[sdk-sentinel-bot]

Caution

This PR contains untrusted AI-generated code. Do not approve or run CI until a maintainer has reviewed the diff. SDK Sentinel verified that GitHub Actions remained approval-gated with zero executable jobs when this PR was opened.

Summary

• CI evidence: failed CI job · workflow run · last known pass · first known failure

Stabilize the UI-port test after the [protobuf job](https://github.com/temporalio/sdk-python/actions/runs/40373283801/job/121749428608) and [FIPS job](https://github.com/temporalio/sdk-python/actions/runs/40375072508/job/121755786519) independently failed while launching its extra dev server. The [last successful workflow](https://github.com/temporalio/sdk-python/actions/runs/40365937356) preceded the [first failing workflow](https://github.com/temporalio/sdk-python/actions/runs/40373283801).

Root cause

Unlike the suite fixtures, this test requested the SDK-default server artifact. Clean runners therefore performed a separate mutable download, which first failed during archive extraction and later exceeded the test timeout during startup.

Fix

Select the repository’s pinned dev-server version in the UI-port test. This preserves the UI-port coverage while removing the extra default-version download and version variability.

Validation

poe test -s -k test_ui_port passed through the pinned cache path, and .ci-flake-runtime/input/validate.sh passed. The exact pinned artifact could not be fetched under the investigation’s network restriction, so the Linux protobuf and FIPS jobs remain required.

Validation status: ci-validation-required

• Flake confidence: high
• Fix confidence: high
• Value: high
• Patch scope: standard — 1 changed file; 557 B
• Local reproduction: not-reproduced — The focused test passed from the preloaded default cache. Recreating a fresh failed download was unavailable because non-loopback networking is prohibited.
• Regression coverage: pass-after-only — The existing focused test passed after selecting the pinned-version path; local setup used a compatible preloaded CLI because the exact pinned artifact was unavailable.
• Unchanged baseline (Poe lint, bridge lint, and editable build) — passed
• Independent candidate (Poe lint, bridge lint, and editable build) — passed

Investigator-run checks

• poe test -s -k test_ui_port — passed; 1 attempt(s). The unchanged test passed once from the preloaded SDK-default cache; natural reproduction did not occur.
• TMPDIR=/home/runner/work/sdk-sentinel/sdk-sentinel/target/.ci-flake-runtime/tmp poe test -s -k test_ui_port — passed; 1 attempt(s). The candidate passed through the pinned cache-name path using the preloaded compatible Temporal CLI.
• .ci-flake-runtime/input/validate.sh — passed; 1 attempt(s). Formatting, imports, type checks, docstyle, Rust clippy, and editable bridge build passed.

Required target CI

• check-protos on Linux/Python 3.10 with protobuf 3.x
• fips-build on Linux/Python 3.10

Residual risks

• Local validation used Temporal CLI 1.9.1 under the pinned cache filename rather than fetching the exact v1.8.3-server-1.32.0-162.0 artifact.
• The unrelated Windows timeout and ARM time-skipping cancellation remain unexplained.

Automation provenance

• Investigator workflow
• Base SHA: 01af1f6508c1880754501966c992d03fbfb112b7

If this finding should not be fixed, apply the sdk-sentinel:false-positive label and close the PR. Sentinel will suppress the finding until its affected source changes.

SDK Sentinel recurrence history

• Unique failed CI run attempts: 1
• First occurrence: 2026-10-26 18:06 UTC
• Latest occurrence: 2026-10-26 18:06 UTC
• Recent occurrences:
  • 2026-10-26 18:06 UTC — failed CI job