From 9e2383a341c311604bf8f1dd2428bf6eab840911 Mon Sep 17 00:00:00 2001
From: davd-gzl <60177543+davd-gzl@users.noreply.github.com>
Date: Fri, 14 Aug 2026 17:54:51 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(ci)=20install=20dependenc?=
 =?UTF-8?q?ies=20without=20running=20their=20setup=20code?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A package could run arbitrary code on the runner while installing,
and the versions were resolved rather than taken from the pins.
The two pip calls now take wheels only, and uv run no longer
resolves an environment of its own.
---
 .github/workflows/meet.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/meet.yml b/.github/workflows/meet.yml
index e7572b68..06d22836 100644
--- a/.github/workflows/meet.yml
+++ b/.github/workflows/meet.yml
@@ -33,7 +33,7 @@ jobs:
           ! git log | grep 'fixup!'
       - name: Install gitlint
         if: always()
-        run: pip install --user requests gitlint
+        run: "pip install --user --only-binary=:all: requests==2.34.2 gitlint==0.18.0"
       - name: Lint commit messages added to main
         if: always()
         run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
@@ -130,11 +130,11 @@ jobs:
         run: uv sync --locked --all-extras
 
       - name: Check code formatting with ruff
-        run: uv run ruff format . --diff
+        run: uv run --no-sync ruff format . --diff
       - name: Lint code with ruff
-        run: uv run ruff check .
+        run: uv run --no-sync ruff check .
       - name: Lint code with pylint
-        run: uv run pylint meet demo core
+        run: uv run --no-sync pylint meet demo core
 
   lint-agents:
     runs-on: ubuntu-latest
@@ -155,9 +155,9 @@ jobs:
       - name: Install the project
         run: uv sync --locked --all-extras
       - name: Check code formatting with ruff
-        run: uv run ruff format . --diff
+        run: uv run --no-sync ruff format . --diff
       - name: Lint code with ruff
-        run: uv run ruff check .
+        run: uv run --no-sync ruff check .
 
   lint-summary:
     runs-on: ubuntu-latest
@@ -175,7 +175,7 @@ jobs:
           python-version: "3.13"
           cache: "pip"
       - name: Install development dependencies
-        run: pip install --user .[dev]
+        run: "pip install --user --only-binary=:all: .[dev]"
       - name: Check code formatting with ruff
         run: ~/.local/bin/ruff format . --diff
       - name: Lint code with ruff
@@ -291,10 +291,10 @@ jobs:
           sudo apt-get install -y gettext
 
       - name: Generate a MO file from strings extracted from the project
-        run: uv run python manage.py compilemessages
+        run: uv run --no-sync python manage.py compilemessages
 
       - name: Run tests
-        run: uv run pytest -n 2
+        run: uv run --no-sync pytest -n 2
 
   test-summary:
     runs-on: ubuntu-latest
@@ -334,7 +334,7 @@ jobs:
           cache: "pip"
 
       - name: Install development dependencies
-        run: pip install --user .[dev]
+        run: "pip install --user --only-binary=:all: .[dev]"
 
       - name: Run summary tests
         run: ~/.local/bin/pytest