ci: bump Python to 3.10 and pin actions to SHA

[louiseschmidtgen]

Summary

Bump all Python version references from 3.8 to 3.10 across CI and update stale GitHub Action SHAs in the test-prep composite action.

Changes

• .github/workflows/build-installer.yml: python-version: 3.8 → "3.10", step name updated
• .github/actions/test-prep/action.yaml: setup-python v5 → v6.2.0 (a309ff8b), download-artifact v4 → v8 (3e5f45b2)
• pyproject.toml: black target-version py35 → py310
• installer/requirements.txt:
  • Removed dead pysha3==1.0.2; python_version < '3.6' conditional
  • Replaced cp38 PyYAML wheel URL with PyYAML==6.0.2 from PyPI

Not changed (already on 3.10):

• snap/snapcraft.yaml — already references python3.10, libpython3.10, etc.
• microk8s-resources/actions/common/utils.sh — already sets PYTHONPATH to python3.10
• tox.ini — uses basepython = python3 (resolves to system default)

Testing

• Verified all 31 external GitHub Actions remain SHA-pinned
• No unpinned tag/branch action references remain

Possible Regressions

The Windows installer build now uses Python 3.10 instead of 3.8. The pyinstaller spec and all dependencies in installer/requirements.txt are compatible with 3.10.

Checklist

• Read the contributions page.
• Submitted the CLA form, if you are a first time contributor.
• The introduced changes are covered by unit and/or integration tests.

Notes

CI-only changes — no runtime code modified.

[louiseschmidtgen]

Review: ci: bump Python to 3.10 and pin actions to SHA

Findings

🔴 Blockers

None

🟡 Warnings

1. Scope note: black formatter touched runtime files — The black upgrade (21.4b2 → 24.10.0) reformatted 3 installer Python files (file_utils.py, _multipass_command.py, errors.py) with trailing commas and whitespace changes. No logic changes, but the PR notes say "CI-only changes — no runtime code modified." Consider updating the notes section to mention the formatter-driven changes.

2. black version jump & click pin removal — tox.ini drops the click==7.1.2 pin that was likely a transitive dep of the old black. The new black doesn't need it pinned, but worth a quick sanity check.

3. .tox_env added to black exclude — tox.ini now excludes .tox_env in the black command. Looks correct (matches the envdir setting), just wasn't mentioned in the PR description.

🔵 Nits

1. SHA comment format inconsistency — setup-python uses # v6.2.0 (patch) while download-artifact uses # v8 (major only). Minor — both are valid, but a consistent convention would be nice.

2. PyYAML win32 conditional — PyYAML==6.0.2; sys_platform == 'win32' keeps the platform guard. Fine if PyYAML is only needed for the Windows installer build.

Summary

• 🔴 Blockers: 0
• 🟡 Warnings: 3
• 🔵 Nits: 2
• Verdict: APPROVE ✅

CI is green (formatting, unit tests, CLA all passing). Changes are correct and safe. The warnings are about PR description completeness, not code correctness.