From 5d925ab7a8f768c17a8c7b1e7d77c7cbb31f50ed Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 11:29:27 +0000 Subject: [PATCH 1/2] Use qualified PHP setup in shared contract CI --- .github/workflows/ci.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2e03ffb..7f875dc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,10 +17,12 @@ concurrency: jobs: contracts: name: Shared contract tests - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: @@ -33,10 +35,11 @@ jobs: - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php with: php-version: '8.3' - tools: composer:2.10.3, phpunit:11.5.57 + ini-file: production + tools: composer:2.10.3,phpunit:11.5.57 coverage: none - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 From 0cfa2cb0ae79f756b1548a186c68062b12bdc954 Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 11:41:16 +0000 Subject: [PATCH 2/2] Assert the no-RECORD refusal independently of pip diagnostic format --- tests/test_private_pip_runtime.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/test_private_pip_runtime.py b/tests/test_private_pip_runtime.py index 16d54b3..9fd07cc 100644 --- a/tests/test_private_pip_runtime.py +++ b/tests/test_private_pip_runtime.py @@ -192,7 +192,10 @@ def test_stock_installer_reproduces_no_record_then_seeds_empty_private_target_wi old_environment = runtime.private_environment(old) with self.assertRaises(subprocess.CalledProcessError) as refused: runtime.manager_command(interpreter, before, old_arguments, old_environment) - self.assertIn("uninstall-no-record-file", refused.exception.stderr) + self.assertNotEqual(0, refused.exception.returncode) + self.assertRegex(refused.exception.stderr, r"(?i)cannot uninstall pip") + self.assertRegex(refused.exception.stderr, + r"(?i)(?:RECORD file not found|no RECORD file (?:was )?found)") self.assertEqual(old_contents, runtime._tree_files(old_site)) private_python, purelib = runtime.venv_layout(new, interpreter) runtime.manager_command(interpreter, before, ["--python", str(private_python), "install",