ci: cache uv dependencies via setup-uv native caching

Every CI job cold-installed dependencies (~340s 'Setup UV'), and a prior custom
actions/cache never actually hit (exact-key + prime race).  Worse, on a cold uv
cache 'uv sync' rebuilds the orb-py package, firing setup.py's build hook →
build_ui.sh (reflex export + bun) → a full SPA build inside the dependency
install, which timed the job out.

Fix: use setup-uv's native cache (enable-cache, keyed on uv.lock) which caches
UV_CACHE_DIR — the wheel cache uv actually uses — so a warm run links wheels in
~14s instead of ~340s.  Pin Python 3.12 via actions/setup-python before uv so
uv never fetches an interpreter, and run 'uv sync' with ORB_SKIP_UI_BUILD=1 so
the package build never triggers the SPA build.  The custom actions/cache
prime/restore is removed (setup-uv handles caching per job); cache-management now
only emits the cache-key output callers still reference.

Author: fgogolli

.github/actions/setup-uv-cached/action.yml

@@ -1,33 +1,39 @@
 name: 'Setup UV with Cache'
-description: 'Install UV and restore cached environment'
+description: 'Install UV with its native wheel cache (enable-cache) and install deps'
 inputs:
   cache-key:
-    description: 'Cache key for UV environment'
-    required: true
+    description: 'Unused — kept for caller compatibility; setup-uv manages its own cache.'
+    required: false
+    default: ''
   fail-on-cache-miss:
-    description: 'Whether to fail if cache is not found'
+    description: 'Unused — kept for caller compatibility.'
     required: false
-    default: 'true'
+    default: 'false'
 
 runs:
   using: 'composite'
   steps:
+    # Pin the interpreter BEFORE uv so uv never tries to fetch/build a Python.
+    - name: Set up Python
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
+      with:
+        python-version: '3.12'
+
+    # setup-uv's native cache keys on the uv.lock hash and caches UV_CACHE_DIR
+    # (the wheel/download cache uv actually uses).  Warm cache → link, not download.
     - name: Install UV
       uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
-
-    - name: Restore UV environment
-      id: restore-cache
-      uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0  # v5.0.0
       with:
-        path: |
-          .venv
-          ~/.cache/uv
-          ~/.local/bin/uv
-          /opt/hostedtoolcache/uv
-        key: ${{ inputs.cache-key }}
-        fail-on-cache-miss: ${{ inputs.fail-on-cache-miss }}
+        version: "0.9.6"
+        enable-cache: true
+        cache-dependency-glob: "uv.lock"
 
-    - name: Install dependencies if cache miss
-      if: steps.restore-cache.outputs.cache-hit != 'true'
+    # ORB_SKIP_UI_BUILD is CRITICAL: `uv sync` builds the orb-py package, which
+    # runs setup.py's build_py hook → build_ui.sh (reflex export + bun) → the
+    # full SPA build.  On a cold uv cache that rebuild fires and takes >30 min,
+    # timing the job out.  Test jobs don't need the SPA, so skip it here.
+    - name: Install dependencies
       shell: bash
-      run: make dev-install
+      env:
+        ORB_SKIP_UI_BUILD: "1"
+      run: uv sync --frozen --all-groups

.github/workflows/cache-management.yml

@@ -12,7 +12,7 @@ on:
         required: true
         type: string
       cache-key-base:
-        description: 'Base cache key (e.g. test-deps, quality-deps)'
+        description: 'Base cache key — all callers must pass "deps" for the shared env'
         required: true
         type: string
       python-version:
@@ -22,11 +22,11 @@ on:
     outputs:
       cache-key:
         description: 'Generated cache key for use in setup-uv-cached'
-        value: ${{ jobs.generate-cache-key.outputs.cache-key }}
+        value: ${{ jobs.setup-cache.outputs.cache-key }}
 
 jobs:
-  generate-cache-key:
-    name: Generate Cache Key
+  setup-cache:
+    name: Prime Dependency Cache
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -50,16 +50,8 @@ jobs:
         echo "key=$KEY" >> "$GITHUB_OUTPUT"
         echo "Generated cache key: $KEY"
 
-    - name: Restore cache
-      id: cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
-      with:
-        path: |
-          ~/.cache/uv
-          .venv
-          dist/
-          .pytest_cache
-        key: ${{ steps.cache-key.outputs.key }}
-        restore-keys: |
-          ${{ inputs.cache-key-base }}-py${{ inputs.python-version }}-
-          ${{ inputs.cache-key-base }}-
+    # NOTE: no cache save/restore here.  Dependency caching is handled per-job
+    # by the setup-uv-cached composite action via setup-uv's native cache
+    # (keyed on uv.lock).  This job only emits the cache-key output that callers
+    # still reference; the custom prime/restore was removed because it never hit
+    # (exact-key + prime race) and duplicated setup-uv's own cache.

.github/workflows/changelog-validation.yml

@@ -32,7 +32,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: changelog-validation
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   validate-changelog:

.github/workflows/ci-quality.yml

@@ -46,7 +46,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: quality-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   auto-format:

.github/workflows/ci-tests.yml

@@ -49,7 +49,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: test-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   # Parallel test-group matrix (T2613): splits the non-provider test corpus

.github/workflows/dependabot.yml

@@ -32,7 +32,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: dependabot
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   update-uv-lock:

.github/workflows/dev-containers.yml

@@ -82,7 +82,7 @@ jobs:
       # fell through to the SHA-based fallback arm in cache-management.yml, producing
       # a cold key on every run and forcing a full dep reinstall each time.
       cache-type: dependencies
-      cache-key-base: container-build
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   container-pipeline:

.github/workflows/docs.yml

@@ -56,7 +56,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: docs-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   build:

.github/workflows/reusable-test.yml

@@ -116,7 +116,7 @@ jobs:
             ${{
               inputs.cache-key != ''
               && inputs.cache-key
-              || format('test-deps-py{0}-{1}',
+              || format('deps-py{0}-{1}',
                    inputs.python-version || inputs.default-python-version,
                    hashFiles('.project.yml', 'pyproject.toml', 'uv.lock'))
             }}

.github/workflows/test-matrix.yml

@@ -28,7 +28,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: test-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   unit-tests: