ci(python-lint): pin ruff to 0.17.0 and run it via the installing interpreter

.github/guid-index.json

@@ -875,7 +875,7 @@
     "path": ".github/workflows/ci-tests.yml",
     "guid": "ci-tests-workflow-2025-automation",
     "title": "CI Self Tests",
-    "version": "1.2.0",
+    "version": "1.2.2",
     "header_path": ".github/workflows/ci-tests.yml",
     "path_mismatch": false
   },
@@ -979,7 +979,7 @@
     "path": ".github/workflows/reusable-ci.yml",
     "guid": "reusable-ci-2025-09-24-core-workflow",
     "title": "Reusable CI Workflow",
-    "version": "1.17.1",
+    "version": "1.19.1",
     "header_path": ".github/workflows/reusable-ci.yml",
     "path_mismatch": false
   },
@@ -1051,7 +1051,7 @@
     "path": ".github/workflows/scripts/ci_workflow.py",
     "guid": "d9c2b3a4-5e6f-47a8-9b0c-1d2e3f4a5b6c",
     "title": "ci workflow",
-    "version": "1.2.0",
+    "version": "1.3.2",
     "header_path": ".github/workflows/scripts/ci_workflow.py",
     "path_mismatch": false
   },
@@ -3663,6 +3663,14 @@
     "header_path": "tests/workflow_scripts/test_automation_workflow.py",
     "path_mismatch": false
   },
+  {
+    "path": "tests/workflow_scripts/test_ci_workflow.py",
+    "guid": "be8f15eb-d640-417d-8c19-bb923f338f54",
+    "title": "test ci workflow",
+    "version": "1.0.1",
+    "header_path": "tests/workflow_scripts/test_ci_workflow.py",
+    "path_mismatch": false
+  },
   {
     "path": "tests/workflow_scripts/test_docs_workflow.py",
     "guid": "2f3a4b5c-6d7e-8f90-a1b2-c3d4e5f60718",

.github/workflows/ci-tests.yml

@@ -1,6 +1,7 @@
 # file: .github/workflows/ci-tests.yml
-# version: 1.2.0
+# version: 1.2.2
 # guid: ci-tests-workflow-2025-automation
+# last-edited: 2026-10-20
 
 name: CI Self Tests
 
@@ -143,19 +144,17 @@ jobs:
 
       - name: Lint scripts
         run: |
-          if command -v ruff >/dev/null 2>&1; then
-            ruff --version
-          else
-            pip install ruff
-          fi
+          # pinned: an unpinned ruff adds findings on its own release schedule
+          python -m pip install ruff==0.17.0
+          python -m ruff --version
           if command -v black >/dev/null 2>&1; then
             black --version
           else
             pip install black
           fi
           if find scripts -name "*.py" -o -path "tests/*.py" | head -1 | grep -q .; then
             black --check scripts tests || true
-            ruff check scripts tests || true
+            python -m ruff check scripts tests || true
           else
             echo "No Python sources detected for linting."
           fi

.github/workflows/reusable-ci.yml

@@ -1,7 +1,7 @@
 # file: .github/workflows/reusable-ci.yml
-# version: 1.18.0
+# version: 1.19.1
 # guid: reusable-ci-2025-09-24-core-workflow
-# last-edited: 2026-10-16
+# last-edited: 2026-10-20
 
 name: Reusable CI Workflow
 
@@ -23,6 +23,17 @@ on:
         required: false
         type: string
         default: '3.13'
+      ruff-version:
+        description: >-
+          Bare ruff version for the Python lint step, e.g. 0.17.0 (a leading v
+          is tolerated). Empty (default) uses RUFF_VERSION in ci_workflow.py.
+          Escape hatch for repos that format with a newer ruff. Takes effect
+          once the script ref this workflow checks out (ghcommon-ref.txt, or the
+          fallback pin) includes the commit that added the input; on an older
+          ref the value is ignored.
+        required: false
+        type: string
+        default: ''
       rust-version:
         description: 'Rust version to use'
         required: false
@@ -507,6 +518,9 @@ jobs:
           python-version: ${{ inputs.python-version }}
 
       - name: Lint Python workflow scripts
+        # TODO: this job pins ruff==0.16.10 separately from RUFF_VERSION in
+        # ci_workflow.py (0.17.0, used by the consumer Python lint). Unify the two
+        # pins so one bump moves both.
         run: |
           set -euo pipefail
           python -m pip install --upgrade pip
@@ -751,6 +765,8 @@ jobs:
 
       - name: Lint Python code
         if: ${{ !inputs.skip-linting }}
+        env:
+          RUFF_VERSION: ${{ inputs.ruff-version }}
         run: |
           python "$GHCOMMON_SCRIPTS_DIR/ci_workflow.py" python-lint