From c5d99fadf8859ee9ccc05ce5eb8a17025445dfd6 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Sun, 4 Jan 2026 23:15:26 -0600
Subject: [PATCH 01/15] [ci] ensure correct Python version is used in CI, other
 small CI fixes

---
 .github/workflows/manual-run.yml      |  7 ++-----
 .github/workflows/smoke-tests.yml     |  7 ++-----
 .github/workflows/static-analysis.yml |  9 +--------
 .github/workflows/unit-tests.yml      | 14 ++++++--------
 Makefile                              |  4 ----
 5 files changed, 11 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/manual-run.yml b/.github/workflows/manual-run.yml
index 5b33529..a74d4fe 100644
--- a/.github/workflows/manual-run.yml
+++ b/.github/workflows/manual-run.yml
@@ -41,11 +41,8 @@ jobs:
           sudo apt-get update -y
           sudo apt-get install -y \
             llvm
-          export PATH="/usr/share/miniconda/bin:${PATH}"
-          conda install \
-            --yes \
-            -c conda-forge \
-              pipx
+          python -m pip install \
+            pipx
           make install
           mkdir -p ./tmp-dir
           python bin/get-pypi-files.py\
diff --git a/.github/workflows/smoke-tests.yml b/.github/workflows/smoke-tests.yml
index fc927c6..8b16bca 100644
--- a/.github/workflows/smoke-tests.yml
+++ b/.github/workflows/smoke-tests.yml
@@ -48,10 +48,8 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - uses: conda-incubator/setup-miniconda@835234971496cad1653abb28a638a281cf32541f # v3.1.0
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
-          activate-environment: pydistcheck-tests
-          miniforge-version: latest
           python-version: ${{ matrix.python_version }}
       - name: Install extra tools on Linux
         if: startsWith(matrix.os, 'ubuntu')
@@ -62,8 +60,7 @@ jobs:
       - name: run tests
         shell: bash -l {0}
         run: |
-          conda install \
-            --yes \
+          python -m pip install \
               pipx \
               requests
           make install
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 78a2a18..ecdc9e4 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -34,11 +34,4 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - name: run linting
-        run: |
-          export PATH="/usr/share/miniconda/bin:${PATH}"
-          conda install \
-            --yes \
-            -c conda-forge \
-              pre-commit
-          make lint
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd #v3.0.1
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index a372179..6343825 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -70,11 +70,9 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - uses: conda-incubator/setup-miniconda@835234971496cad1653abb28a638a281cf32541f # v3.1.0
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
-          activate-environment: pydistcheck-tests
-          miniforge-version: latest
-          python-version: ${{ matrix.python_version }}
+          python-version: '${{ matrix.python_version }}'
       - name: Install extra tools on Linux
         if: startsWith(matrix.os, 'ubuntu')
         run: |
@@ -116,9 +114,9 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
-          python-version: 'pypy${{ matrix.python_version}}'
+          python-version: 'pypy${{ matrix.python_version }}'
       - name: Install extra tools on Linux
         if: startsWith(matrix.os, 'ubuntu')
         run: |
@@ -156,9 +154,9 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
-          python-version: "${{ matrix.python_version}}"
+          python-version: "${{ matrix.python_version }}"
       - name: run tests
         run: |
           bin/check-test-packages.sh ${GITHUB_WORKSPACE}/tests/data
diff --git a/Makefile b/Makefile
index 91ac84e..58c7ae0 100644
--- a/Makefile
+++ b/Makefile
@@ -35,10 +35,6 @@ clean:
 install:
 	pipx install --force '.[conda]'
 
-.PHONY: lint
-lint:
-	pre-commit run --all-files
-
 .PHONY: linux-wheel
 linux-wheel:
 	docker run \

From 55b72a4d58a94f6e1f2e2156c27682de1e2651eb Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 21:45:11 -0600
Subject: [PATCH 02/15] where is Python

