[stephen-kintsugi]

Summary

CI in this repo cannot install Poetry. Since Poetry moved its installer hosting on Nov 8, install.python-poetry.org returns a Cloudflare 403 (error 1010) to Python's urllib user agent, and snok/install-poetry v1.4.1 downloads the installer that way. This pins the action to v1.4.2, which downloads a pinned installer commit from raw.githubusercontent.com instead and never contacts that host.

• .github/actions/setup-python-poetry/action.yml: snok/install-poetry v1.4.1 to v1.4.2, pinned by commit SHA (a783c322, the v1.4.2 tag) with a # v1.4.2 comment.
• The action's inputs are identical between the two versions, and Poetry stays at 2.5.1.

Approve from: @kintsugi-tax/core-product

The same fix is green on kintsugi-tax/platform-client#65. The longer-term fix is one shared setup action for every Python repo (CP-6855).

Deferred findings (pre-existing, not changed by this PR):

• Dependabot will not keep this SHA current: the github-actions entry scans /, which does not include .github/actions/*. Tracked under CP-6855.
• ci.yml has no top-level permissions:, so jobs on main get the repo's default write token. Worth its own ticket.

Jira

CP-6852

Tests

• This PR's own CI runs the changed step: lint-and-test and all five test-matrix legs in ci.yml. A green run there is the proof.
• Full /pr-review (all five phases, plus audit-code-standards and audit-ci-pinning): no blockers, no findings on the changed line.
• Rollback is a revert of this one commit, but that returns to the broken v1.4.1.

Document Checklist

• No docs mention the action version or the installer URL.

🤖 Generated with Claude Code

---

Note

Low Risk
Single composite-action pin change with no app or secret-handling impact; only affects how CI installs Poetry.

Overview
Fixes CI Poetry installation by updating the composite setup-python-poetry step to use snok/install-poetry v1.4.2 (commit-pinned) instead of v1.4.1.

v1.4.1 pulls the installer from install.python-poetry.org, which now blocks Python’s default urllib user agent (Cloudflare 403). v1.4.2 uses a pinned installer fetched from raw.githubusercontent.com, so jobs that call ./.github/actions/setup-python-poetry can install Poetry again. Poetry 2.5.1 and the action inputs are unchanged.

^{Reviewed by Cursor Bugbot for commit 4730298. Bugbot is set up for automated code reviews on this repo. Configure here.}

[stephen-kintsugi]

/kin-review

[kin-review-bot]

Approving: one-line SHA-pinned CI action bump, Low risk, no findings.

• Blockers: 0
• Nits: 0

[kin-review-bot]

Decision record

review_event: APPROVE
would_have: null
blockers: 0
nits: 0
nits_dropped: 0
open_kept: 0
held_back: 0
head_sha: 4730298d2b2a15b50417f2fdbbbe772fbdfc95ff
base_sha: 9ceb299c02f44e83bb2f52dd440e1e0090c87efa
policy_ref: f968c5b1710a0c511787d63558668610616622a8
run_nonce: d6435ad0-e7f7-4115-9ffd-b2618b20f3ab
record_verdict: APPROVE
risk_level: Low
inline_comments: 0
reanchored: 0
pr_level: 0
audits_required: []
audits_missing: []
action_taken: approved
gates: []
evidence: 1 files, +1 / -1, reconciliation OK, removed names 0
ledger_mode: first_review
ledger_trust: dedicated
last_reviewed_commit: null
cleared_orphans: []
rationale: "One-line SHA-pin bump of snok/install-poetry in .github/actions/setup-python-poetry/action.yml. CI-only, fail-closed, no shared-resource load; both SHAs verified against upstream tags v1.4.1 and v1.4.2 via git ls-remote."

Agent review summary

Decision	Risk	Blockers	Nits
approved	Low	0	0

Why

• Risk: The diff swaps one pinned SHA on the Install Poetry step of the shared composite action. It affects CI only, fails loudly if wrong, and reverts with one line. Both the old and new SHAs were verified against their upstream tags.
• Blockers: None.
• Nits: None.
• Outcome: Every gate passed and the risk tier allows approval, so the run approved the PR at the recorded head.

What to do

1. Nothing. The approval is on 4730298.

Failed gates

Every gate passed.

Reviewed 9ceb299..4730298: 1 files, +1 / -1.