Freeze measurement score indices

[FlorianPfaff]

Bug

MeasurementScore is a frozen dataclass in a module explicitly providing non-mutating result containers, but it retained the caller's mutable active_measurement_indices list directly.

That allowed external mutation to change an already-created score. In particular, appending to an originally empty list could silently change score.is_active from False to True, potentially causing update logic to treat a skipped measurement batch as active.

Fix

• accept sequence-like index inputs as before
• normalize active_measurement_indices to an owned tuple in __post_init__
• preserve NumPy index-array support and existing tracker iteration/length behavior
• add a regression that mutates the source list after construction and verifies the score remains inactive

Validation

• syntax-compiled the modified module and test
• ran a focused runtime regression for caller-list mutation and NumPy array conversion
• branch comparison: 2 commits ahead of main, 0 behind
• diff is limited to the measurement-score container and its focused test

The full repository matrix should run on this pull request.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	24.2s
✅ JSON	prettier	7	0	0	0	1.54s
✅ JSON	v8r	7		0	0	3.84s
✅ MARKDOWN	markdownlint	68	0	0	0	2.02s
✅ MARKDOWN	markdown-table-formatter	68	0	0	0	0.63s
✅ PYTHON	black	1550	199	0	0	98.3s
✅ PYTHON	isort	1550	370	0	0	2.76s
✅ REPOSITORY	betterleaks	yes		no	no	3.06s
✅ REPOSITORY	checkov	yes		no	no	55.82s
✅ REPOSITORY	gitleaks	yes		no	no	15.6s
✅ REPOSITORY	git_diff	yes		no	no	0.4s
✅ REPOSITORY	secretlint	yes		no	no	64.97s
✅ REPOSITORY	syft	yes		no	no	5.65s
✅ REPOSITORY	trivy-sbom	yes		no	no	7.47s
✅ REPOSITORY	trufflehog	yes		no	no	31.87s
✅ YAML	prettier	11	0	0	0	0.77s
✅ YAML	v8r	11		0	0	12.65s
✅ YAML	yamllint	11		0	0	0.6s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters PYTHON_BLACK,PYTHON_ISORT,COPYPASTE_JSCPD,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository