ci: bootstrap quality env without ensurepip

.gitea/workflows/ci-cd.yml

@@ -84,7 +84,7 @@ jobs:
       - name: Install Python and uv
         run: |
           set -euo pipefail
-          rm -rf .venv .ci-python-env
+          rm -rf .venv .ci-bin .ci-python-env
           CLEAN_PATH=""
           IFS=: read -r -a PATH_PARTS <<< "${PATH}"
           for path_part in "${PATH_PARTS[@]}"; do
@@ -108,6 +108,11 @@ jobs:
           "${PYTHON_BIN}" --version
 
           printf 'PYTHON_BIN=%s\n' "${PYTHON_BIN}" > .ci-python-env
+          mkdir -p .ci-bin
+          if ! curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | env UV_INSTALL_DIR="${PWD}/.ci-bin" sh; then
+            curl -LsSf "https://astral.sh/uv/install.sh" | env UV_INSTALL_DIR="${PWD}/.ci-bin" sh
+          fi
+          .ci-bin/uv --version
 
       - name: Create virtual environment and install dependencies
         run: |
@@ -119,14 +124,13 @@ jobs:
               exit 1
               ;;
           esac
-          "${PYTHON_BIN}" -m venv .venv
+          "${PYTHON_BIN}" -m venv --without-pip .venv
           . .venv/bin/activate
-          python -m pip install "uv==${UV_VERSION}"
-          uv sync \
+          .ci-bin/uv sync \
             --dev \
             --frozen \
             --active \
-            --python "${PYTHON_BIN}" \
+            --python "${PWD}/.venv/bin/python" \
             --no-managed-python \
             --no-python-downloads