Use Python zipfile in build step (zip CLI not on runner)

.github/workflows/release.yml

@@ -22,25 +22,45 @@ jobs:
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
-          STAGE="dist/staging"
           OUT="dist/projects-portfolio-v${VERSION}.zip"
 
           rm -rf dist
-          mkdir -p "$STAGE/projects-portfolio"
+          mkdir -p dist
 
-          cp projects-portfolio.php "$STAGE/projects-portfolio/"
-          cp README.md             "$STAGE/projects-portfolio/"
-          cp LICENSE               "$STAGE/projects-portfolio/"
-          cp -r admin/             "$STAGE/projects-portfolio/"
-          cp -r assets/            "$STAGE/projects-portfolio/"
-          cp -r includes/          "$STAGE/projects-portfolio/"
-          cp -r languages/         "$STAGE/projects-portfolio/"
-          cp -r templates/         "$STAGE/projects-portfolio/"
+          # Use Python's stdlib zipfile module — guaranteed to be on ubuntu-latest.
+          python3 - "$OUT" <<'PYEOF'
+          import os
+          import sys
+          import zipfile
 
-          ( cd "$STAGE" && zip -r "../../$OUT" projects-portfolio )
+          out_path = sys.argv[1]
+          allowed = [
+              "projects-portfolio.php",
+              "README.md",
+              "LICENSE",
+              "admin",
+              "assets",
+              "includes",
+              "languages",
+              "templates",
+          ]
+
+          with zipfile.ZipFile(out_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
+              for entry in allowed:
+                  if os.path.isdir(entry):
+                      for root, _, files in os.walk(entry):
+                          for name in files:
+                              abs_path = os.path.join(root, name)
+                              arcname = os.path.join("projects-portfolio", abs_path)
+                              zf.write(abs_path, arcname)
+                  elif os.path.isfile(entry):
+                      zf.write(entry, os.path.join("projects-portfolio", entry))
+                  else:
+                      sys.exit(f"Allowlisted path missing: {entry}")
+          PYEOF
 
           echo "Built $OUT"
-          unzip -l "$OUT"
+          python3 -c "import zipfile; zf=zipfile.ZipFile('$OUT'); print('\n'.join(zf.namelist()))"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4