Install pyyaml in action composite for host Python orchestration

[jwbron]

Summary

• Pin host Python to 3.14 in action composite #2279 added actions/setup-python@v5 to pin host Python to 3.14, but setup-python provides a clean interpreter with no project deps. The orchestration command python3 -c "from egg_lib.gha_exec import gha_exec; ..." transitively imports shared/egg_config/config.py, which import yamls and exits with Error: PyYAML is required. Observed on PR Fix #2242: alive-signal gate on heartbeat/progress alerts; plan-phase post-ACK threshold #2268's egg-reviewer-review job (run).
• Add a minimal pip install pyyaml step after setup-python in action/action.yml. PyYAML is the only non-stdlib dep on the gha_exec → egg_config import path (verified by walking imports across sandbox/egg_lib/*.py and shared/egg_config/*.py), so this is tighter than the uv sync --extra dev pattern used in test/lint workflows.

Test plan

• Re-run the failing egg-reviewer-review job on PR Fix #2242: alive-signal gate on heartbeat/progress alerts; plan-phase post-ACK threshold #2268 (or push a new commit to it) once this lands and confirm it gets past === Step 3: Python orchestration === without the PyYAML error.
• Spot-check that other action invocations (autofixer, conflict, doc-updater, etc.) still succeed — they share the same composite.

[egg-reviewer]

No agent-mode design concerns. This is a CI infrastructure fix (installing PyYAML for host Python orchestration in the composite action) that doesn't touch agent prompts, tool surface, or sandbox boundaries.

— Authored by egg

[egg-reviewer]

Review

The fix is correct and the scope is right. I traced the import chain to confirm the PR's claim before approving the approach.

Verification of PR claim

I reproduced the bug locally and confirmed PyYAML is the only third-party dep on the from egg_lib.gha_exec import gha_exec path:

$ PYTHONPATH=sandbox:shared python3 -c "import sys; from egg_lib.gha_exec import gha_exec; ..."
Top-level non-stdlib modules: yaml

Concrete chain:

• egg_lib.gha_exec → egg_lib.runtime → egg_container → from egg_config import GATEWAY_PROXY_PORT → egg_config/__init__.py → from .config import Config, get_local_repos, ... → shared/egg_config/config.py:11–15 (the try: import yaml / except ImportError: sys.exit(1) block).
• Independently, egg_lib.runtime also pulls in egg_lib.docker (docker.py:19 import yaml) and egg_lib.gateway (gateway.py:23 import yaml) at module top, so even removing the egg_config sys.exit would still require yaml.

So pip install pyyaml is the minimum viable fix. The choice to install one package rather than uv sync or a full requirements file is defensible — the import surface here is tiny and only depends on PyYAML.

Non-blocking observations

1. Unpinned version. pip install pyyaml resolves to whatever the latest is at run time. PyYAML has been stable for years and PyYAML 6.0.3 added Python 3.14 wheels (which is what setup-python@v5 with python-version: "3.14" will pick up), so this is unlikely to bite, but a defensive pyyaml>=6,<7 would protect the composite from a future breaking release without much cost. Optional.

2. No pip cache. Every action invocation re-downloads PyYAML. The wheel is small (~700KB), so the latency is negligible — but actions/setup-python supports cache: pip with a requirements.txt-style file. Not worth the bookkeeping for a single dep; flagging only for completeness.

3. shared/egg_config/config.py:11–15 does sys.exit(1) at import time when yaml is missing. That's an aggressive failure mode for a library module and it's why the composite saw Error: PyYAML is required rather than a normal ModuleNotFoundError. Out of scope for this PR, but worth noting: a library module shouldn't sys.exit on import — it should let the ImportError propagate so callers can catch it. A future cleanup.

4. No automated test added. The test plan is manual. That's reasonable for an action composite step that only runs in GHA — there isn't a clean unit-test surface for "did pip install succeed in a real GHA runner." Calling it out for awareness, not as a blocker.

Verdict

Self-authored PR (already merged), commenting only. No blocking issues. The fix is correct, minimal, and the import-path analysis in the PR description is accurate.

— Authored by egg

[james-in-a-box]

egg review completed. View run logs

1 previous review(s) hidden.