From 736944bd91d522accdae61ba31375ab5777b5da8 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Thu, 27 Aug 2026 07:40:29 +0200
Subject: [PATCH] ci: align managed validation contract [skip ci]

---
 .gitea/workflows/managed-validation.yml | 75 +++++++++++++------------
 1 file changed, 40 insertions(+), 35 deletions(-)

diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml
index aa26303..05072fe 100644
--- a/.gitea/workflows/managed-validation.yml
+++ b/.gitea/workflows/managed-validation.yml
@@ -38,11 +38,50 @@ jobs:
           esac
 
           git diff --check
-          if git grep -nE '^(<<<<<<<|=======|>>>>>>>)' -- . ':!*.lock' ':!*.patch'; then
+          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
             echo "Unresolved merge markers detected" >&2
             exit 1
           fi
 
+          if [[ -f pyproject.toml || -f requirements.txt ]]; then
+            # Compile only tracked Python sources. Running compileall after a
+            # Node install would otherwise traverse node_modules and turn a
+            # lightweight baseline into a large runner workload.
+            git ls-files -z '*.py' | xargs -0 -r python -m py_compile
+            if [[ -f uv.lock ]]; then
+              python -m venv "${RUNNER_TEMP}/managed-uv"
+              uv_python="${RUNNER_TEMP}/managed-uv/bin/python"
+              "${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0
+              managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv"
+              export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv"
+              "${managed_uv}" sync --locked
+              export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
+              if [[ "${profile}" == test || "${profile}" == full ]]; then
+                if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
+                  "${managed_uv}" run python -m pytest
+                fi
+              fi
+              if [[ "${profile}" == lint || "${profile}" == full ]]; then
+                if "${managed_uv}" run python -c 'import ruff' 2>/dev/null; then
+                  "${managed_uv}" run python -m ruff check .
+                fi
+              fi
+            elif [[ -f requirements.txt ]]; then
+              python -m venv "${RUNNER_TEMP}/managed-python"
+              managed_python="${RUNNER_TEMP}/managed-python/bin/python"
+              "${managed_python}" -m pip install --disable-pip-version-check -r requirements.txt
+              export PATH="${RUNNER_TEMP}/managed-python/bin:${PATH}"
+              if [[ "${profile}" == test || "${profile}" == full ]]; then
+                if "${managed_python}" -c 'import pytest' 2>/dev/null; then
+                  "${managed_python}" -m pytest
+                fi
+              fi
+            fi
+          fi
+
+          # Prepare Python before invoking Node scripts. Polyglot repositories
+          # commonly delegate their test script to Python and need the managed
+          # virtual environment to be active first.
           if [[ -f package.json ]]; then
             corepack enable
             if [[ -f pnpm-lock.yaml ]]; then
@@ -62,40 +101,6 @@ jobs:
             fi
           fi
 
-          if [[ -f pyproject.toml || -f requirements.txt ]]; then
-            # Compile only tracked Python sources. Running compileall after a
-            # Node install would otherwise traverse node_modules and turn a
-            # lightweight baseline into a large runner workload.
-            git ls-files -z '*.py' | xargs -0 -r python -m py_compile
-            if [[ -f uv.lock ]]; then
-              python -m venv "${RUNNER_TEMP}/managed-uv"
-              uv_python="${RUNNER_TEMP}/managed-uv/bin/python"
-              "${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0
-              managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv"
-              export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv"
-              "${managed_uv}" sync --locked
-              if [[ "${profile}" == test || "${profile}" == full ]]; then
-                if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
-                  "${managed_uv}" run python -m pytest
-                fi
-              fi
-              if [[ "${profile}" == lint || "${profile}" == full ]]; then
-                if "${managed_uv}" run python -c 'import ruff' 2>/dev/null; then
-                  "${managed_uv}" run python -m ruff check .
-                fi
-              fi
-            elif [[ -f requirements.txt ]]; then
-              python -m venv "${RUNNER_TEMP}/managed-python"
-              managed_python="${RUNNER_TEMP}/managed-python/bin/python"
-              "${managed_python}" -m pip install --disable-pip-version-check -r requirements.txt
-              if [[ "${profile}" == test || "${profile}" == full ]]; then
-                if "${managed_python}" -c 'import pytest' 2>/dev/null; then
-                  "${managed_python}" -m pytest
-                fi
-              fi
-            fi
-          fi
-
           if [[ -f go.mod ]]; then
             if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
               go test ./...