name: Setup Python env
description: >-
  Shared CI setup: provision uv (with cache) and install Python. Factored out
  of ci.yml so the pinned action SHAs and cache configuration live in one place
  instead of being copy-pasted per job. The caller MUST run actions/checkout
  first — a local composite action's files are only available after checkout.

inputs:
  python-version:
    description: Python version passed to actions/setup-python.
    required: false
    default: "3.12"

runs:
  using: composite
  steps:
    - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
      with:
        enable-cache: true
        prune-cache: true
        cache-dependency-glob: "**/uv.lock"

    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: ${{ inputs.python-version }}

    - name: Set SOURCE_DATE_EPOCH for deterministic LaTeX builds
      shell: bash
      run: |-
        epoch=$(git log -1 --format=%ct)
        echo "SOURCE_DATE_EPOCH=$epoch" >> "$GITHUB_ENV"
        echo "TZ=UTC" >> "$GITHUB_ENV"