---
 .github/workflows/unit-tests.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 6343825..db01204 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -73,6 +73,12 @@ jobs:
       - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: '${{ matrix.python_version }}'
+      - name: check that correct Python version is used
+        run: |
+          which python
+          python --version
+          which python3
+          python3 --version
       - name: Install extra tools on Linux
         if: startsWith(matrix.os, 'ubuntu')
         run: |

From 6312c2502e8f3f8ab89eb5fb9767a933fa79ef16 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 21:51:45 -0600
Subject: [PATCH 03/15] use correct version

---
 .github/workflows/check-docs.yml |  2 +-
 .github/workflows/unit-tests.yml | 10 ++++++----
 .readthedocs.yaml                |  2 +-
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/check-docs.yml b/.github/workflows/check-docs.yml
index b9071b8..55d3fe0 100644
--- a/.github/workflows/check-docs.yml
+++ b/.github/workflows/check-docs.yml
@@ -42,7 +42,7 @@ jobs:
       - name: build docs
         shell: bash -l {0}
         run: |
-          pip install .
+          python -m pip install .
           make -C ./docs html
           python -m sphinx -b linkcheck -D linkcheck_timeout=5 --fail-on-warning ./docs ./linkcheck_output
   check-links:
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index db01204..d02d33c 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -75,6 +75,8 @@ jobs:
           python-version: '${{ matrix.python_version }}'
       - name: check that correct Python version is used
         run: |
+          which pip
+          pip --version
           which python
           python --version
           which python3
@@ -92,12 +94,12 @@ jobs:
       - name: build and check dists
         shell: bash -l {0}
         run: |
-          pip install -r ./requirements-tests.txt || exit 1
+          python -m pip install -r ./requirements-tests.txt || exit 1
           make build check-dists
       - name: install
         shell: bash -l {0}
         run: |
-          pip install dist/*.whl
+          python -m pip install dist/*.whl
       - name: test
         shell: bash -l {0}
         run: |
@@ -132,12 +134,12 @@ jobs:
       - name: build and check dists
         shell: bash -l {0}
         run: |
-          pip install -r ./requirements-tests.txt
+          python -m pip install -r ./requirements-tests.txt
           make build check-dists
       - name: install
         shell: bash -l {0}
         run: |
-          pip install dist/*.whl
+          python -m pip install dist/*.whl
       - name: test
         shell: bash -l {0}
         run: |
diff --git a/.readthedocs.yaml b/.readthedocs.yaml
index 26514f6..bfbb265 100644
--- a/.readthedocs.yaml
+++ b/.readthedocs.yaml
@@ -8,7 +8,7 @@ build:
     pre_build:
       - python -m sphinx -b linkcheck -D linkcheck_timeout=5 --fail-on-warning ./docs/ ./linkcheck_output
     post_create_environment:
-      - pip install .
+      - python -m pip install .
 conda:
   environment: docs/env.yml
 formats:

From 746fb4d86cc748a3834e3b93c7ab5913ce7ecf91 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 22:07:51 -0600
Subject: [PATCH 04/15] more logs

---
 .github/workflows/unit-tests.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index d02d33c..41baeba 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -94,12 +94,12 @@ jobs:
       - name: build and check dists
         shell: bash -l {0}
         run: |
-          python -m pip install -r ./requirements-tests.txt || exit 1
+          python -m pip -vv install -r ./requirements-tests.txt || exit 1
           make build check-dists
       - name: install
         shell: bash -l {0}
         run: |
-          python -m pip install dist/*.whl
+          python -m pip install -v dist/*.whl
       - name: test
         shell: bash -l {0}
         run: |

From 50df4f1ada9b165e8211d2fbf029cad7b8c7d778 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 22:15:00 -0600
Subject: [PATCH 05/15] check PATH

