From 00294ce678fe1e36f6695a82ae9820d241926a56 Mon Sep 17 00:00:00 2001
From: Rafal Lagowski <423235+rafeekpro@users.noreply.github.com>
Date: Thu, 13 Aug 2026 00:29:08 +0200
Subject: [PATCH] ci: take Python from the runner's tool cache, not from a
 mid-run download
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`uv python install` fetched CPython from python-build-standalone on GitHub Releases at the
start of four separate jobs, every run. On 2026-08-12 one of those fetches died:

  error: Failed to install cpython-3.13.7-linux-x86_64-gnu
    Caused by: http2 error: refused stream before processing any application logic

It was the fourth toolchain download to break fleet CI that day — after `yq` (veracrew,
curl exit 56), `kubectl` (speacher, still red), and Trivy (trading-council, exit 56). None
of the four had anything to do with the code being tested.

Two changes, and the second is the one that matters:

  actions/setup-python with python-version-file: '.python-version'
  UV_PYTHON_PREFERENCE: only-system

setup-python alone would NOT have fixed this. uv's default preference is `managed`: it
prefers its own CPython and downloads it even when a perfectly good interpreter is already
on PATH. `only-system` is what actually removes the fetch.

These jobs run on ubuntu-latest, where Python 3.13 ships in the runner's tool cache, so
setup-python resolves it without crossing the network. (Worth stating because the answer
would be different on our self-hosted pool, where setup-python falls back to downloading
from GitHub Releases too — there the fix would be a declared runner capability, the way
`build` already promises `start-test-postgres` and the WeasyPrint stack.)

.python-version stays the single source of truth: 3.13, matching requires-python >=3.13.
Applied to all four jobs that had the step (lines 103, 188, 229, 278) — dap#872 said three;
there were four.

Closes #872

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9bed73cc..399d7bee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,13 @@ permissions:
 
 env:
   UV_VERSION: "0.8.15"
+  # uv defaults to `managed`, i.e. it PREFERS its own CPython and downloads it from
+  # python-build-standalone on GitHub Releases. On 2026-08-12 that download failed mid-run
+  # ("http2 error: refused stream"), one of four toolchain fetches that broke fleet CI that
+  # day for reasons unrelated to any code. `only-system` makes uv use the interpreter
+  # actions/setup-python already put there — which on ubuntu-latest comes out of the runner's
+  # tool cache and crosses no network at all.
+  UV_PYTHON_PREFERENCE: only-system
   NODE_VERSION: "22"
   PNPM_VERSION: "9"
 
@@ -100,7 +107,9 @@ jobs:
 
       - name: Pin Python from .python-version
         if: needs.classify.result != 'success' || needs.classify.outputs.run_python == 'true'
-        run: uv python install
+        uses: actions/setup-python@v5
+        with:
+          python-version-file: '.python-version'
 
       # Guard against source/lock drift (#645): dependabot's uv group can bump
       # uv.lock without widening the source pyproject.toml constraints (or vice
@@ -185,7 +194,9 @@ jobs:
 
       - name: Pin Python from .python-version
         if: needs.classify.result != 'success' || needs.classify.outputs.run_python_smoke == 'true'
-        run: uv python install
+        uses: actions/setup-python@v5
+        with:
+          python-version-file: '.python-version'
 
       - name: Install workspace (frozen)
         if: needs.classify.result != 'success' || needs.classify.outputs.run_python_smoke == 'true'
@@ -226,7 +237,9 @@ jobs:
 
       - name: Pin Python from .python-version
         if: needs.classify.result != 'success' || needs.classify.outputs.run_pip_audit == 'true'
-        run: uv python install
+        uses: actions/setup-python@v5
+        with:
+          python-version-file: '.python-version'
 
       - name: Install workspace (frozen)
         if: needs.classify.result != 'success' || needs.classify.outputs.run_pip_audit == 'true'
@@ -275,7 +288,9 @@ jobs:
 
       - name: Pin Python from .python-version
         if: needs.classify.result != 'success' || needs.classify.outputs.run_dashboard == 'true'
-        run: uv python install
+        uses: actions/setup-python@v5
+        with:
+          python-version-file: '.python-version'
 
       - name: Install Python workspace (frozen)
         if: needs.classify.result != 'success' || needs.classify.outputs.run_dashboard == 'true'