From f7a018de7eaa4c4b5c4bc08b0ff603a17659f2e8 Mon Sep 17 00:00:00 2001
From: Timmy <timmy@stackchain.ai>
Date: Sat, 22 Aug 2026 23:43:31 +0000
Subject: [PATCH] ci: provision pinned image runtime

---
 .gitea/workflows/quality.yml | 5 +++++
 tests/ci-workflow.test.js    | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml
index 1a9863d..c83115f 100644
--- a/.gitea/workflows/quality.yml
+++ b/.gitea/workflows/quality.yml
@@ -23,10 +23,15 @@ jobs:
         with:
           node-version: 22
           cache: npm
+      - name: Set up pinned Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
       - name: Install reproducibly
         run: |
           npm ci
           python3 -m pip install --break-system-packages -r requirements-test.txt
+          printf 'TIMMY_PYTHON=%s\n' "$(python3 -c 'import sys; print(sys.executable)')" >> "$GITHUB_ENV"
       - name: Install browser
         run: npx playwright install --with-deps chromium
       - name: Unit and security tests
diff --git a/tests/ci-workflow.test.js b/tests/ci-workflow.test.js
index 07fdb83..04eff59 100644
--- a/tests/ci-workflow.test.js
+++ b/tests/ci-workflow.test.js
@@ -17,6 +17,9 @@ test('Gitea CI gates pull requests and main with the reproducible quality suite'
   assert.match(workflow, /fetch-depth: 0/);
   assert.match(workflow, /npm ci/);
   assert.match(workflow, /python3 -m pip install --break-system-packages -r requirements-test\.txt/);
+  assert.match(workflow, /uses: actions\/setup-python@v5/);
+  assert.match(workflow, /python-version: ['"]3\.11['"]/);
+  assert.match(workflow, /TIMMY_PYTHON=.*sys\.executable/);
   assert.match(workflow, /npm test/);
   assert.match(workflow, /npm run test:ui/);
   assert.match(workflow, /npm run test:photo/);