From ae971631cde5f18dff4e4d7303e37c49c0ca2cce Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 09:18:21 +0000
Subject: [PATCH 1/3] Pin package build tools and require the policy YAML wheel

---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/publish.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0744f227..44b3e7b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
       - name: Bootstrap patched pip trust
         uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
       - name: Install policy dependencies
-        run: python -m pip install PyYAML==6.0.2
+        run: python -m pip install --only-binary=:all: PyYAML==6.0.2
       - name: Require centrally approved immutable action commits
         run: >-
           python .central-action-policy/scripts/qualification_policy.py validate
@@ -191,7 +191,7 @@ jobs:
         uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
         with:
           clients: pip,python
-      - run: pip install build twine
+      - run: pip install build==1.6.1 twine==7.0.0
       - run: python -m build
       - name: Compare built release metadata with the exact source commit
         run: python scripts/check_release_metadata.py --source-ref "$(git rev-parse HEAD)" --dist dist
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 43c9b715..ae5fc2d9 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -113,7 +113,7 @@ jobs:
           clients: pip,python
 
       - name: Install build tools
-        run: pip install build twine
+        run: pip install build==1.6.1 twine==7.0.0
 
       - name: Build package
         run: python -m build

From 9f11fdeec474066c3fc49c7b0eb1dfba85fbcb73 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 09:23:13 +0000
Subject: [PATCH 2/3] Quote the binary-only install command as a YAML block

---
 .github/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44b3e7b7..e4e8eb1f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,8 @@ jobs:
       - name: Bootstrap patched pip trust
         uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
       - name: Install policy dependencies
-        run: python -m pip install --only-binary=:all: PyYAML==6.0.2
+        run: >-
+          python -m pip install --only-binary=:all: PyYAML==6.0.2
       - name: Require centrally approved immutable action commits
         run: >-
           python .central-action-policy/scripts/qualification_policy.py validate

From 6d5501e1225b44613dc205a76286aa96da1c37af Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 09:27:57 +0000
Subject: [PATCH 3/3] Use reviewed wheel-only installs for policy and package
 tools

---
 .github/workflows/ci.yml      | 5 +++--
 .github/workflows/publish.yml | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e4e8eb1f..f8195e11 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -53,7 +53,7 @@ jobs:
         uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
       - name: Install policy dependencies
         run: >-
-          python -m pip install --only-binary=:all: PyYAML==6.0.2
+          python -m pip install --only-binary :all: PyYAML==6.0.2
       - name: Require centrally approved immutable action commits
         run: >-
           python .central-action-policy/scripts/qualification_policy.py validate
@@ -192,7 +192,8 @@ jobs:
         uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
         with:
           clients: pip,python
-      - run: pip install build==1.6.1 twine==7.0.0
+      - run: >-
+          pip install --only-binary :all: build==1.6.1 twine==7.0.0
       - run: python -m build
       - name: Compare built release metadata with the exact source commit
         run: python scripts/check_release_metadata.py --source-ref "$(git rev-parse HEAD)" --dist dist
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ae5fc2d9..93e6e51d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -113,7 +113,8 @@ jobs:
           clients: pip,python
 
       - name: Install build tools
-        run: pip install build==1.6.1 twine==7.0.0
+        run: >-
+          pip install --only-binary :all: build==1.6.1 twine==7.0.0
 
       - name: Build package
         run: python -m build