ci: per-job scoped dependency sync + working cache + drop redundant prereqs

- setup-uv-cached: add `group` input; on cache miss run
  `uv sync --frozen --no-default-groups --group <group>` so each job
  installs only its slice (~2-15 packages) not all 300.  Legacy callers
  (no group) fall back to --all-groups.  Always sets up Python 3.12.
- cache-management: add `group` input; key becomes
  `deps-py3.12-<group>-<uv.lock hash>`.  Add a populate step so the cache
  prime actually installs the group's packages before actions/cache saves
  (it previously saved an empty .venv on every miss).  Each job's own
  setup-uv-cached syncs-on-miss too, so correctness never depends on the
  prime winning the race.
- Per-job group mapping: lint-ruff/auto-format -> lint; lint-pyright ->
  typecheck; arch-validation/version-drift -> arch; test legs -> test;
  build-and-package -> build; bandit/safety -> security; docs -> docs.
- Cache key base unified to `deps` across all workflows (was quality-deps,
  test-deps, docs-deps, ...) so per-group keys are globally deduplicated.
- version-drift step no longer does `pip install pyyaml`; it uses the venv
  populated by setup-uv-cached (pyyaml is a project dependency).
- Drop redundant dev-install prereqs from ci-quality-ruff, ci-arch-imports,
  ci-arch-lint-imports (ci.mk) and format-fix (quality.mk); CI jobs receive a
  pre-populated venv, local fresh-checkout still works via `make dev-install`.

Author: fgogolli

.github/actions/setup-uv-cached/action.yml

@@ -1,9 +1,19 @@
 name: 'Setup UV with Cache'
-description: 'Install UV and restore cached environment'
+description: 'Install UV and restore cached environment, syncing only the requested dependency group'
 inputs:
   cache-key:
-    description: 'Cache key for UV environment'
+    description: 'Cache key for UV environment (caller-supplied; keyed per group)'
     required: true
+  group:
+    description: >-
+      PEP 735 dependency-group to sync (e.g. lint, typecheck, arch, test, docs,
+      security, build, ci, dev).  When supplied the action runs
+      `uv sync --frozen --no-default-groups --group <group>` on a cache miss so
+      each job installs only the packages it needs.  When empty the action falls
+      back to `uv sync --frozen --all-groups` (preserves legacy callers that
+      have not yet been updated to pass a group).
+    required: false
+    default: ''
   fail-on-cache-miss:
     description: 'Whether to fail if cache is not found'
     required: false
@@ -15,6 +25,11 @@ runs:
     - name: Install UV
       uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
+    - name: Setup Python 3.12
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
+      with:
+        python-version: '3.12'
+
     - name: Restore UV environment
       id: restore-cache
       uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0  # v5.0.0
@@ -27,7 +42,17 @@ runs:
         key: ${{ inputs.cache-key }}
         fail-on-cache-miss: ${{ inputs.fail-on-cache-miss }}
 
-    - name: Install dependencies if cache miss
+    - name: Install dependencies (scoped, on cache miss)
       if: steps.restore-cache.outputs.cache-hit != 'true'
       shell: bash
-      run: make dev-install
+      env:
+        ORB_SKIP_UI_BUILD: "1"
+        UV_GROUP: ${{ inputs.group }}
+      run: |
+        if [ -n "$UV_GROUP" ]; then
+          # Scoped install: only the packages this job needs (~2-15 pkgs, fast even cold)
+          uv sync --frozen --no-default-groups --group "$UV_GROUP"
+        else
+          # Legacy fallback: full install (used by callers that predate group scoping)
+          uv sync --frozen --all-groups
+        fi

