fix(python): lock tooling to py310 baseline

.github/actions/setup/README.md

@@ -114,7 +114,7 @@ Use `steps.<id>.outputs.zccache-store-path` inside workflow expressions. The sam
 | Input | Default | Description |
 |---|---|---|
 | `fbuild-version` | `latest` | PyPI version spec. Pin to an exact version (`2.1.16`) for reproducible CI. |
-| `python-version` | `3.12` | Python used to install fbuild. Must be >= 3.9. |
+| `python-version` | `3.10` | Python used to install fbuild. Must be >= 3.10. |
 | `cache` | `true` | Set to `false` to install fbuild without wiring `actions/cache`. |
 | `cache-mode` | `combined` | `combined` keeps one `FBUILD_CACHE_DIR` entry per key. `split` restores a packages cache shared per platform family and a per-board build-payload cache, and runs `fbuild install` as its own step. |
 | `save` | `true` | `false` restores caches without saving; use it on pull requests. |

.github/actions/setup/action.yml

@@ -11,9 +11,9 @@ inputs:
     required: false
     default: "latest"
   python-version:
-    description: "Python version used to install fbuild. Must be >= 3.9."
+    description: "Python version used to install fbuild. Must be >= 3.10."
     required: false
-    default: "3.12"
+    default: "3.10"
   cache:
     description: "Whether to save/restore the fbuild cache via actions/cache. Set to 'false' to skip caching (install only)."
     required: false

.github/workflows/audit-ignored-tests.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.10"
       - name: Install uv
         run: pip install --timeout 60 uv
       - name: Generate inventory (markdown)

.github/workflows/template_native_build.yml

@@ -118,7 +118,10 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          # The extension's public ABI baseline is abi3-py310. Keep release
+          # tooling on that version so a newer interpreter cannot constrain
+          # the repository's dependency lock (FastLED/fbuild#1451).
+          python-version: "3.10"
 
       # rust-toolchain.toml pins 1.95.0 which overrides the above;
       # ensure the target stdlib is installed for the pinned toolchain too.

.github/workflows/validate-boards.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.12"
+          python-version: "3.10"
       - name: Install PlatformIO
         timeout-minutes: 5
         run: pip install --timeout 60 "platformio==${PLATFORMIO_CORE_VERSION}"

crates/fbuild-python/tests/pyo3_policy.rs

@@ -204,6 +204,44 @@ fn pyo3_029_policy_stays_target_python_independent() {
     }
 }
 
+#[test]
+fn python_api_and_fixed_ci_interpreters_use_py310() {
+    // FastLED/fbuild#1451: the public extension is abi3-py310.  Lock and run
+    // repository-owned Python tooling against that API floor; do not make a
+    // newer interpreter an accidental resolver requirement.
+    let root = repo_root();
+    let manifest = fs::read_to_string(root.join("pyproject.toml")).unwrap();
+    let lockfile = fs::read_to_string(root.join("uv.lock")).unwrap();
+    let install = fs::read_to_string(root.join("install")).unwrap();
+    let setup_action = fs::read_to_string(root.join(".github/actions/setup/action.yml")).unwrap();
+    let setup_readme = fs::read_to_string(root.join(".github/actions/setup/README.md")).unwrap();
+
+    for (name, contents) in [
+        ("pyproject.toml", manifest.as_str()),
+        ("uv.lock", lockfile.as_str()),
+        ("install", install.as_str()),
+    ] {
+        assert!(
+            contents.contains("requires-python = \">=3.10\""),
+            "{name} must retain Python 3.10 as its supported floor"
+        );
+    }
+    assert!(setup_action.contains("default: \"3.10\""));
+    assert!(setup_readme.contains("| `python-version` | `3.10` |"));
+
+    for workflow in [
+        ".github/workflows/template_native_build.yml",
+        ".github/workflows/audit-ignored-tests.yml",
+        ".github/workflows/validate-boards.yml",
+    ] {
+        let contents = fs::read_to_string(root.join(workflow)).unwrap();
+        assert!(
+            contents.contains("python-version: \"3.10\""),
+            "{workflow} must use the Python 3.10 API baseline"
+        );
+    }
+}
+
 #[test]
 fn native_release_workflow_uses_current_cross_toolchains() {
     let root = repo_root();

install

@@ -1,6 +1,6 @@
 #!/usr/bin/env -S uv run --script
 # /// script
-# requires-python = ">=3.9"
+# requires-python = ">=3.10"
 # ///
 """Install uv and the pinned Rust toolchain for fbuild development.