[jcline-alpaca]

Summary

Patches the language runtimes used by this repo's GitHub Actions workflows for the eMudhra intermediate
CA compromise (SRE-50): CVE-2026-111943 (Go crypto/x509), CVE-2026-115557 (CPython
ssl), and the matching Node.js / OpenJDK trust-store fixes.

The hosted ubuntu-24.04 runner image still caches pre-fix toolchains (Go 1.26.9, Node 22.23.3 / 24.21.0,
Python 3.11.17–3.14.8, Temurin 17.0.20 / 21.0.12), so floating specs such as go-version: '1.26',
python-version: '3.12' or node-version: '24' resolve to unpatched runtimes.

Changes

• .github/workflows/ci.yml (test-core, test-integration): python-version: "3.12" → "3.12.16" (floating 3.12 resolves to the cached, unpatched 3.12.15; uv pip install --system installs into this interpreter)
• .github/workflows/publish-pypi.yml (build-release): python-version: "3.12" → "3.12.16" (same reason; uv sync/uv build use this interpreter)
• .github/workflows/publish-pypi.yml (publish-to-pypi): pypa/gh-action-pypi-publish v1.14.2 → v1.14.3, still SHA-pinned. The upload to PyPI runs on the action's own container Python, and v1.14.3 (2026-10-20) is the release that ships the eMudhra fixes (GHSA-5xjx-3w67-w9x9).

Notes

• The publish job only runs on release, so this PR's CI exercises the Python pins but not the new publish action.
• CI-only change; nothing is deployed by this PR.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were found.

Summary

Pins Python to 3.12.16 for both CI jobs and the release build.

• CI and release builds use Python 3.12.16.
• PyPI releases use the v1.14.3 publishing action.

_{Reviews (1) · Last reviewed commit: "SRE-50: Patch CI language runtimes for e..." · Reviewed by Greptile}