.github/workflows/cache-management.yml

@@ -19,6 +19,15 @@ on:
         description: 'Python version for cache key'
         required: true
         type: string
+      group:
+        description: >-
+          PEP 735 dependency-group to prime (e.g. lint, typecheck, test).
+          When provided the prime job runs `uv sync --frozen --no-default-groups
+          --group <group>` so only the relevant slice is cached.  When empty the
+          prime installs --all-groups (legacy / umbrella callers).
+        required: false
+        type: string
+        default: ''
     outputs:
       cache-key:
         description: 'Generated cache key for use in setup-uv-cached'
@@ -36,12 +45,27 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
+    - name: Install UV
+      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+
+    - name: Setup Python 3.12
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
+      with:
+        python-version: '3.12'
+
     - name: Generate cache key
       id: cache-key
       run: |
         case "${{ inputs.cache-type }}" in
           dependencies)
-            KEY="${{ inputs.cache-key-base }}-py${{ inputs.python-version }}-${{ hashFiles('.project.yml', 'pyproject.toml', 'uv.lock') }}"
+            # Key encodes the group so per-group caches are independent;
+            # a uv.lock bump invalidates only that group's slice.
+            GROUP="${{ inputs.group }}"
+            if [ -n "$GROUP" ]; then
+              KEY="${{ inputs.cache-key-base }}-py3.12-${GROUP}-${{ hashFiles('.project.yml', 'pyproject.toml', 'uv.lock') }}"
+            else
+              KEY="${{ inputs.cache-key-base }}-py3.12-${{ hashFiles('.project.yml', 'pyproject.toml', 'uv.lock') }}"
+            fi
             ;;
           *)
             KEY="${{ inputs.cache-key-base }}-${{ github.sha }}"
@@ -50,7 +74,7 @@ jobs:
         echo "key=$KEY" >> "$GITHUB_OUTPUT"
         echo "Generated cache key: $KEY"
 
-    - name: Restore cache
+    - name: Restore cache (check for existing warm cache)
       id: cache
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v5
       with:
@@ -61,5 +85,22 @@ jobs:
           .pytest_cache
         key: ${{ steps.cache-key.outputs.key }}
         restore-keys: |
-          ${{ inputs.cache-key-base }}-py${{ inputs.python-version }}-
+          ${{ inputs.cache-key-base }}-py3.12-${{ inputs.group != '' && format('{0}-', inputs.group) || '' }}
           ${{ inputs.cache-key-base }}-
+
+    - name: Prime cache (populate on miss)
+      # Only runs when there is no existing warm cache for this key.
+      # Installs the scoped group so the post-step cache save writes a populated
+      # .venv rather than an empty one.  Each job's setup-uv-cached composite
+      # also syncs-on-miss, so correctness never depends on the prime winning
+      # the race; this is best-effort warming.
+      if: steps.cache.outputs.cache-hit != 'true'
+      env:
+        ORB_SKIP_UI_BUILD: "1"
+        UV_GROUP: ${{ inputs.group }}
+      run: |
+        if [ -n "$UV_GROUP" ]; then
+          uv sync --frozen --no-default-groups --group "$UV_GROUP"
+        else
+          uv sync --frozen --all-groups
+        fi

.github/workflows/changelog-validation.yml

@@ -32,8 +32,9 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: changelog-validation
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
+      group: build
 
   validate-changelog:
     name: Validate Changelog Format
@@ -53,6 +54,7 @@ jobs:
       uses: ./.github/actions/setup-uv-cached
       with:
         cache-key: ${{ needs.setup-cache.outputs.cache-key }}
+        group: build
         fail-on-cache-miss: false
 
     - name: Install changelog dependencies

.github/workflows/ci-quality.yml

@@ -45,14 +45,37 @@ jobs:
     name: Configuration
     uses: ./.github/workflows/shared-config.yml
 
-  setup-cache:
-    name: Setup Cache
+  # One setup-cache job per group that needs priming.
+  # Each installs only its slice so cache misses are cheap even cold.
+  setup-cache-lint:
+    name: Setup Cache (lint)
     needs: config
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: quality-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
+      group: lint
+
+  setup-cache-typecheck:
+    name: Setup Cache (typecheck)
+    needs: config
+    uses: ./.github/workflows/cache-management.yml
+    with:
+      cache-type: dependencies
+      cache-key-base: deps
+      python-version: ${{ needs.config.outputs.default-python-version }}
+      group: typecheck
+
+  setup-cache-arch:
+    name: Setup Cache (arch)
+    needs: config
+    uses: ./.github/workflows/cache-management.yml
+    with:
+      cache-type: dependencies
+      cache-key-base: deps
+      python-version: ${{ needs.config.outputs.default-python-version }}
+      group: arch
 
   auto-format:
     name: Auto-Format Code
@@ -64,7 +87,7 @@ jobs:
       && github.actor != 'open-resource-broker-cicd[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: [config, setup-cache]
+    needs: [config, setup-cache-lint]
     # Override the workflow-level concurrency so this job is never cancelled
     # mid-run.  If it were interrupted after `ruff` rewrites files but before
     # `git push`, the PR branch would be left in a half-formatted state.
@@ -94,7 +117,8 @@ jobs:
       - name: Setup UV with cache
         uses: ./.github/actions/setup-uv-cached
         with:
-          cache-key: ${{ needs.setup-cache.outputs.cache-key }}
+          cache-key: ${{ needs.setup-cache-lint.outputs.cache-key }}
+          group: lint
           fail-on-cache-miss: false
 
