fix: use venv for Python deps in all CI workflows (PEP 668) (#531)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

.github/workflows/cleanup.yml

@@ -29,12 +29,14 @@ jobs:
           echo '${{ toJson(secrets) }}' > secrets.json
 
       - name: Install dependencies
-        run: pip install -r .github/workflows/innersourcing/requirements.txt
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install -r .github/workflows/innersourcing/requirements.txt
 
       - name: Execute cleanup script
         run: |
           set -e
           set -o pipefail
           export GITHUB_REF_NAME="${{ github.event_name == 'workflow_dispatch' && github.ref_name || github.event.pull_request.head.ref }}"
           echo "Exporting GITHUB_REF_NAME: $GITHUB_REF_NAME"
-          python3 .github/workflows/innersourcing/cleanup.py
+          .venv/bin/python3 .github/workflows/innersourcing/cleanup.py

.github/workflows/outputs-publish.yml

@@ -31,13 +31,13 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -r .github/workflows/innersourcing/requirements.txt
+          python3 -m venv .venv
+          .venv/bin/pip install -r .github/workflows/innersourcing/requirements.txt
 
       - name: Generate Output Trees
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_BUCKET_NAME: ${{ vars.FACETS_MODULES_BUCKET_NAME }}
           DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
-        run: python .github/workflows/innersourcing/generate_output_trees.py
+        run: .venv/bin/python .github/workflows/innersourcing/generate_output_trees.py

.github/workflows/publish.yml

@@ -24,15 +24,15 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -r .github/workflows/innersourcing/requirements.txt
+          python3 -m venv .venv
+          .venv/bin/pip install -r .github/workflows/innersourcing/requirements.txt
 
       - name: Generate Module Zips
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_BUCKET_NAME: ${{ vars.FACETS_MODULES_BUCKET_NAME }}
-        run: python .github/workflows/innersourcing/zip_modules.py
+        run: .venv/bin/python .github/workflows/innersourcing/zip_modules.py
 
       - name: Post Success to a Slack channel
         id: slack

.github/workflows/validate-bootstrapper.yml

@@ -23,7 +23,9 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Install dependencies
-        run: pip install -r .github/workflows/innersourcing/requirements.txt
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install -r .github/workflows/innersourcing/requirements.txt
 
       - name: Run validate-bootstrapper script
         id: run
@@ -32,7 +34,7 @@ jobs:
           ROOT_TOKEN: ${{ secrets.ROOT_TOKEN }}
         run: |
           set +e
-          python -u .github/workflows/innersourcing/validate_bootstrapper.py 2>&1 | tee script_output.txt
+          .venv/bin/python -u .github/workflows/innersourcing/validate_bootstrapper.py 2>&1 | tee script_output.txt
           exit_status=${PIPESTATUS[0]}
           output=$(cat script_output.txt)