[jothimani-rajendran]

What this changes

The three pip install . lines in demo-gif.yml (both jobs) and quickstart.yml become pip install --no-deps -e ., the form ci.yml and release.yml already use. agentseam declares no dependencies, so nothing is resolved either way. Scorecard's Pinned-Dependencies check flagged these three lines as unpinned and accepts the new form.

Scanner results, main (64e7270) → this branch

Scanner	main	this branch
Scorecard v5.2.1 --local, Pinned-Dependencies	8 (4 warns)	9 (1 warn: docs/quickstart.sh:17)
Scorecard Token-Permissions	10 (1 warn: demo-gif.yml contents: write)	10 (same warn, kept)
Scorecard aggregate (local file checks)	9.1	9.1
zizmor 1.31.1 --offline	0 findings	0 findings
CodeQL 2.26.4 (the bundle codeql.yml pins), python security-extended	0 results	not re-run (Python unchanged)
actionlint 1.7.12	clean	clean

zizmor online was not run because no GitHub token works in the session, so it is unmeasured.

Kept on purpose

• demo-gif.yml render-and-commit: contents: write and persist-credentials: true. The job pushes the regenerated GIF back onto the PR branch, so it needs both. The permission is set at job level only. Scorecard will keep this warning.
• docs/quickstart.sh:17 pip install agentseam. This line is generated from the README's Quick start block and is the end-user install instruction. In CI the tree installed above already satisfies it. Hash-pinning a README quickstart is a docs decision, so it is left for the owner.

Checks

• actionlint and zizmor clean; every action is still SHA-pinned; no new permissions, triggers or secrets
• I checked locally that pip install --no-deps -e . followed by pip install agentseam reports "Requirement already satisfied", so the quickstart block still resolves to the tree under test
• Commits are signed off (git commit -s)

Notes for the reviewer

These changes touch workflow files, so the orchestrator's security review is needed before this PR is marked ready.

---

Generated by Claude Code