       - name: Auto-format code
@@ -128,7 +152,7 @@ jobs:
       && github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: [config, setup-cache]
+    needs: [config, setup-cache-lint]
     permissions:
       contents: read
       pull-requests: write
@@ -142,7 +166,8 @@ jobs:
       - name: Setup UV with cache
         uses: ./.github/actions/setup-uv-cached
         with:
-          cache-key: ${{ needs.setup-cache.outputs.cache-key }}
+          cache-key: ${{ needs.setup-cache-lint.outputs.cache-key }}
+          group: lint
           fail-on-cache-miss: false
 
       - name: Run formatter
@@ -159,7 +184,7 @@ jobs:
     name: Ruff (Code Quality)
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: [config, setup-cache]
+    needs: [config, setup-cache-lint]
     permissions:
       contents: read
     steps:
@@ -169,7 +194,8 @@ jobs:
       - name: Setup UV with cache
         uses: ./.github/actions/setup-uv-cached
         with:
-          cache-key: ${{ needs.setup-cache.outputs.cache-key }}
+          cache-key: ${{ needs.setup-cache-lint.outputs.cache-key }}
+          group: lint
           fail-on-cache-miss: false
 
       - name: Check code quality
@@ -179,7 +205,7 @@ jobs:
     name: Ruff (Extended Checks)
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: [config, setup-cache, lint-ruff]
+    needs: [config, setup-cache-lint, lint-ruff]
     permissions:
       contents: read
     steps:
@@ -189,7 +215,8 @@ jobs:
       - name: Setup UV with cache
         uses: ./.github/actions/setup-uv-cached
         with:
-          cache-key: ${{ needs.setup-cache.outputs.cache-key }}
+          cache-key: ${{ needs.setup-cache-lint.outputs.cache-key }}
+          group: lint
           fail-on-cache-miss: false
 
       - name: Extended linting (warnings)
@@ -200,7 +227,7 @@ jobs:
     name: Type Checking (pyright)
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: [config, setup-cache, lint-ruff]
+    needs: [config, setup-cache-typecheck, lint-ruff]
     permissions:
       contents: read
     steps:
@@ -210,7 +237,8 @@ jobs:
     - name: Setup UV with cache
       uses: ./.github/actions/setup-uv-cached
       with:
-        cache-key: ${{ needs.setup-cache.outputs.cache-key }}
+        cache-key: ${{ needs.setup-cache-typecheck.outputs.cache-key }}
+        group: typecheck
         fail-on-cache-miss: false
 
     - name: Run pyright type check
@@ -221,7 +249,7 @@ jobs:
     name: Architecture Validation
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    needs: [config, setup-cache, lint-ruff]
+    needs: [config, setup-cache-arch, lint-ruff]
     permissions:
       contents: read
     strategy:
@@ -243,7 +271,8 @@ jobs:
     - name: Setup UV with cache
       uses: ./.github/actions/setup-uv-cached
       with:
-        cache-key: ${{ needs.setup-cache.outputs.cache-key }}
+        cache-key: ${{ needs.setup-cache-arch.outputs.cache-key }}
+        group: arch
         fail-on-cache-miss: false
 
     - name: Run architecture validation (${{ matrix.description }})
@@ -254,16 +283,22 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     # Runs independently of lint to give early signal on version drift.
-    # Only needs a checkout + pyyaml — no UV venv required.
-    needs: config
+    # pyyaml is available via the project's core [dependencies] so any
+    # group that installs the project also provides it.  Use the arch
+    # group (smallest group that triggers a uv sync with the project).
+    needs: [config, setup-cache-arch]
     permissions:
       contents: read
     steps:
     - name: Checkout code
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-    - name: Install PyYAML
-      run: pip install --quiet pyyaml
+    - name: Setup UV with cache
+      uses: ./.github/actions/setup-uv-cached
+      with:
+        cache-key: ${{ needs.setup-cache-arch.outputs.cache-key }}
+        group: arch
+        fail-on-cache-miss: false
 
     - name: Check Python version drift
       run: make ci-check-python-version-drift