self-test: Install sigstore in separate virtualenv

This prevents sigstore dependencies from being accidentally
used by the test suite.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

.github/workflows/conformance.yml

@@ -28,12 +28,21 @@ jobs:
           cache: "pip"
 
       - name: install sigstore-python
-        run: pip install "sigstore >= 3.5.0, < 4.0"
+        run: |
+          python3 -m venv sigstore-env
+          ./sigstore-env/bin/python -m pip install "sigstore >= 3.5.0, < 4.0"
+
+          cat <<EOF > ./sigstore-env/bin/conformance
+          #!/bin/sh
+          $PWD/sigstore-env/bin/python $PWD/sigstore-python-conformance "$@"
+          EOF
+
+          chmod +x ./sigstore-env/bin/conformance
 
       - name: conformance test sigstore-python
         uses: ./
         with:
-          entrypoint: ${{ github.workspace }}/sigstore-python-conformance
+          entrypoint: ./sigstore-env/bin/conformance
           skip-cpython-release-tests: ${{ matrix.skip-cpython-release-tests }}
           environment: ${{ matrix.sigstore-env }}
           xfail: "test_verify_with_trust_root test_verify_dsse_bundle_with_trust_root"