Tweak handling of system to avoid need for sudo.

.github/workflows/app-build-verify.yml

@@ -111,10 +111,14 @@ jobs:
         path: ${{ steps.config.outputs.briefcase-data-dir }}
 
     - name: Set Up Python
-      if: ${{ inputs.python-version != 'system' }}
+      # On Linux, we can use the system python as-is. On macOS/Windows, install
+      # a Python that matches the version provided as a system default. This is
+      # to avoid issues with trying to install packages into homebrew's python
+      # without requiring sudo.
+      if: ${{ !startsWith(inputs.runner-os, 'ubuntu') || inputs.python-version != 'system' }}
       uses: actions/[email protected]
       with:
-        python-version: ${{ inputs.python-version }}
+        python-version: ${{ inputs.python-version == 'system' && steps.config.system-python-version || inputs.python-version }}
         allow-prereleases: true
         cache: pip
         cache-dependency-path: |

.github/workflows/app-create-verify.yml

@@ -47,6 +47,11 @@ jobs:
     runs-on: ${{ inputs.runner-os }}
     timeout-minutes: 30
     steps:
+    - name: Workflow Configuration
+      id: config
+      run: |
+        SYSTEM_PYTHON_VER=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
+        echo "system-python-version=${SYSTEM_PYTHON_VER}" | tee -a ${GITHUB_OUTPUT}
 
     - name: Checkout ${{ inputs.repository }}
       uses: actions/[email protected]
@@ -68,10 +73,10 @@ jobs:
         path: briefcase-template
 
     - name: Set up Python
-      if: ${{ inputs.python-version != 'system' }}
+      # Always set up a Python, so that dependencies can be installed without sudo access
       uses: actions/[email protected]
       with:
-        python-version: ${{ inputs.python-version }}
+        python-version: ${{ inputs.python-version == 'system' && steps.config.system-python-version || inputs.python-version }}
         cache: pip
         allow-prereleases: true
         cache-dependency-path: |