From e646d8a98ac18afda0c7e1248b89c75627ffe959 Mon Sep 17 00:00:00 2001
From: shenxianpeng <xianpeng.shen@gmail.com>
Date: Fri, 24 Jul 2026 05:38:42 +0300
Subject: [PATCH] fix: resolve SonarCloud code scanning alerts for pip install
 security

- Add --only-binary :all: to all pip install commands in workflows
- Pin nox and twine versions in pyproject.toml as optional deps
- Add new ci optional-dependency group for twine
- Install CI tools via .[dev] and .[ci] extras to centralize version mgmt
- Dependabot will automatically manage version updates in pyproject.toml
---
 .github/workflows/main.yml            | 12 ++++++------
 .github/workflows/publish-package.yml |  3 ++-
 pyproject.toml                        |  3 ++-
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 826a6427..85442119 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -27,8 +27,8 @@ jobs:
 
       - name: Install nox
         run: |
-          python -m pip install --upgrade pip
-          python -m pip install nox
+          python -m pip install --only-binary :all: --upgrade pip
+          python -m pip install --only-binary :all: ".[dev]"
 
       - name: Run pre-commit
         run: |
@@ -71,8 +71,8 @@ jobs:
         with:
           python-version: ${{ matrix.py }}
       - run: |
-          pip install --upgrade pip
-          pip install .[dev]
+          pip install --only-binary :all: --upgrade pip
+          pip install --only-binary :all: .[dev]
 
       - name: Download wheel artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -97,8 +97,8 @@ jobs:
 
         - name: Install nox
           run: |
-            python -m pip install --upgrade pip
-            python -m pip install nox
+            python -m pip install --only-binary :all: --upgrade pip
+            python -m pip install --only-binary :all: ".[dev]"
 
         - name: Build docs
           run: nox -s docs
diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml
index 68eaabe3..86018824 100644
--- a/.github/workflows/publish-package.yml
+++ b/.github/workflows/publish-package.yml
@@ -26,7 +26,8 @@ jobs:
     - name: Build wheel
       run: |
         # Install dependencies
-        python -m pip install --upgrade pip twine
+        python -m pip install --only-binary :all: --upgrade pip
+        python -m pip install --only-binary :all: ".[ci]"
         # Build wheel
         python -m pip wheel -w dist .
         # Check distribution
diff --git a/pyproject.toml b/pyproject.toml
index 9841c626..4f909775 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -46,9 +46,10 @@ tracker = "https://github.com/commit-check/commit-check/issues"
 #     https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
 
 [project.optional-dependencies]
-dev = ['nox']
+dev = ['nox==2026.7.11']
 test = ['coverage', 'pytest', 'pytest-mock', 'pytest-codspeed']
 docs = ['sphinx<9', 'sphinx-immaterial', 'sphinx-autobuild', 'sphinx_issues', 'myst-parser']
+ci = ['twine==6.2.0']
 
 [tool.setuptools]
 zip-safe = false