ci: run the shared guards on the runner python3 instead of downloading CPython

.github/actions/self-hosted-runners/action.yml

@@ -14,12 +14,23 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-      with:
-        python-version: "3.12"
-    - shell: bash
-      run: python3 -m pip install --disable-pip-version-check --quiet pyyaml==6.0.2
+    # The runner's own python3 runs the guard: actions/setup-python downloads
+    # and installs CPython on every run, which can exhaust a 5-minute job. Only
+    # PyYAML is fetched, and only when the runner lacks it.
     - shell: bash
       env:
         VISIBILITY: ${{ inputs.visibility }}
-      run: python3 "$GITHUB_ACTION_PATH/check_runners.py" "$GITHUB_WORKSPACE" --visibility "$VISIBILITY"
+      run: |
+        set -euo pipefail
+        if ! command -v python3 >/dev/null 2>&1; then
+          echo "::error::the self-hosted-runners guard needs python3 on the runner"
+          exit 1
+        fi
+        if ! python3 -c 'import yaml' >/dev/null 2>&1; then
+          deps="${RUNNER_TEMP:-/tmp}/self-hosted-runners-python"
+          mkdir -p "$deps"
+          python3 -m pip install --quiet --disable-pip-version-check \
+            --target "$deps" pyyaml==6.0.2
+          export PYTHONPATH="$deps${PYTHONPATH:+:$PYTHONPATH}"
+        fi
+        exec python3 "$GITHUB_ACTION_PATH/check_runners.py" "$GITHUB_WORKSPACE" --visibility "$VISIBILITY"

.github/workflows/content-checks.yml

@@ -37,10 +37,16 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-      - run: python3 -m pip install --disable-pip-version-check --quiet pyyaml==6.0.2
+      - name: PyYAML for the guard tests
+        run: |
+          set -euo pipefail
+          if ! python3 -c 'import yaml' >/dev/null 2>&1; then
+            deps="${RUNNER_TEMP:-/tmp}/self-hosted-runners-python"
+            mkdir -p "$deps"
+            python3 -m pip install --quiet --disable-pip-version-check \
+              --target "$deps" pyyaml==6.0.2
+            echo "PYTHONPATH=$deps${PYTHONPATH:+:$PYTHONPATH}" >> "$GITHUB_ENV"
+          fi
       - name: Guard tests
         run: python3 .github/actions/self-hosted-runners/test/test_check_runners.py
       - name: Guard this repository (local action, same code other repos call)

.github/workflows/ftl-daily-budget-action.yml

@@ -16,9 +16,6 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
       - name: Unit tests
         run: python3 -m unittest discover -s .github/actions/ftl-daily-budget/test
       - name: The action runs, and fails closed with no Test Lab credentials

.github/workflows/game-standard-action.yml

@@ -15,9 +15,6 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
       - name: Unit tests
         run: python3 -m unittest discover -s .github/actions/game-standard/test
       - name: The action runs, and fails closed in a repository with no manifest