" --mock
               ;;
             py-script)
               python "$ENTRY"
@@ -149,7 +163,7 @@ jobs:
           set -euo pipefail
           case "$RUNNER" in
             pnpm-test)
-              pnpm install
+              pnpm install --ignore-scripts
               pnpm test
               ;;
             node-script)

.github/workflows/verify-live.yml

@@ -79,7 +79,7 @@ jobs:
           python-version: "3.13"   # cp313 wheel gap (AAASM-4446) is part of what this lane must catch
 
       - name: Install the real published SDK (no shim)
-        run: pip install --pre "agent-assembly==0.0.1rc6"
+        run: "pip install --pre --only-binary=:all: 'agent-assembly==0.0.1rc6'"
 
       - name: Install and start the real aasm gateway
         run: bash .github/scripts/start-aasm.sh
@@ -115,7 +115,7 @@ jobs:
 
       - name: Install the real published SDK (no stub)
         working-directory: scenarios/live-core-enforcement/node-agent
-        run: pnpm install
+        run: pnpm install --ignore-scripts
 
       - name: Install and start the real aasm gateway
         run: bash .github/scripts/start-aasm.sh

.github/workflows/verify-node.yml

@@ -37,7 +37,7 @@ jobs:
           node-version: "20"
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --ignore-scripts
 
       - name: Type-check
         run: pnpm typecheck
@@ -63,7 +63,7 @@ jobs:
           node-version: "20"
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --ignore-scripts
 
       - name: Type-check
         run: pnpm typecheck
@@ -89,7 +89,7 @@ jobs:
           node-version: "20"
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --ignore-scripts
 
       - name: Type-check
         run: pnpm typecheck
@@ -115,7 +115,7 @@ jobs:
           node-version: "20"
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --ignore-scripts
 
       - name: Type-check
         run: pnpm typecheck
@@ -141,7 +141,7 @@ jobs:
           node-version: "20"
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --ignore-scripts
 
       - name: Type-check
         run: pnpm typecheck
@@ -167,7 +167,7 @@ jobs:
           node-version: "20"
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --ignore-scripts
 
       - name: Type-check
         run: pnpm typecheck

.github/workflows/verify-python.yml

@@ -32,10 +32,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   custom-tool-policy:
     name: custom-tool-policy
@@ -51,10 +51,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   llamaindex-tool-policy:
     name: llamaindex-tool-policy
@@ -70,10 +70,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   openai-agents-sdk:
     name: openai-agents-sdk
@@ -89,10 +89,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   langchain-research-agent:
     name: langchain-research-agent
@@ -108,10 +108,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   crewai-research-crew:
     name: crewai-research-crew
@@ -127,10 +127,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   langgraph:
     name: langgraph
@@ -146,10 +146,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   pydantic-ai:
     name: pydantic-ai
@@ -165,10 +165,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   microsoft-agent-framework-tool-policy:
     name: microsoft-agent-framework-tool-policy
@@ -187,13 +187,13 @@ jobs:
       # so CI installs `dev` only. The smoke tests importorskip it and the mock
       # demo runs without it — the offline path this repo's CI is meant to verify.
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
       - name: Run offline mock demo
-        run: uv run python src/main.py --mock
+        run: uv run --locked --no-build python src/main.py --mock
 
   google-adk:
     name: google-adk
@@ -209,10 +209,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   smolagents-tool-policy:
     name: smolagents-tool-policy
@@ -228,10 +228,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   agno-tool-policy:
     name: agno-tool-policy
@@ -247,10 +247,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   haystack-tool-policy:
     name: haystack-tool-policy
@@ -266,10 +266,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
   autogen-tool-policy:
     name: autogen-tool-policy
@@ -285,13 +285,13 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
       - name: Run offline demo
-        run: uv run python src/main.py
+        run: uv run --locked --no-build python src/main.py
 
   semantic-kernel-tool-policy:
     name: semantic-kernel-tool-policy
@@ -307,13 +307,16 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        # `--no-build` (S8541) can't be used here: pybars4 (a transitive dep
+        # of semantic-kernel's templating) ships no wheel on PyPI, sdist only,
+        # so it must be built from source. `--locked` (S8544) still applies.
+        run: uv sync --extra dev --locked
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked pytest tests/ -v
 
       - name: Run offline demo
-        run: uv run python src/main.py
+        run: uv run --locked python src/main.py
 
   strands-agents-tool-policy:
     name: strands-agents-tool-policy
@@ -329,10 +332,10 @@ jobs:
           version: "latest"
 
       - name: Install dependencies
-        run: uv sync --extra dev
+        run: uv sync --extra dev --locked --no-build
 
       - name: Run smoke tests
-        run: uv run pytest tests/ -v
+        run: uv run --locked --no-build pytest tests/ -v
 
       - name: Run offline demo
-        run: uv run python src/main.py
+        run: uv run --locked --no-build python src/main.py

.github/workflows/verify-scenarios.yml

@@ -155,7 +155,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install PyYAML for policy validation
-        run: pip install pyyaml
+        run: "pip install --only-binary=:all: 'pyyaml==6.0.3'"
       - name: Validate example code + policy shape (no gateway required)
         run: python scenarios/live-core-enforcement/scripts/check-offline.py
       - name: Validate docker-compose config
@@ -246,8 +246,8 @@ jobs:
         run: |
           if [ -d "scenarios/policy-enforcement/python" ]; then
             cd scenarios/policy-enforcement/python
-            uv sync --extra dev
-            uv run pytest tests/ -v
+            uv sync --extra dev --locked --no-build
+            uv run --locked --no-build pytest tests/ -v
           else
             echo "scenarios/policy-enforcement/python not yet present — skipping"
           fi
@@ -273,7 +273,7 @@ jobs:
         run: |
           if [ -d "scenarios/policy-enforcement/node" ]; then
             cd scenarios/policy-enforcement/node
-            pnpm install
+            pnpm install --ignore-scripts
             pnpm run build
           else
             echo "scenarios/policy-enforcement/node not yet present — skipping"
@@ -324,8 +324,8 @@ jobs:
         run: |
           if [ -d "scenarios/approval-gates/python" ]; then
             cd scenarios/approval-gates/python
-            uv sync --extra dev
-            uv run pytest tests/ -v
+            uv sync --extra dev --locked --no-build
+            uv run --locked --no-build pytest tests/ -v
           else
             echo "scenarios/approval-gates/python not yet present — skipping"
           fi
@@ -351,7 +351,7 @@ jobs:
         run: |
           if [ -d "scenarios/approval-gates/node" ]; then
             cd scenarios/approval-gates/node
-            pnpm install
+            pnpm install --ignore-scripts
             pnpm run build
           else
             echo "scenarios/approval-gates/node not yet present — skipping"