git:20260730.4fcc86a to git:20260814.87e25ce

# `setup-python-env` — technical reference

Composite action wrapping the shared CI Python setup. See

[`README.md`](README.md) for usage and inputs.

## Steps (in order)

1. `astral-sh/setup-uv` — SHA-pinned; `enable-cache: true`,

`prune-cache: true`, `cache-dependency-glob: "**/uv.lock"`.

2. `actions/setup-python` — SHA-pinned; `python-version` from the input

It deliberately does **not** run `actions/checkout` (the caller does, first) and

does **not** run `uv sync` (kept explicit per job so dependency groups stay

visible).

## Invariants

- Third-party `uses:` are pinned to a full commit SHA with a `# vX.Y.Z` comment,

matching [`../../workflows/ci.yml`](../../workflows/ci.yml).

- The SHAs here are the single source of truth for the setup block; bump them

here, not per job.

- Changing inputs or step order requires updating the "Shared setup" section of

[`../../workflows/AGENTS.md`](../../workflows/AGENTS.md) in the same change.

## Verification

- `actionlint` (CI `actionlint` job) validates this action and its callers.

- Behavioural proof is the next CI run: GitHub Actions ordering (local action

resolves only post-checkout) cannot be exercised by local `actionlint`.