---
 .github/workflows/unit-tests.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 41baeba..5ebc2de 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -99,6 +99,12 @@ jobs:
       - name: install
         shell: bash -l {0}
         run: |
+          echo "--- PATH ---"
+          echo "${PATH}"
+          echo "--- which pip ---"
+          which pip
+          echo "--- which python ---"
+          which python
           python -m pip install -v dist/*.whl
       - name: test
         shell: bash -l {0}

From ce5a86cc553b24288083cc1e878773fc0de9bb1e Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 22:31:15 -0600
Subject: [PATCH 06/15] what is modifying PATH

---
 .github/workflows/unit-tests.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 5ebc2de..a3912b2 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -70,9 +70,15 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
+      - name: PATH before setup-python
+        run:
+          echo "${PATH}"
       - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: '${{ matrix.python_version }}'
+      - name: PATH after setup-python
+        run:
+          echo "${PATH}"
       - name: check that correct Python version is used
         run: |
           which pip
@@ -91,11 +97,17 @@ jobs:
         if: startsWith(matrix.os, 'windows')
         run: |
           choco install zip
+      - name: PATH before first pipx invocation
+        run: |
+          echo "${PATH}"
       - name: build and check dists
         shell: bash -l {0}
         run: |
-          python -m pip -vv install -r ./requirements-tests.txt || exit 1
+          python -m pip -v install -r ./requirements-tests.txt || exit 1
           make build check-dists
+      - name: PATH after first pipx invocation
+        run: |
+          echo "${PATH}"
       - name: install
         shell: bash -l {0}
         run: |

From c1ee1767818a877ab5d1dd177bb83216ff2c4378 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 22:45:21 -0600
Subject: [PATCH 07/15] stop using login shell

---
 .github/workflows/check-docs.yml  |  2 +-
 .github/workflows/smoke-tests.yml |  2 +-
 .github/workflows/unit-tests.yml  | 12 ++++++------
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/check-docs.yml b/.github/workflows/check-docs.yml
index 55d3fe0..23cd45f 100644
--- a/.github/workflows/check-docs.yml
+++ b/.github/workflows/check-docs.yml
@@ -40,7 +40,7 @@ jobs:
           activate-environment: pydistcheck-docs
           miniforge-version: latest
       - name: build docs
-        shell: bash -l {0}
+        shell: bash
         run: |
           python -m pip install .
           make -C ./docs html
diff --git a/.github/workflows/smoke-tests.yml b/.github/workflows/smoke-tests.yml
index 8b16bca..746fa8c 100644
--- a/.github/workflows/smoke-tests.yml
+++ b/.github/workflows/smoke-tests.yml
@@ -58,7 +58,7 @@ jobs:
           sudo apt-get install -y \
             llvm
       - name: run tests
-        shell: bash -l {0}
+        shell: bash
         run: |
           python -m pip install \
               pipx \
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index a3912b2..38713ae 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -101,7 +101,7 @@ jobs:
         run: |
           echo "${PATH}"
       - name: build and check dists
-        shell: bash -l {0}
+        shell: bash
         run: |
           python -m pip -v install -r ./requirements-tests.txt || exit 1
           make build check-dists
@@ -109,7 +109,7 @@ jobs:
         run: |
           echo "${PATH}"
       - name: install
-        shell: bash -l {0}
+        shell: bash
         run: |
           echo "--- PATH ---"
           echo "${PATH}"
@@ -119,7 +119,7 @@ jobs:
           which python
           python -m pip install -v dist/*.whl
       - name: test
-        shell: bash -l {0}
+        shell: bash
         run: |
           make test
   test-pypy:
@@ -150,16 +150,16 @@ jobs:
           sudo apt-get install -y \
             llvm
       - name: build and check dists
-        shell: bash -l {0}
+        shell: bash
         run: |
           python -m pip install -r ./requirements-tests.txt
           make build check-dists
       - name: install
-        shell: bash -l {0}
+        shell: bash
         run: |
           python -m pip install dist/*.whl
       - name: test
-        shell: bash -l {0}
+        shell: bash
         run: |
           make test
   check-test-packages:

From c059392179b62f890c8af40bf0cfbf4b868315c6 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 23:21:41 -0600
Subject: [PATCH 08/15] fix Python 3.19-3.11 compatibility

---
 src/pydistcheck/_compat.py     | 17 +++++++++
 src/pydistcheck/_file_utils.py | 64 ++++++++++++++++++++++++----------
 2 files changed, 63 insertions(+), 18 deletions(-)

diff --git a/src/pydistcheck/_compat.py b/src/pydistcheck/_compat.py
index 6863f77..99b01bd 100644
--- a/src/pydistcheck/_compat.py
+++ b/src/pydistcheck/_compat.py
@@ -3,6 +3,9 @@
 with a wide range of dependency versions.
 """
 
+import re
+import sysconfig
+from functools import lru_cache
 from typing import Any
 
 try:  # pragma: no cover
@@ -11,6 +14,20 @@
     import tomli as tomllib  # type: ignore[no-redef]
 
 
+@lru_cache
+def _py_major_minor() -> tuple[int, int]:
+    python_major, python_minor, *_ = sysconfig.get_python_version().split(".")
+    # handle versions like '3.15t'
+    python_minor = re.sub("[^0-9.]+", "", python_minor)
+    return int(python_major), int(python_minor)
+
+
+@lru_cache
+def _py_gt_312() -> bool:
+    python_major, python_minor = _py_major_minor()
+    return python_major >= 3 and python_minor >= 12
+
+
 def _import_zstandard() -> Any:  # pragma: no cover
     try:
         import zstandard  # noqa: PLC0415
diff --git a/src/pydistcheck/_file_utils.py b/src/pydistcheck/_file_utils.py
index 7fc3f34..ed007c7 100644
--- a/src/pydistcheck/_file_utils.py
+++ b/src/pydistcheck/_file_utils.py
@@ -5,7 +5,7 @@
 from dataclasses import dataclass
 from typing import Union
 
-from ._compat import _import_zstandard
+from ._compat import _import_zstandard, _py_gt_312
 
 
 @dataclass
@@ -171,8 +171,12 @@ def _decompress_zstd_archive(
                 decompressor.copy_stream(compressed, destination)
 
 
-def _extract_subset_of_files_from_archive(
-    *, archive_file: str, archive_format: str, relative_paths: list[str], out_dir: str
+def _extract_subset_of_files_from_archive(  # noqa: PLR0912
+    *,
+    archive_file: str,
+    archive_format: str,
+    relative_paths: list[str],
+    out_dir: str,
 ) -> None:
     """
     Extract a subset of files from an archive to a destination directory.
@@ -184,18 +188,34 @@ def _extract_subset_of_files_from_archive(
             zf.extractall(path=out_dir, members=relative_paths)
     elif archive_format == _ArchiveFormat.BZIP2_TAR:
         with tarfile.open(archive_file, mode="r:bz2") as tf:
-            tf.extractall(
-                path=out_dir,
-                members=[tf.getmember(p) for p in relative_paths],
-                filter="data",
-            )
+            # passing filter="data" to tarfile.extractall() makes it more secure, but
+            # that option wasn't available prior to Python 3.12
+            if _py_gt_312():
+                tf.extractall(
+                    path=out_dir,
+                    members=[tf.getmember(p) for p in relative_paths],
+                    filter="data",
+                )
+            else:
+                tf.extractall(
+                    path=out_dir,
+                    members=[tf.getmember(p) for p in relative_paths],
+                )
     elif archive_format == _ArchiveFormat.GZIP_TAR:
         with tarfile.open(archive_file, mode="r:gz") as tf:
-            tf.extractall(
-                path=out_dir,
-                members=[tf.getmember(p) for p in relative_paths],
-                filter="data",
-            )
+            # passing filter="data" to tarfile.extractall() makes it more secure, but
+            # that option wasn't available prior to Python 3.12
+            if _py_gt_312():
+                tf.extractall(
+                    path=out_dir,
+                    members=[tf.getmember(p) for p in relative_paths],
+                    filter="data",
+                )
+            else:
+                tf.extractall(
+                    path=out_dir,
+                    members=[tf.getmember(p) for p in relative_paths],
+                )
     elif archive_format == _ArchiveFormat.CONDA:
         inner_tar_zst_files = []
         # extract any files at the outer ZIP level,
@@ -231,8 +251,16 @@ def _extract_subset_of_files_from_archive(
                     for tar_info in tf.getmembers()
                     if tar_info.name in relative_paths
                 ]
-                tf.extractall(
-                    path=out_dir,
-                    members=files_to_extract,
-                    filter="data",
-                )
+                # passing filter="data" to tarfile.extractall() makes it more secure, but
+                # that option wasn't available prior to Python 3.12
+                if _py_gt_312():
+                    tf.extractall(
+                        path=out_dir,
+                        members=files_to_extract,
+                        filter="data",
+                    )
+                else:
+                    tf.extractall(
+                        path=out_dir,
+                        members=files_to_extract,
+                    )

