Fix Python and Conan versions for sigstore signing on CentOS 7

The sigstore action requires Python 3.9+ and looks for 'python' (not
'python3'). On CentOS 7 (vfx2021 and vfx2022), the system Python is
3.7.9 and Conan is 1.47.0, both too old.

Solution:
1. Add ~/.local/bin to PATH early (before all setup steps)
2. Install Python 3.11 using uv with --default flag to create python,
   python3, and python3.11 symlinks in ~/.local/bin
3. Install Conan manually for CentOS 7 using python3.11 -m pip install
   --user to place it in ~/.local/bin
4. Keep get-conan action for other platforms

With ~/.local/bin first in PATH, all tools (uv, python 3.11, conan 2.x)
are found before old system versions, ensuring:
- Sigstore finds Python 3.11 as 'python'
- Builds use Conan 2.10.3 instead of system Conan 1.47.0

Signed-off-by: Gary Oberbrunner <[email protected]>

Author: garyo

.github/workflows/build.yml

@@ -189,6 +189,12 @@ jobs:
           fi
           echo "RELEASE_NAME=${RELEASE_PREFIX}-${REF_SUFFIX}${OPENGL_BUILD}" >> $GITHUB_ENV
 
+      # Ensure ~/.local/bin is first in PATH for all local tools (uv, python, pip, conan)
+      # This is especially important for old CentOS 7 containers with old system versions
+      - name: Fix PATH for local tools
+        run: |
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
       - name: Set up python 3.11
         uses: actions/setup-python@v5
         if: matrix.ostype == 'mac'
@@ -199,35 +205,34 @@ jobs:
       # Unfortunately astral-sh/setup-uv action doesn't work on CentOS 7, its GLIBC is too old.
 
       - name: Set up uv manually
-        if: matrix.release_prefix == 'linux-vfx2021'
+        if: matrix.vfx-cy == 2021 || matrix.vfx-cy == 2022
         run: |
           curl -LsSf https://astral.sh/uv/install.sh | sh
-          source ~/.local/bin/env
-          echo After sourcing uv env: "$PATH"
-          uv python install --preview 3.11
-
-          # Python is in $(uv python dir)/cpython-*/bin
-          # uv also installs a symlink in $HOME/.local/bin but because
-          # that is only a symlink, it causes problems with pip and venv.
-          # As a workaround, prepend the actual bin dir to $PATH.
-          uv_python_dir="$(uv python dir)"
-          uv_cpython_name="$(/bin/ls -1 $uv_python_dir)"
-          uv_python_path="$uv_python_dir/$uv_cpython_name/bin"
-          PATH="$uv_python_path":$PATH
-          # Prepend to path for future steps (note: don't use $GITHUB_ENV here)
-          echo "$uv_python_path" >> $GITHUB_PATH
+          # No need to source env - we already added ~/.local/bin to PATH above
+
+          # Use --default to create python/python3 symlinks in ~/.local/bin
+          # This ensures the sigstore action can find 'python' (not just 'python3')
+          ~/.local/bin/uv python install --default 3.11
 
       - name: Check python, uv paths
         run: |
-          echo $PATH
-          echo -n 'which python: ' && which python
-          echo -n 'which python3: ' && which python3
-          echo -n 'python version: ' && python --version
-          echo -n 'python3 version: ' && python3 --version
-          echo -n 'which uv: ' && (which uv || echo "No python uv; continuing")
+          echo "PATH=$PATH"
+          echo -n 'which python: ' && which python && python --version
+          echo -n 'which python3: ' && which python3 && python3 --version
+          echo -n 'python symlink target: ' && (readlink -f $(which python) || echo "not a symlink")
+          echo -n 'which uv: ' && (which uv || echo "No uv; continuing")
+
+      # Install Conan manually for old CentOS 7 using uv-installed Python
+      # The get-conan action doesn't know about uv Python and would use system Python
+      - name: Install Conan manually (CentOS 7)
+        if: matrix.vfx-cy == 2021 || matrix.vfx-cy == 2022
+        run: |
+          python3.11 -m pip install --user conan==${{ matrix.conan_version }}
 
+      # Use get-conan action for other platforms
       - name: Install Conan
         id: conan
+        if: matrix.vfx-cy != 2021 && matrix.vfx-cy != 2022
         uses: turtlebrowser/get-conan@main
         with:
           version: ${{ matrix.conan_version }}