[BUGFIX] sonarcloud: Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is safe here.

Gonzalo Diaz · Gonzalo Diaz · commit 0c340a48187e · 2026-05-28T16:23:59.000-04:00
diff --git a/.github/workflows/yamllint.yml b/.github/workflows/yamllint.yml
@@ -18,7 +18,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install yamllint
-        run: pip install yamllint
+        run: >
+          python3 -m pip install --require-hashes --only-binary :all: -r requirements.lock.txt
 
       - name: Lint YAML files
         run: >
diff --git a/requirements.lock.txt b/requirements.lock.txt
@@ -0,0 +1,2 @@
+yamllint==1.38.0 \
+    --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+yamllint==1.38.0 \`
	`2`	`+ --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220`