From df9a566982ba343544aa87a1d40c2668f1c081c0 Mon Sep 17 00:00:00 2001
From: Wanderingss <1624155937@qq.com>
Date: Fri, 2 Oct 2026 01:29:55 +0800
Subject: [PATCH] =?UTF-8?q?CI=EF=BC=9A=E8=AF=8A=E6=96=AD=20pre-commit=20?=
 =?UTF-8?q?=E4=BB=85=E8=A3=85=E4=BA=8E=E7=94=A8=E6=88=B7=E6=80=81=E5=AF=BC?=
 =?UTF-8?q?=E8=87=B4=20SYSTEM=20=E4=B8=8D=E5=8F=AF=E8=A7=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

第五次运行（run#5）L0 仍失败，但错误信息已指向真因：
自检步骤 3 个候选解释器（msys64 / .venv / anaconda3）全部探测失败。

根因（已实测定位）：本机 pre-commit 装在
  C:\Users\Administrator\AppData\Roaming\Python\Python312\site-packages
即 Administrator 的【用户态 user-site】。runner 以 SYSTEM 运行，其
%APPDATA% = C:\Windows\system32\config\systemprofile\AppData\Roaming，
根本看不到该目录 → 换任何 python.exe 路径都无效。
（已盘点本机全部 python：anaconda3 3.12.4 / workbuddy 3.13.12 /
 msys64 3.14.5，以 -s 禁用 user-site 后 pre-commit 均为 rc=1。）

本次改动（workflow 侧，配合外部的全局安装）：
- 探测改用 `& $py -s -m pre_commit --version`（-s 禁用 user-site），
  只有 SYSTEM 真能用的解释器才被选中
- 后续 install / run 同步加 -s，保持判定一致
- 失败信息明确指向 user-site 不可见 + 给出修复脚本路径
  （install_precommit_global.ps1，装到 anaconda3 全局 site-packages）

真正的修复需管理员执行该脚本（本会话无提权权限，pip --no-user
报 WinError 5 拒绝访问）。装好后 L0 即可通过。
---
 .gitea/workflows/ci.yml | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index e19926a0..700b9c46 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -89,10 +89,16 @@ jobs:
           # no pre-commit). Probe the same order as scripts/ci_local.py:
           #   PATH python -> .venv -> anaconda3
           #
-          # CAUTION: a failing native command writes to stderr; with
+          # CAUTION 1: a failing native command writes to stderr; with
           # $ErrorActionPreference='Stop' that would abort the whole script
           # (NativeCommandError) before the next candidate is tried. So relax
           # the preference around each probe, and restore it afterwards.
+          #
+          # CAUTION 2: pre-commit may be installed in the USER site of some
+          # account (e.g. %APPDATA%\Roaming\Python\...), which SYSTEM cannot
+          # see at all -- no python.exe path can help then. Probe with `-s`
+          # (no user-site) so we only accept an interpreter that works for
+          # SYSTEM, and say so clearly when none is found.
           $candidates = @(
             (Get-Command python -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source),
             (Join-Path $repoRoot '.venv\Scripts\python.exe'),
@@ -104,19 +110,21 @@ jobs:
             if (-not $c) { continue }
             if (-not (Test-Path $c)) { continue }
             $ErrorActionPreference = 'Continue'
-            & $c -m pre_commit --version 2>&1 | Out-Null
+            & $c -s -m pre_commit --version 2>&1 | Out-Null
             $rc = $LASTEXITCODE
             $ErrorActionPreference = $saved
             if ($rc -eq 0) { $py = $c; break }
           }
           $ErrorActionPreference = 'Stop'
           if (-not $py) {
-            Write-Host "::error::no Python with pre-commit found. Tried: $($candidates -join ' | ')"
+            Write-Host "::error::no Python with a SYSTEM-visible pre-commit. Tried: $($candidates -join ' | ')"
+            Write-Host "::error::pre-commit is probably installed only in a USER site (invisible to SYSTEM)."
+            Write-Host "::error::fix (elevated): powershell -ExecutionPolicy Bypass -File D:\Docker\act_runner\install_precommit_global.ps1"
             exit 1
           }
           Write-Host "using python: $py"
           & $py --version
-          & $py -m pre_commit --version
+          & $py -s -m pre_commit --version
           "PYTHON=$py" | Out-File -FilePath $env:GITHUB_ENV -Append
 
           # --- cppcheck -----------------------------------------------------
@@ -140,7 +148,7 @@ jobs:
 
       - name: 安装 pre-commit 钩子到本仓库
         shell: powershell
-        run: "& $env:PYTHON -m pre_commit install --install-hooks"
+        run: "& $env:PYTHON -s -m pre_commit install --install-hooks"
 
       - name: 决定跳过哪些钩子（Keil 依赖）
         id: skip
@@ -163,7 +171,7 @@ jobs:
           SKIP: ${{ steps.skip.outputs.value }}
         run: |
           if ($env:SKIP) { Write-Host "SKIP=$env:SKIP" }
-          & $env:PYTHON -m pre_commit run --all-files --show-diff-on-failure
+          & $env:PYTHON -s -m pre_commit run --all-files --show-diff-on-failure
           if ($LASTEXITCODE -ne 0) {
             Write-Host "::error::L0 static gates failed (see output above)"
             exit $LASTEXITCODE