fix(ci): pair setup-python with setup-uv to get latest Python patch

CI failure on PR #230 commit 1558779: build (3.12) failed because the
runner used Python 3.12.3 (pre-installed on ubuntu-latest), not 3.12.11+.
Two tests assert RFC 5952 IPv4-mapped IPv6 string format
(`::ffff:192.0.2.1`), which Python only adopted in 3.12.4 (bpo-119891).

Root cause: setup-uv's `python-version: "3.12"` doesn't install the
LATEST 3.12 patch — it picks up whatever Python is already on PATH (the
runner's older pre-installed version).

Fix: install Python via `actions/setup-python` first (always picks the
latest patch for the requested minor), then run setup-uv WITHOUT the
`python-version` input. Pass `--python ${{ matrix.python-version }}` to
`uv sync` to pin uv to the version setup-python provided.

Same fix applied to py-to-exe.yml for consistency.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: bluet

.github/workflows/py-to-exe.yml

@@ -19,18 +19,23 @@ jobs:
         python-version: ["3.14"]  # Default to current Python; revert to 3.13 if PyInstaller breaks
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - name: Install uv and set the Python version
+      # See python-test-versions.yml for why setup-python is paired with
+      # setup-uv — TL;DR: avoid the runner's older pre-installed Python.
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.13"
-          python-version: ${{ matrix.python-version }}
           enable-cache: true
       - name: Install project + pyinstaller
         # pyinstaller is build-only tooling, not a project runtime dep, so
         # install it on top of the locked env via `uv pip install` rather
         # than adding it to pyproject.toml.
         run: |
-          uv sync --locked
+          uv sync --locked --python ${{ matrix.python-version }}
           uv pip install pyinstaller
       - name: Compile python to exe
         run: |

.github/workflows/python-test-versions.yml

@@ -19,14 +19,25 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - name: Install uv and set the Python version
+      # Install Python via setup-python to get the LATEST patch of the
+      # requested minor version. setup-uv's `python-version` input would
+      # otherwise pick up the runner's pre-installed Python (often older,
+      # e.g. 3.12.3 on ubuntu-latest as of May 2026), which breaks tests
+      # sensitive to bug fixes shipped in later patches (e.g. Python
+      # 3.12.4's IPv4-mapped IPv6 string format change in bpo-119891).
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.13"
-          python-version: ${{ matrix.python-version }}
           enable-cache: true
       - name: Install project + dev dependencies (includes ruff)
-        run: uv sync --locked --dev
+        # `--python` pins uv to the python set up above (otherwise uv may
+        # resolve to a uv-managed install of a different patch).
+        run: uv sync --locked --dev --python ${{ matrix.python-version }}
       - name: Lint with ruff
         run: |
           # stop the build if there are Python syntax errors or undefined names