From de78fe25be8ac04328cf411b002b99d226e1c9de Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 23:34:42 -0600
Subject: [PATCH 09/15] fix patch

---
 src/pydistcheck/_compat.py     | 26 +++++++++++++++-----------
 src/pydistcheck/_file_utils.py | 14 ++++----------
 2 files changed, 19 insertions(+), 21 deletions(-)

diff --git a/src/pydistcheck/_compat.py b/src/pydistcheck/_compat.py
index 99b01bd..fd391b2 100644
--- a/src/pydistcheck/_compat.py
+++ b/src/pydistcheck/_compat.py
@@ -3,8 +3,6 @@
 with a wide range of dependency versions.
 """
 
-import re
-import sysconfig
 from functools import lru_cache
 from typing import Any
 
@@ -15,17 +13,23 @@
 
 
 @lru_cache
-def _py_major_minor() -> tuple[int, int]:
-    python_major, python_minor, *_ = sysconfig.get_python_version().split(".")
-    # handle versions like '3.15t'
-    python_minor = re.sub("[^0-9.]+", "", python_minor)
-    return int(python_major), int(python_minor)
+def _tf_extractall_has_filter() -> bool:
+    """
+    tarfile.TarFile.extractall() picked up a new argument ``filter`` in Python 3.12,
+    to make extraction more secure.
 
+    That was backported all the way back to Python 3.8 (https://github.com/python/cpython/issues/102950),
+    but this function exists to account for older patch versions without the backport.
 
-@lru_cache
-def _py_gt_312() -> bool:
-    python_major, python_minor = _py_major_minor()
-    return python_major >= 3 and python_minor >= 12
+    On GitHub Actions, for example, 'actions/setup-python' seems to set up
+    Python 3.9.13 for CPython on Windows and the backport was in 3.9.17 (https://github.com/python/cpython/pull/104382).
+
+    This can be removed when the oldest support Python here is at least 3.12.
+    """
+    import inspect  # noqa: PLC0415
+    import tarfile  # noqa: PLC0415
+
+    return "filter" in inspect.signature(tarfile.TarFile.extractall).parameters
 
 
 def _import_zstandard() -> Any:  # pragma: no cover
diff --git a/src/pydistcheck/_file_utils.py b/src/pydistcheck/_file_utils.py
index ed007c7..dbaad0d 100644
--- a/src/pydistcheck/_file_utils.py
+++ b/src/pydistcheck/_file_utils.py
@@ -5,7 +5,7 @@
 from dataclasses import dataclass
 from typing import Union
 
-from ._compat import _import_zstandard, _py_gt_312
+from ._compat import _import_zstandard, _tf_extractall_has_filter
 
