From 58d3169282d1db0cc92f9abd89cc1ff40d8143a1 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Fri, 4 Sep 2026 20:41:48 +0200
Subject: [PATCH] fix(ci): bootstrap pinned Python runtime

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
---
 .forgejo/workflows/runtime-contract.yaml | 41 ++++++++++++++++++++----
 1 file changed, 34 insertions(+), 7 deletions(-)

diff --git a/.forgejo/workflows/runtime-contract.yaml b/.forgejo/workflows/runtime-contract.yaml
index 6fbc0de..a243570 100644
--- a/.forgejo/workflows/runtime-contract.yaml
+++ b/.forgejo/workflows/runtime-contract.yaml
@@ -17,18 +17,47 @@ jobs:
           FORGE_BASE: ${{ github.server_url }}
           REPO_NAME: ${{ github.repository }}
           REPO_SHA: ${{ github.sha }}
+          UV_VERSION: "0.8.0"
+          UV_X86_64_SHA256: "a7d74ee5c5ff3069b9d88236a05f293cc4e2809bad872f3a88a384489ba3675e"
         run: |
           set -eu
           work_dir="$(mktemp -d /tmp/rein-contract.XXXXXX)"
           trap 'rm -rf "${work_dir}"' EXIT
 
+          download() {
+            if command -v curl >/dev/null 2>&1; then
+              curl -fsSL "$1" -o "$2"
+            elif command -v wget >/dev/null 2>&1; then
+              wget -qO "$2" "$1"
+            else
+              echo "curl or wget is required to bootstrap uv" >&2
+              return 1
+            fi
+          }
+
+          case "$(uname -m)" in
+            x86_64|amd64) uv_target="x86_64-unknown-linux-gnu" ;;
+            *) echo "unsupported contract-runner architecture: $(uname -m)" >&2; exit 1 ;;
+          esac
+          uv_archive="${work_dir}/uv.tar.gz"
+          download \
+            "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-${uv_target}.tar.gz" \
+            "${uv_archive}"
+          printf '%s  %s\n' "${UV_X86_64_SHA256}" "${uv_archive}" | sha256sum -c -
+          tar -xzf "${uv_archive}" -C "${work_dir}"
+          uv_bin="${work_dir}/uv-${uv_target}/uv"
+          export UV_CACHE_DIR="${work_dir}/uv-cache"
+          export UV_PYTHON_INSTALL_DIR="${work_dir}/uv-python"
+          "${uv_bin}" python install 3.12
+          python_bin="$("${uv_bin}" python find 3.12)"
+
           git clone "${FORGE_BASE}/${REPO_NAME}.git" "${work_dir}/rein-aharness"
           git -C "${work_dir}/rein-aharness" checkout --detach "${REPO_SHA}"
 
           lock="${work_dir}/rein-aharness/deploy/runtime-contract-lock.json"
-          llm_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "llm-connect"))' "${lock}")"
-          glas_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "glas-harness"))' "${lock}")"
-          sandbox_sha="$(python3 -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "sandboxer"))' "${lock}")"
+          llm_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "llm-connect"))' "${lock}")"
+          glas_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "glas-harness"))' "${lock}")"
+          sandbox_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "sandboxer"))' "${lock}")"
 
           git clone "${FORGE_BASE}/coulomb/llm-connect.git" "${work_dir}/llm-connect"
           git -C "${work_dir}/llm-connect" checkout --detach "${llm_sha}"
@@ -38,7 +67,5 @@ jobs:
           git -C "${work_dir}/sand-boxer" checkout --detach "${sandbox_sha}"
 
           cd "${work_dir}/rein-aharness"
-          python3 -m venv .venv
-          .venv/bin/pip install --disable-pip-version-check 'uv==0.8.0'
-          .venv/bin/uv sync --frozen --no-editable --extra glas --extra llm --extra dev
-          make contract-test
+          "${uv_bin}" sync --python "${python_bin}" --frozen --no-editable --extra glas --extra llm --extra dev
+          ./scripts/verify-runtime-contracts.sh