ci: take Python from the runner's tool cache, not from a mid-run download - #873
Merged
Conversation
…load
`uv python install` fetched CPython from python-build-standalone on GitHub Releases at the
start of four separate jobs, every run. On 2026-08-12 one of those fetches died:
error: Failed to install cpython-3.13.7-linux-x86_64-gnu
Caused by: http2 error: refused stream before processing any application logic
It was the fourth toolchain download to break fleet CI that day — after `yq` (veracrew,
curl exit 56), `kubectl` (speacher, still red), and Trivy (trading-council, exit 56). None
of the four had anything to do with the code being tested.
Two changes, and the second is the one that matters:
actions/setup-python with python-version-file: '.python-version'
UV_PYTHON_PREFERENCE: only-system
setup-python alone would NOT have fixed this. uv's default preference is `managed`: it
prefers its own CPython and downloads it even when a perfectly good interpreter is already
on PATH. `only-system` is what actually removes the fetch.
These jobs run on ubuntu-latest, where Python 3.13 ships in the runner's tool cache, so
setup-python resolves it without crossing the network. (Worth stating because the answer
would be different on our self-hosted pool, where setup-python falls back to downloading
from GitHub Releases too — there the fix would be a declared runner capability, the way
`build` already promises `start-test-postgres` and the WeasyPrint stack.)
.python-version stays the single source of truth: 3.13, matching requires-python >=3.13.
Applied to all four jobs that had the step (lines 103, 188, 229, 278) — dap#872 said three;
there were four.
Closes #872
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
rlagowski
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Zamyka #872.
Problem
uv python installpobierał CPythona z GitHub Releases na starcie czterech jobów, przykażdym przebiegu. 12 sierpnia jedno z tych pobrań padło:
To była czwarta tego dnia awaria pobierania narzędzia w CI floty:
yqcurl: (56) Connection died— naprawionekubectlhttp2: refused stream— tutajŻadna z czterech nie miała związku z testowanym kodem.
Zmiana
Sam
setup-pythonby tego nie naprawił — i to jest sedno. Domyślna preferencja uv tomanaged: woli własnego CPythona i pobiera go nawet wtedy, gdy sprawny interpreter jużjest na PATH. Dopiero
only-systemfaktycznie usuwa pobieranie. W zgłoszeniu #872zaproponowałem sam
setup-python; to było niewystarczające.Dlaczego akurat tu to działa
Te joby biegną na
ubuntu-latest, gdzie Python 3.13 jest w tool-cache runnera, więcsetup-pythonrozwiązuje go bez sieci.Mówię to wprost, bo na naszej puli self-hosted odpowiedź byłaby inna: tam
setup-pythonteż schodzi po plik do GitHub Releases, i właściwym rozwiązaniem byłaby zadeklarowana
zdolność runnera — tak jak
buildjuż obiecujestart-test-postgresi stos WeasyPrint(
pr-review-gate/registry/repos.yml).Weryfikacja
uv python installnie został.python-versionpozostaje jedynym źródłem prawdy:3.13, zgodne zrequires-python = ">=3.13"z grepa po jednym wzorcu i przeoczyłem czwarte.
Prawdziwym testem jest zielone CI na tym PR: jeśli Python wstaje bez pobierania, kroki
Pin Pythonprzejdą w sekundy zamiast w kilkanaście.