 
 @dataclass
@@ -188,9 +188,7 @@ def _extract_subset_of_files_from_archive(  # noqa: PLR0912
             zf.extractall(path=out_dir, members=relative_paths)
     elif archive_format == _ArchiveFormat.BZIP2_TAR:
         with tarfile.open(archive_file, mode="r:bz2") as tf:
-            # passing filter="data" to tarfile.extractall() makes it more secure, but
-            # that option wasn't available prior to Python 3.12
-            if _py_gt_312():
+            if _tf_extractall_has_filter():
                 tf.extractall(
                     path=out_dir,
                     members=[tf.getmember(p) for p in relative_paths],
@@ -203,9 +201,7 @@ def _extract_subset_of_files_from_archive(  # noqa: PLR0912
                 )
     elif archive_format == _ArchiveFormat.GZIP_TAR:
         with tarfile.open(archive_file, mode="r:gz") as tf:
-            # passing filter="data" to tarfile.extractall() makes it more secure, but
-            # that option wasn't available prior to Python 3.12
-            if _py_gt_312():
+            if _tf_extractall_has_filter():
                 tf.extractall(
                     path=out_dir,
                     members=[tf.getmember(p) for p in relative_paths],
@@ -251,9 +247,7 @@ def _extract_subset_of_files_from_archive(  # noqa: PLR0912
                     for tar_info in tf.getmembers()
                     if tar_info.name in relative_paths
                 ]
-                # passing filter="data" to tarfile.extractall() makes it more secure, but
-                # that option wasn't available prior to Python 3.12
-                if _py_gt_312():
+                if _tf_extractall_has_filter():
                     tf.extractall(
                         path=out_dir,
                         members=files_to_extract,

From 47974e9e824d40b5f245a1df6e8aa6f5675bd474 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 23:38:16 -0600
Subject: [PATCH 10/15] add a test

---
 tests/test_compat.py | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/tests/test_compat.py b/tests/test_compat.py
index bc46146..c66d302 100644
--- a/tests/test_compat.py
+++ b/tests/test_compat.py
@@ -1,9 +1,11 @@
+import re
 import sys
+import sysconfig
 from unittest import mock
 
 import pytest
 
-from pydistcheck._compat import _import_zstandard
+from pydistcheck._compat import _import_zstandard, _tf_extractall_has_filter
 
 
 def test_import_zstandard_raises_informative_error_if_it_isnt_found():
@@ -15,3 +17,14 @@ def test_import_zstandard_raises_informative_error_if_it_isnt_found():
             match="Checking zstd-compressed files requires the 'zstandard' library",
         ):
             _import_zstandard()
+
+
+def test_extractall_has_filter_works():
+    python_major, python_minor, *_ = sysconfig.get_python_version()
+    # handle versions with letters, like '3.13t'
+    python_minor = re.sub(r"[^0-9.]", "", python_minor)
+    res = _tf_extractall_has_filter()
+    if int(python_major) >= 3 and int(python_minor) >= 12:
+        assert res is True
+    else:
+        assert isinstance(res, bool)

From daecaa50785082203be54ffa9f0da43ff8cf1224 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Tue, 6 Jan 2026 23:44:07 -0600
Subject: [PATCH 11/15] fix tests

---
 tests/test_compat.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_compat.py b/tests/test_compat.py
index c66d302..ceb00c6 100644
--- a/tests/test_compat.py
+++ b/tests/test_compat.py
@@ -20,7 +20,7 @@ def test_import_zstandard_raises_informative_error_if_it_isnt_found():
 
 
 def test_extractall_has_filter_works():
-    python_major, python_minor, *_ = sysconfig.get_python_version()
+    python_major, python_minor, *_ = sysconfig.get_python_version().split(".")
     # handle versions with letters, like '3.13t'
     python_minor = re.sub(r"[^0-9.]", "", python_minor)
     res = _tf_extractall_has_filter()

From d901fd92335508559aee66746ce67bec48380de0 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Fri, 9 Jan 2026 21:52:43 -0600
Subject: [PATCH 12/15] activate environment

