[pull] main from Alishahryar1:main

.github/actions/ci-environment/action.yml

@@ -0,0 +1,144 @@
+name: CI environment
+description: Restore managed Python and uv dependencies using the same cache identity on every runner.
+
+inputs:
+  uv-version:
+    description: Pinned uv version
+    required: true
+  runner-label:
+    description: GitHub runner image label
+    required: true
+  lookup-only:
+    description: Check dependency cache availability without downloading it
+    default: "false"
+  prepare-node:
+    description: Prepare the Node runtime used by pytest subprocess contracts.
+    default: "false"
+
+outputs:
+  python-path:
+    description: Managed Python cache directory
+    value: ${{ steps.identity.outputs.python-path }}
+  python-key:
+    description: Exact managed Python cache key
+    value: ${{ steps.identity.outputs.python-key }}
+  python-hit:
+    description: Whether managed Python was restored from the exact key
+    value: ${{ steps.python-cache.outputs.cache-hit }}
+  dependencies-path:
+    description: uv dependency cache directory
+    value: ${{ steps.identity.outputs.dependencies-path }}
+  dependencies-prefix:
+    description: Compatible dependency cache prefix
+    value: ${{ steps.identity.outputs.dependencies-prefix }}
+  dependencies-key:
+    description: Exact dependency cache key
+    value: ${{ steps.identity.outputs.dependencies-prefix }}${{ steps.dependencies.outputs.hash }}
+  dependencies-hit:
+    description: Whether the exact dependency key exists
+    value: ${{ steps.dependencies-cache.outputs.cache-hit }}
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare cache identity
+      id: identity
+      shell: bash
+      env:
+        CI_TEMP: ${{ runner.temp }}
+        CI_RUNNER: ${{ inputs.runner-label }}
+        CI_OS: ${{ runner.os }}
+        CI_ARCH: ${{ runner.arch }}
+        CI_UV: ${{ inputs.uv-version }}
+      run: |
+        set -euo pipefail
+        version="$(tr -d '[:space:]' < .python-version)"
+        test -n "$version"
+        cache_root="${CI_TEMP//\\//}"
+        identity="$CI_RUNNER-$CI_OS-$CI_ARCH-py-$version-uv-$CI_UV"
+        {
+          echo "UV_CACHE_DIR=$cache_root/fcc-uv-cache"
+          echo "UV_PYTHON_INSTALL_DIR=$cache_root/fcc-uv-python"
+          echo "UV_PYTHON_PREFERENCE=only-managed"
+        } >> "$GITHUB_ENV"
+        {
+          echo "python-version=$version"
+          echo "python-path=$cache_root/fcc-uv-python"
+          echo "python-key=uv-python-v2-$identity"
+          echo "dependencies-path=$cache_root/fcc-uv-cache"
+          echo "dependencies-prefix=uv-deps-v2-$identity-"
+        } >> "$GITHUB_OUTPUT"
+
+    - name: Restore Python
+      id: python-cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: ${{ steps.identity.outputs.python-path }}
+        key: ${{ steps.identity.outputs.python-key }}
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4
+      with:
+        version: ${{ inputs.uv-version }}
+        enable-cache: false
+
+    - name: Install Python
+      if: steps.python-cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        CI_PYTHON: ${{ steps.identity.outputs.python-version }}
+      run: uv python install "$CI_PYTHON"
+
+    - name: Prepare Node runtime
+      if: inputs.prepare-node == 'true'
+      shell: bash
+      env:
+        CI_PYTHON: ${{ steps.identity.outputs.python-version }}
+      run: |
+        uv run --no-project --python "$CI_PYTHON" python - <<'PY'
+        import shutil
+        import subprocess
+
+        node = shutil.which("node")
+        if node is None:
+            raise RuntimeError("Node is required for pytest subprocess contracts")
+        # Cold executable paging must happen before the timed behavior checks.
+        subprocess.run(
+            [node, "--experimental-strip-types", "--input-type=module", "--eval",
+             "import { stripTypeScriptTypes } from 'node:module'; "
+             "stripTypeScriptTypes('const value: number = 1'); "
+             "await new Response('ready').text(); "
+             "console.log('Node runtime ready:', process.version);"],
+            check=True,
+            timeout=120,
+        )
+        PY
+
+    - name: Fingerprint dependencies
+      id: dependencies
+      shell: bash
+      env:
+        CI_PYTHON: ${{ steps.identity.outputs.python-version }}
+      run: |
+        set -euo pipefail
+        uv export --locked --group dev --no-emit-workspace --no-header --no-annotate \
+          --output-file "$RUNNER_TEMP/uv-ci-dependencies.txt" > /dev/null
+        uv run --no-project --python "$CI_PYTHON" python - <<'PY'
+        import hashlib
+        import os
+        from pathlib import Path
+
+        dependencies = Path(os.environ["RUNNER_TEMP"]) / "uv-ci-dependencies.txt"
+        digest = hashlib.sha256(dependencies.read_bytes().replace(b"\r\n", b"\n")).hexdigest()
+        with Path(os.environ["GITHUB_OUTPUT"]).open("a", encoding="utf-8") as output:
+            output.write(f"hash={digest}\n")
+        PY
+
+    - name: Restore dependency cache
+      id: dependencies-cache
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: ${{ steps.identity.outputs.dependencies-path }}
+        key: ${{ steps.identity.outputs.dependencies-prefix }}${{ steps.dependencies.outputs.hash }}
+        restore-keys: ${{ steps.identity.outputs.dependencies-prefix }}
+        lookup-only: ${{ inputs.lookup-only }}

