ci: sonar fixes (#41)

Author: ReenigneArcher

.github/workflows/ci.yml

@@ -72,11 +72,11 @@ jobs:
       - name: Sync Python tools
         env:
           UV_PYTHON: ${{ steps.setup-python.outputs.python-path }}
-        run: uv sync --locked --only-group test-python
+        run: uv sync --locked --only-group test-python --no-build
 
       - name: Test with pytest
         id: test
-        run: uv run --locked --only-group test-python pytest
+        run: uv run --locked --only-group test-python --no-build pytest
 
       - name: Upload test coverage
         # any except canceled or skipped

.github/workflows/localize.yml

@@ -56,10 +56,16 @@ jobs:
 
       - name: Sync Python tools
         run: |
-          uv sync --project .lizardbyte-common --frozen --group locale \
-            --no-default-groups \
-            --python "${PYTHON_VERSION}" \
+          uv_sync_args=(
+            --project .lizardbyte-common
+            --frozen
+            --group locale
+            --no-default-groups
+            --python "${PYTHON_VERSION}"
             --no-python-downloads
+          )
+          # The workflow SHA pins reviewed project code; building it installs the required lb-* entry points.
+          uv sync "${uv_sync_args[@]}"  # NOSONAR(githubactions:S8541)
 
       - name: Set up xgettext
         run: |