[sylphx-desk-apps]

What

The shared self-hosted-runners action no longer calls actions/setup-python. It runs the runner's own python3; if PyYAML is missing it installs pyyaml==6.0.2 with pip install --target into $RUNNER_TEMP and adds that directory to PYTHONPATH (the pattern the Android build workflows already use). It fails with a clear error if the runner has no python3.

The same setup-python step is removed from this repository's own content-checks, ftl-daily-budget-action and game-standard-action workflows. The ftl-daily-budget and game-standard actions already pick the first suitable interpreter on the runner, so they need no change. content-checks installs PyYAML for its guard tests with the same --target fallback.

Why

actions/setup-python downloads and installs CPython 3.12 on every run of a self-hosted runner. In a calling repository the self-hosted-runners job has timeout-minutes: 5 and was cancelled at the limit right after "Successfully set up CPython". Every code check had passed; only the guard job timed out, and the aggregate check failed on it.

How tested

• actionlint on content-checks.yml, ftl-daily-budget-action.yml and game-standard-action.yml: clean. (Other workflows in the repo report existing shellcheck info notes; not touched.)
• python3 .github/actions/self-hosted-runners/test/test_check_runners.py: 11 tests OK.
• The action's step script, extracted and run with the runner's python3 (no setup step), with GITHUB_ACTION_PATH, GITHUB_WORKSPACE, RUNNER_TEMP, VISIBILITY set:
  • PyYAML present: passes a compliant private repository.
  • PyYAML absent (fresh venv without it): installs into $RUNNER_TEMP/self-hosted-runners-python, then passes.
  • A private repository with runs-on: ubuntu-latest: exits 1 with the same error as before.
• Not run: the workflows on a real runner (needs this PR's CI).

Rollout

Calling repositories pin this action by commit, so merging changes nothing for them until a pin is bumped. After merge the new commit is rolled out canary-first, not to all callers at once:

1. Canary: Cubeage/renovate-config (small config repo, one content-checks job). Bump its pin to the merge commit and confirm its self-hosted-runners job finishes in seconds with no CPython download.
2. Second: Cubeage/fun-mahjong, which carries a vendored copy of the guard as a stopgap; once it passes on the new pin that copy is removed.
3. If both are green, the remaining callers are bumped in batches.

Calling repositories found by code search (39, current pin 854d150d886e0a4d15846e87e57ca67c7b8c290e where checked): Big2TycoonHk, Info, Policy, app-ads.txt, big2-tycoon, big2-tycoon-2, big2-tycoon-keel, big2-tycoon-tw, blackjack-showdown, bloomkin-keel, brand, crumple-keel, cubeage-cs-agent, cubeage-kit, cubeage-native-sdk, cubeage-platform, cubeage-preview-router, dearhouse-keel, fun-big2-hk, fun-big2-tw, fun-mahjong, fun-mahjong-keel, fun-showhand, fun-texas-holdem, jery, last-minute-keel, mahjong-tycoon-tw, mahjong-tycoon-tw-2, mobile-app, planet-post-keel, rank-system, renovate-config, solar2d-ironsource-sdk, solar2d-linux-builds, tenkind-keel, tycoon-engine, unity-runner, voidbite-keel, worldreign-keel.

Callers use either content-checks.yml or self-hosted-runners.yml (cubeage-kit, dearhouse-keel, worldreign-keel).

Risks

Low. A runner with no python3 now fails with an explicit message instead of silently provisioning one; all current runners have python3 (the guard already ran under it in fun-mahjong). Rollback: revert this commit and re-pin callers.

[sylphx-desk-services]

Looks good. The shared runner guard and the three workflows now use the runner's own python3 instead of downloading CPython on every run. PyYAML is installed into a temporary target only when the runner lacks it, and a runner without python3 fails with a clear error. Callers pin the action by commit, so nothing changes for them until they update the pin. CI is green.