Supply chain: hash-locked dependencies, pip-audit/OSV, gitleaks, CycloneDX SBOM, Renovate (1.12.1)

[desiorac]

• Dependencies locked with hashes by uv pip compile --generate-hashes (Linux, Python 3.14); the deploy installs in pip's hash-checking mode (tested: install + pin check). A lock job fails when a lock is stale.
• pip-audit on the locked set, PyPI and OSV advisories (blocking).
• gitleaks on the whole history, pinned binary checked by sha256; the 29 existing findings were reviewed (doc examples, conformance JWTs, fake test keys, public proof ids, one historical secret already rotated) and are listed in .gitleaksignore.
• CycloneDX SBOM of the runtime set as a CI artifact and attached to each release.
• renovate.json (pip-compile manager, weekly lock maintenance). Renovate itself still has to be installed on the repository.

🤖 Generated with Claude Code

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/ci.yml

Package	Version	License	Issue Type
actions/upload-artifact	4.*.*	Null	Unknown License

Denied Licenses:

GPL-1.0, GPL-2.0, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-3.0, AGPL-3.0-only, AGPL-3.0-or-later, EUPL-1.0, EUPL-1.1, EUPL-1.2, OSL-1.0, OSL-2.0, OSL-2.1, OSL-3.0

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/upload-artifact	4.*.*	🟢 5.2	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
pip/pydantic-core	2.46.4	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 2 Found 8/28 approved changesets -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/typing-extensions	4.15.0	Unknown	Unknown

Scanned Files

• .github/workflows/ci.yml
• requirements.txt