[rmcdaniel]

Change

Install the pinned PyYAML policy dependency from a wheel. This addresses Sonar finding AaFA6a2F1hbbA_aB5roV without permitting source package build scripts for policy setup.

The central validator supports this reviewed command through durable-workflow/.github#192. Its previous command remains accepted for existing consumers; this workflow uses the hardened form.

Verification

• Python 3.13 installs PyYAML 6.0.2 from its published wheel.
• The central policy validator checks this workflow and preserves exact version, index, action-pin and permission constraints.
• All three candidate compatibility profiles and required CI/Sonar checks pass.
• Merged source is 59bf37360d31872fc0504117bf62b1ae1e41306f. All three fresh main compatibility profiles, the final qualification aggregate and main Sonar pass.
• Main analysis marks AaFA6a2F1hbbA_aB5roV FIXED at 01:16:46 UTC. This status was read back from Sonar, rather than set manually.

The other Sonar warning, AaFA6a2F1hbbA_aB5roW, was reviewed separately. This library intentionally resolves the selected Laravel/Testbench/PHPUnit ranges in its compatibility matrix, so composer update remains. Sonar records the specific accepted risk with its disposable-runner, read-only-token and no-secrets rationale. The rule stays enabled.

Refs durable-workflow/.github#187.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud