@plainconceptsplatform/workflows 1.21.0 → 1.21.2

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -3731,6 +3731,12 @@ rc 'side-checks\.sh' "${HERE}/../merge-agent-pr/action.yml" 'merge-agent-pr must
 rc 'land-pull-request/side-checks\.sh' "${HERE}/../merge-train/merge-train.sh" 'the merge train must hold a pull request whose side workflow is red'
 rc 'test-timings\.mjs' "$CI_DOTNET" 'the .NET template must summarise the test timings'
 [ "$(grep -c -- '--logger trx' "$CI_DOTNET")" -ge 5 ] || { RC_OK=0; echo "FAIL: required checks: every .NET test step must write a trx report" >&2; }
+# The template sync installs copier on a runner whose Python cannot make a venv: the pinned uv it
+# falls back to must stay checked against its SHA-256, or the sync never runs (it never had).
+SYNC_YML="${HERE}/../../templates/platform-template/.github/workflows/platform-template-sync.yml"
+rc '^  UV_SHA256: [0-9a-f]{64}$' "$SYNC_YML" 'the template sync must pin uv by SHA-256'
+rc 'sha256sum --check --strict' "$SYNC_YML" 'the template sync must check the uv download'
+rc "python3 -c 'import ensurepip'" "$SYNC_YML" 'the template sync must not try a venv where ensurepip is missing'
 if [ "$RC_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 
 echo "── App error privacy ─────────────────────────────────────────────────────"

package/loops/templates/platform-template/.github/workflows/platform-template-sync.yml

@@ -25,6 +25,10 @@ concurrency:
 env:
   # copier 9.19.1 needs Python 3.10 or newer on the runner.
   COPIER_VERSION: "9.19.1"
+  # The pinned uv the copier step downloads when the runner has no uvx, no pipx and no ensurepip
+  # (the self-hosted runner image ships Python without python3-venv, so a venv cannot be made).
+  UV_VERSION: "0.13.5"
+  UV_SHA256: f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f
   NODE_VERSION: "22"
   SYNC_BRANCH: platform/template-sync
 
@@ -79,7 +83,8 @@ jobs:
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
-      # uvx where uv is installed, then pipx, then a virtual environment from the runner's Python.
+      # uvx where uv is installed, then pipx, then a virtual environment from the runner's Python, and
+      # where that Python cannot make one, a pinned uv checked against its SHA-256.
       - name: Install copier
         if: steps.decide.outputs.run == 'true' && startsWith(steps.contract.outputs.update, 'copier ')
         run: |
@@ -90,10 +95,16 @@ jobs:
             run="uvx --from copier==$COPIER_VERSION copier"
           elif command -v pipx >/dev/null 2>&1; then
             run="pipx run --spec copier==$COPIER_VERSION copier"
-          else
+          elif python3 -c 'import ensurepip' >/dev/null 2>&1; then
             python3 -m venv "$RUNNER_TEMP/copier-venv"
             "$RUNNER_TEMP/copier-venv/bin/pip" install --quiet "copier==$COPIER_VERSION"
             run="$RUNNER_TEMP/copier-venv/bin/copier"
+          else
+            tarball="$RUNNER_TEMP/uv.tar.gz"
+            curl -fsSL -o "$tarball" "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz"
+            echo "${UV_SHA256}  $tarball" | sha256sum --check --strict
+            tar -xzf "$tarball" -C "$RUNNER_TEMP"
+            run="$RUNNER_TEMP/uv-x86_64-unknown-linux-gnu/uvx --from copier==$COPIER_VERSION copier"
           fi
           cat > "$bin/copier" <<EOF
           #!/usr/bin/env bash

package/loops/templates/quality-gates/scripts/lib/test-timings.mjs

@@ -3,7 +3,8 @@
 // Reads VSTest .trx reports and says where a test run's time goes: by test class, since a class is
 // what xUnit runs in parallel and where a fixture's setup is paid once.
 
-const attr = (tag, name) => tag.match(new RegExp(`\\b${name}="([^"]*)"`))?.[1];
+// One literal pattern reads every attribute of a tag: Semgrep blocks a RegExp built from a variable.
+const attr = (tag, name) => Object.fromEntries([...tag.matchAll(/([\w:]+)="([^"]*)"/g)].map(([, key, value]) => [key, value]))[name];
 
 function seconds(duration) {
   const [h, m, s] = (duration ?? '0:0:0').split(':');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.21.0",
+  "version": "1.21.2",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",