From 8a9bd9ef61b75d7cfe424f1f6af74db7655513d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Mon, 9 Nov 2026 21:25:33 -0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20fix(install-locked-tools):=20Win?=
 =?UTF-8?q?dows=20lock=20reader?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 changelog.d/+windows-lock-reader.bugfix.md | 2 ++
 install-locked-tools/action.yml            | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/+windows-lock-reader.bugfix.md

diff --git a/changelog.d/+windows-lock-reader.bugfix.md b/changelog.d/+windows-lock-reader.bugfix.md
new file mode 100644
index 0000000..626cf30
--- /dev/null
+++ b/changelog.d/+windows-lock-reader.bugfix.md
@@ -0,0 +1,2 @@
+`install-locked-tools` installs the lock reader on Windows again: it ran the installer from the lock reader's own
+interpreter, and Windows refused to replace that running `python.exe` when the installer recreated the environment.
diff --git a/install-locked-tools/action.yml b/install-locked-tools/action.yml
index fb7bc7f..0f7738a 100644
--- a/install-locked-tools/action.yml
+++ b/install-locked-tools/action.yml
@@ -37,8 +37,9 @@ runs:
       env:
         EXCLUDE_NEWER: ${{ inputs.exclude-newer }}
         EXCLUDE_NEWER_PACKAGE: ${{ inputs.exclude-newer-package }}
+      # The script recreates lock-reader, and Windows refuses to replace the python.exe it would be running from.
       run: >-
-        uv run --no-project --python "$RUNNER_TEMP/lock-reader" python "$GITHUB_ACTION_PATH/../tools/install_live_tools.py" "$RUNNER_TEMP/lock-reader" --only-binary :all: 'certifi>=2026.7.22' 'packaging>=26.3'
+        uv run --no-project --python 3.15 python "$GITHUB_ACTION_PATH/../tools/install_live_tools.py" "$RUNNER_TEMP/lock-reader" --only-binary :all: 'certifi>=2026.7.22' 'packaging>=26.3'
     - id: selection
       name: ⚙️ Select locked groups and build constraints
       shell: bash