fix(distribution): make satellite verification reproducible

distribution/scripts/package-template.mjs

@@ -92,7 +92,11 @@ function generatedWorkflow(template) {
           cache: npm
 `,
     "Gradle Wrapper": "      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4\n        with:\n          distribution: temurin\n          java-version: 17\n          cache: gradle\n",
-    pip: "      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5\n        with:\n          python-version: '3.11'\n          cache: pip\n",
+    pip: `      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '${template.pythonVersion ?? "3.11"}'
+          cache: pip
+`,
     "Go modules": "      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5\n        with:\n          go-version-file: go.mod\n          cache: true\n",
     "Flutter pub": "      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2\n        with:\n          channel: stable\n          cache: true\n",
     Composer: "      - uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5\n        with:\n          php-version: '8.3'\n          tools: composer:v2\n          coverage: none\n",

distribution/scripts/package-template.test.mjs

@@ -12,6 +12,7 @@ const manifest = loadCatalog();
 const aiSaas = manifest.products.find((product) => product.id === "ai-saas");
 const react = manifest.templates.find((template) => template.id === "react-vite");
 const laravel = manifest.templates.find((template) => template.id === "laravel");
+const django = manifest.templates.find((template) => template.id === "django");
 const repositoryRoot = resolve(import.meta.dirname, "../..");
 const sliceFourSecurityFiles = new Map([
   ["sveltekit", ["src/lib/server/oidc.ts"]],
@@ -83,6 +84,18 @@ test("packages the AI SaaS product separately from the twenty framework satellit
   }
 });
 
+test("generates the declared runtime version in satellite CI", () => {
+  const temporary = mkdtempSync(resolve(tmpdir(), "tuurio-package-runtime-test-"));
+  try {
+    const output = resolve(temporary, "django");
+    packageTemplate(django, { output, sourceSha: "7".repeat(40) });
+    const workflow = readFileSync(resolve(output, ".github/workflows/verify.yml"), "utf8");
+    assert.match(workflow, /python-version: '3\.12'/);
+  } finally {
+    rmSync(temporary, { recursive: true, force: true });
+  }
+});
+
 test("packages the six server starters with the reviewed authentication contract", () => {
   const temporary = mkdtempSync(resolve(tmpdir(), "tuurio-package-server-contract-test-"));
   try {

distribution/scripts/validate-manifest.mjs

@@ -117,6 +117,25 @@ export const validateManifest = (manifest, { repositoryRoot = root } = {}) => {
     if (template.start !== undefined) {
       validateCommand(template.start, `${prefix}.start`, errors);
     }
+    if (
+      template.nodeVersion !== undefined &&
+      !/^[0-9]+(?:\.[0-9]+){0,2}$/.test(String(template.nodeVersion))
+    ) {
+      errors.push(`${prefix}: nodeVersion must be a numeric version`);
+    }
+    if (
+      template.pythonVersion !== undefined &&
+      !/^[0-9]+(?:\.[0-9]+){1,2}$/.test(String(template.pythonVersion))
+    ) {
+      errors.push(`${prefix}: pythonVersion must include major and minor numeric versions`);
+    }
+    if (
+      template.packageManager === "pip" &&
+      template.runtime?.startsWith("Python 3.12") &&
+      String(template.pythonVersion) !== "3.12"
+    ) {
+      errors.push(`${prefix}: Python 3.12 runtime must generate CI with pythonVersion 3.12`);
+    }
     if (template.files !== undefined) {
       if (!Array.isArray(template.files) || template.files.length < 1) {
         errors.push(`${prefix}: files must contain at least one allow-listed path`);

distribution/scripts/validate-manifest.test.mjs

@@ -98,3 +98,11 @@ test("rejects a framework label that cannot render safely", () => {
   const { errors } = validateManifest(manifest, { repositoryRoot: root });
   assert.ok(errors.some((error) => error.includes("framework must use 1-24 lowercase ASCII slug characters")));
 });
+
+test("requires Python 3.12 CI for templates that declare that runtime", () => {
+  const manifest = copy();
+  const django = manifest.templates.find((template) => template.id === "django");
+  django.pythonVersion = "3.11";
+  const { errors } = validateManifest(manifest, { repositoryRoot: root });
+  assert.ok(errors.some((error) => error.includes("Python 3.12 runtime must generate CI")));
+});

distribution/templates.yml

@@ -324,6 +324,7 @@ templates:
     campaign: github_django
     framework: django
     runtime: Python 3.12+
+    pythonVersion: "3.12"
     packageManager: pip
     start: python3 manage.py runserver 0.0.0.0:8000
     kind: server
@@ -341,6 +342,7 @@ templates:
     campaign: github_fastapi
     framework: fastapi
     runtime: Python 3.12+
+    pythonVersion: "3.12"
     packageManager: pip
     start: uvicorn app.main:app --host 0.0.0.0 --port 8000
     kind: server