.github/workflows/dependency-cache.yml

@@ -4,11 +4,9 @@ env:
   CI_UV_VERSION: "0.12.13"
   UV_MALWARE_CHECK: "1"
   UV_PREVIEW_FEATURES: "malware-check"
-  UV_CACHE_DIR: /tmp/.uv-cache
-  UV_PYTHON_INSTALL_DIR: /tmp/uv-python
-  UV_PYTHON_PREFERENCE: only-managed
 
 on:
+  workflow_dispatch:
   push:
     branches: [main]
 
@@ -18,87 +16,57 @@ concurrency:
 
 jobs:
   warm-dependency-cache:
-    name: Warm dependency cache
-    runs-on: ubuntu-latest
+    name: Warm dependency cache (${{ matrix.os }})
+    if: github.ref == 'refs/heads/main'
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 15
     permissions:
       contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: Linux
+            runner: ubuntu-latest
+          - os: Windows
+            runner: windows-latest
+          - os: macOS
+            runner: macos-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
 
-      - name: Read Python version
-        id: python
-        shell: bash
-        run: |
-          set -euo pipefail
-          version="$(tr -d '[:space:]' < .python-version)"
-          test -n "$version"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-
-      - name: Restore Python
-        id: python-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      - name: Set up CI environment
+        id: environment
+        uses: ./.github/actions/ci-environment
         with:
-          path: ${{ env.UV_PYTHON_INSTALL_DIR }}
-          key: uv-python-v1-${{ runner.os }}-${{ runner.arch }}-py-${{ steps.python.outputs.version }}-uv-${{ env.CI_UV_VERSION }}
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4
-        with:
-          version: ${{ env.CI_UV_VERSION }}
-          enable-cache: false
-
-      - name: Install Python
-        if: steps.python-cache.outputs.cache-hit != 'true'
-        run: uv python install "${{ steps.python.outputs.version }}"
+          uv-version: ${{ env.CI_UV_VERSION }}
+          runner-label: ${{ matrix.runner }}
+          lookup-only: "true"
 
       - name: Save Python
-        if: steps.python-cache.outputs.cache-hit != 'true'
+        if: steps.environment.outputs.python-hit != 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
-          path: ${{ env.UV_PYTHON_INSTALL_DIR }}
-          key: ${{ steps.python-cache.outputs.cache-primary-key }}
-
-      - name: Fingerprint dependencies
-        id: dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          uv export \
-            --locked \
-            --no-emit-workspace \
-            --no-header \
-            --no-annotate \
-            --output-file "$RUNNER_TEMP/uv-ci-dependencies.txt"
-          echo "hash=$(sha256sum "$RUNNER_TEMP/uv-ci-dependencies.txt" | cut -d ' ' -f 1)" >> "$GITHUB_OUTPUT"
-
-      - name: Check for exact uv cache
-        id: exact-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: ${{ env.UV_CACHE_DIR }}
-          key: uv-deps-v1-${{ runner.os }}-${{ runner.arch }}-py-${{ steps.python.outputs.version }}-uv-${{ env.CI_UV_VERSION }}-${{ steps.dependencies.outputs.hash }}
-          lookup-only: true
+          path: ${{ steps.environment.outputs.python-path }}
+          key: ${{ steps.environment.outputs.python-key }}
 
-      - name: Restore compatible uv cache
-        if: steps.exact-cache.outputs.cache-hit != 'true'
-        id: uv-cache
+      - name: Restore compatible dependency cache
+        if: steps.environment.outputs.dependencies-hit != 'true'
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
-          path: ${{ env.UV_CACHE_DIR }}
-          key: uv-deps-v1-${{ runner.os }}-${{ runner.arch }}-py-${{ steps.python.outputs.version }}-uv-${{ env.CI_UV_VERSION }}-${{ steps.dependencies.outputs.hash }}
-          restore-keys: |
-            uv-deps-v1-${{ runner.os }}-${{ runner.arch }}-py-${{ steps.python.outputs.version }}-uv-${{ env.CI_UV_VERSION }}-
+          path: ${{ steps.environment.outputs.dependencies-path }}
+          key: ${{ steps.environment.outputs.dependencies-key }}
+          restore-keys: ${{ steps.environment.outputs.dependencies-prefix }}
 
-      - name: Warm uv cache
-        if: steps.exact-cache.outputs.cache-hit != 'true'
-        run: uv sync --locked --no-install-workspace
+      - name: Warm dependency cache
+        if: steps.environment.outputs.dependencies-hit != 'true'
+        run: uv sync --locked --group dev --no-install-workspace
 
-      - name: Save uv cache
-        if: steps.exact-cache.outputs.cache-hit != 'true'
+      - name: Save dependency cache
+        if: steps.environment.outputs.dependencies-hit != 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
-          path: ${{ env.UV_CACHE_DIR }}
-          key: ${{ steps.uv-cache.outputs.cache-primary-key }}
+          path: ${{ steps.environment.outputs.dependencies-path }}
+          key: ${{ steps.environment.outputs.dependencies-key }}