Skip to content

Commit 680f0dc

Browse files
juenglinjuenglin
committed
CI: floor Python to ~3.14.10 in lychee.yml and build-docs.yml
Both workflows pass their Python interpreter to lychee-links, which calls harden-pip. Neither had a patched-version floor, and the docs CI run (job 123173870397) confirmed 3.14.9 was resolved before the simplified pip upgrade ran (no hash-pinned bootstrap to compensate). Apply the same ~3.14.10 tilde-range floor used in pre-commit.yml: - lychee.yml: inline the floor in the python-version field; PYTHON_VERSION stays minor-only ("3.14") for the cache restore-key prefix. - build-docs.yml: direct literal, no cache interaction to preserve. 3.14.10 is present in the manifest for all runner platforms, so the tilde-range resolves cleanly. Raised by rwgk in review.
1 parent dd043cd commit 680f0dc

2 files changed

Lines changed: 6 additions & 3 deletions

File tree

‎.github/workflows/build-docs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,7 @@ jobs:
307307
if: ${{ !inputs.is-release && startsWith(github.ref_name, 'pull-request/') }}
308308
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
309309
with:
310-
python-version: "3.14"
310+
python-version: "~3.14.10" # floor: first 3.14 with eMudhra ssl fix (CVE-2026-115557)
311311

312312
- name: Check rendered documentation links through pre-commit
313313
if: ${{ !inputs.is-release && startsWith(github.ref_name, 'pull-request/') }}

‎.github/workflows/lychee.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353
kind: [authored, rendered]
5454
env:
5555
PYTHONUTF8: "1"
56-
# Reuse the same minor version for Python setup and cache fallback.
56+
# Minor version used as the cache restore-key prefix (see setup-python step).
5757
PYTHON_VERSION: "3.14"
5858
steps:
5959
- name: Checkout checked revision
@@ -70,7 +70,10 @@ jobs:
7070
id: python
7171
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
7272
with:
73-
python-version: ${{ env.PYTHON_VERSION }}
73+
# Floor spec ensures the interpreter's ssl module rejects the compromised
74+
# eMudhra keys (CVE-2026-115557). PYTHON_VERSION stays minor-only ("3.14")
75+
# for the cache restore-key prefix below.
76+
python-version: "~3.14.10"
7477

7578
- name: Set pre-commit cache location
7679
run: echo "PRE_COMMIT_HOME=${RUNNER_TEMP}/pre-commit" >> "${GITHUB_ENV}"

0 commit comments

Comments
 (0)