fix(testing): harden script tooling checks

scripts/check-workflows.mjs

@@ -3,10 +3,12 @@
 // Uses installed tools when present, otherwise falls back to pinned hooks where
 // possible, then runs repo-specific workflow guards.
 import { spawnSync } from "node:child_process";
-import { readdirSync } from "node:fs";
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 const ACTIONLINT_VERSION = "1.7.11";
+const PRE_COMMIT_VERSION = "4.2.0";
 const WORKFLOW_DIR = ".github/workflows";
 
 function commandExists(command, args = ["--version"]) {
@@ -25,6 +27,59 @@ function run(command, args) {
   }
 }
 
+function runChecked(command, args) {
+  const result = spawnSync(command, args, { stdio: "inherit" });
+  if (result.error) {
+    return {
+      message: `[check-workflows] failed to run ${command}: ${result.error.message}`,
+      status: 1,
+    };
+  }
+  if (result.status !== 0) {
+    return {
+      message: null,
+      status: result.status ?? 1,
+    };
+  }
+  return null;
+}
+
+function runPreCommitFromTempVenv(hook, hookArgs) {
+  if (!commandExists("python3", ["--version"])) {
+    return false;
+  }
+  const venvDir = mkdtempSync(join(tmpdir(), "openclaw-check-workflows-pre-commit-"));
+  const python = join(venvDir, process.platform === "win32" ? "Scripts/python.exe" : "bin/python");
+  let failure;
+  try {
+    failure = runChecked("python3", ["-m", "venv", venvDir]);
+    if (!failure) {
+      failure = runChecked(python, [
+        "-m",
+        "pip",
+        "install",
+        "--disable-pip-version-check",
+        `pre-commit==${PRE_COMMIT_VERSION}`,
+      ]);
+    }
+    if (!failure) {
+      failure = runChecked(python, ["-m", "pre_commit", ...hookArgs]);
+    }
+    if (failure) {
+      return false;
+    }
+    return true;
+  } finally {
+    rmSync(venvDir, { force: true, recursive: true });
+    if (failure) {
+      if (failure.message) {
+        console.error(failure.message);
+      }
+      process.exit(failure.status);
+    }
+  }
+}
+
 function workflowFiles() {
   return readdirSync(WORKFLOW_DIR)
     .filter((file) => file.endsWith(".yml") || file.endsWith(".yaml"))
@@ -42,9 +97,12 @@ function runPreCommitHook(hook, files) {
     run("python3", ["-m", "pre_commit", ...hookArgs]);
     return;
   }
+  if (runPreCommitFromTempVenv(hook, hookArgs)) {
+    return;
+  }
 
   console.error(
-    `[check-workflows] missing pre-commit runtime for ${hook}: install pre-commit or python3 pre_commit.`,
+    `[check-workflows] missing pre-commit runtime for ${hook}: install pre-commit or Python venv support for pre-commit ${PRE_COMMIT_VERSION}.`,
   );
   process.exit(1);
 }
@@ -57,7 +115,8 @@ if (commandExists("actionlint")) {
   run("go", ["run", `github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION}`]);
 } else if (
   commandExists("pre-commit") ||
-  commandExists("python3", ["-m", "pre_commit", "--version"])
+  commandExists("python3", ["-m", "pre_commit", "--version"]) ||
+  commandExists("python3", ["--version"])
 ) {
   runPreCommitHook("actionlint", workflows);
 } else {

scripts/test-projects.test-support.mjs

@@ -2042,6 +2042,7 @@ function classifyTarget(arg, cwd) {
   }
   if (
     relative.startsWith("test/") ||
+    relative === "src/scripts" ||
     relative.startsWith("src/scripts/") ||
     relative === "src/config/doc-baseline.integration.test.ts" ||
     relative === "src/config/schema.base.generated.test.ts" ||