---
 .github/workflows/check-docs.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/check-docs.yml b/.github/workflows/check-docs.yml
index 23cd45f..a927406 100644
--- a/.github/workflows/check-docs.yml
+++ b/.github/workflows/check-docs.yml
@@ -42,6 +42,7 @@ jobs:
       - name: build docs
         shell: bash
         run: |
+          source activate pydistcheck-docs
           python -m pip install .
           make -C ./docs html
           python -m sphinx -b linkcheck -D linkcheck_timeout=5 --fail-on-warning ./docs ./linkcheck_output

From a22854f8c80b1172abcb436aa6614892fcca0d06 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Fri, 9 Jan 2026 21:58:05 -0600
Subject: [PATCH 13/15] docs might need a login shell

---
 .github/workflows/check-docs.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check-docs.yml b/.github/workflows/check-docs.yml
index a927406..3dcf62d 100644
--- a/.github/workflows/check-docs.yml
+++ b/.github/workflows/check-docs.yml
@@ -40,7 +40,7 @@ jobs:
           activate-environment: pydistcheck-docs
           miniforge-version: latest
       - name: build docs
-        shell: bash
+        shell: bash -l {0}
         run: |
           source activate pydistcheck-docs
           python -m pip install .

From 31378cf5654833d10261b73941b54ee701005c66 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Fri, 9 Jan 2026 22:03:10 -0600
Subject: [PATCH 14/15] just do not touch check-docs

---
 .github/workflows/check-docs.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/check-docs.yml b/.github/workflows/check-docs.yml
index 3dcf62d..b9071b8 100644
--- a/.github/workflows/check-docs.yml
+++ b/.github/workflows/check-docs.yml
@@ -42,8 +42,7 @@ jobs:
       - name: build docs
         shell: bash -l {0}
         run: |
-          source activate pydistcheck-docs
-          python -m pip install .
+          pip install .
           make -C ./docs html
           python -m sphinx -b linkcheck -D linkcheck_timeout=5 --fail-on-warning ./docs ./linkcheck_output
   check-links:

From 56b0bc96974d2b09947cc79d1ced3e42cfdb1fe6 Mon Sep 17 00:00:00 2001
From: James Lamb <jaylamb20@gmail.com>
Date: Fri, 9 Jan 2026 22:13:31 -0600
Subject: [PATCH 15/15] 'remove debugging stuff

---
 .github/workflows/unit-tests.yml | 26 --------------------------
 1 file changed, 26 deletions(-)

diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 38713ae..b5a7e10 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -70,23 +70,9 @@ jobs:
         with:
           fetch-depth: 1
           persist-credentials: false
-      - name: PATH before setup-python
-        run:
-          echo "${PATH}"
       - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: '${{ matrix.python_version }}'
-      - name: PATH after setup-python
-        run:
-          echo "${PATH}"
-      - name: check that correct Python version is used
-        run: |
-          which pip
-          pip --version
-          which python
-          python --version
-          which python3
-          python3 --version
       - name: Install extra tools on Linux
         if: startsWith(matrix.os, 'ubuntu')
         run: |
@@ -97,26 +83,14 @@ jobs:
         if: startsWith(matrix.os, 'windows')
         run: |
           choco install zip
-      - name: PATH before first pipx invocation
-        run: |
-          echo "${PATH}"
       - name: build and check dists
         shell: bash
         run: |
           python -m pip -v install -r ./requirements-tests.txt || exit 1
           make build check-dists
-      - name: PATH after first pipx invocation
-        run: |
-          echo "${PATH}"
       - name: install
         shell: bash
         run: |
-          echo "--- PATH ---"
-          echo "${PATH}"
-          echo "--- which pip ---"
-          which pip
-          echo "--- which python ---"
-          which python
           python -m pip install -v dist/*.whl
       - name: test
         shell: bash