Extract greenlight container tool install action

- Add greenlight-container-tools composite action installing jq, AWS CLI v2,
  and gh on demand for minimal container base images
- Replace three inline apt/curl install steps in greenlight-pr-review.yml with
  calls to the new action (awscli; gh+jq; awscli+jq)
- Each job now requests only the tools it needs via boolean inputs

Notes:
The ARC runners use a minimal node:20-bookworm container that lacks the CLI
tools the GitHub-hosted ubuntu image ships by default, so each job hand-rolled
the same apt/curl install boilerplate. Consolidating into one composite action
removes the duplication and keeps the install logic single-sourced.

Signed-off-by: Jean Schmidt <contato@jschmidt.me>

Author: jeanschmidt

.github/actions/greenlight-container-tools/action.yml

@@ -0,0 +1,57 @@
+name: Greenlight container tools
+description: >-
+  Installs CLI tools that the GitHub-hosted ubuntu image ships by default but a
+  minimal container base image does not (jq, AWS CLI v2, GitHub CLI). Only the
+  tools a job requests are installed. Assumes a Debian/Ubuntu base running as root.
+
+inputs:
+  jq:
+    description: Install jq
+    default: "false"
+  awscli:
+    description: Install AWS CLI v2
+    default: "false"
+  gh:
+    description: Install the GitHub CLI (gh)
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Install apt packages
+      shell: bash
+      env:
+        INSTALL_JQ: ${{ inputs.jq }}
+        INSTALL_AWSCLI: ${{ inputs.awscli }}
+      run: |
+        set -euo pipefail
+        pkgs=(ca-certificates curl)
+        if [ "$INSTALL_JQ" = "true" ]; then pkgs+=(jq); fi
+        if [ "$INSTALL_AWSCLI" = "true" ]; then pkgs+=(unzip); fi
+        apt-get update
+        apt-get install -y --no-install-recommends "${pkgs[@]}"
+
+    - name: Install GitHub CLI
+      if: ${{ inputs.gh == 'true' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        install -d -m 755 /etc/apt/keyrings
+        curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+          -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
+        chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+        arch="$(dpkg --print-architecture)"
+        echo "deb [arch=${arch} signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+          > /etc/apt/sources.list.d/github-cli.list
+        apt-get update
+        apt-get install -y --no-install-recommends gh
+
+    - name: Install AWS CLI v2
+      if: ${{ inputs.awscli == 'true' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/awscliv2.zip
+        unzip -q /tmp/awscliv2.zip -d /tmp
+        /tmp/aws/install
+        rm -rf /tmp/awscliv2.zip /tmp/aws

.github/workflows/greenlight-pr-review.yml

@@ -68,15 +68,10 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Install AWS CLI v2
-        run: |
-          set -euo pipefail
-          apt-get update
-          apt-get install -y --no-install-recommends ca-certificates curl unzip
-          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/awscliv2.zip
-          unzip -q /tmp/awscliv2.zip -d /tmp
-          /tmp/aws/install
-          rm -rf /tmp/awscliv2.zip /tmp/aws
+      - name: Install container CLI tools
+        uses: ./.github/actions/greenlight-container-tools
+        with:
+          awscli: "true"
 
       - name: Set up Python 3.14
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
@@ -148,19 +143,11 @@ jobs:
           path: pytorch
           fetch-depth: 1
 
-      - name: Install gh and jq
-        run: |
-          set -euo pipefail
-          apt-get update
-          apt-get install -y --no-install-recommends ca-certificates curl gnupg jq
-          install -d -m 755 /etc/apt/keyrings
-          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-            -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
-          chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
-          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
-            > /etc/apt/sources.list.d/github-cli.list
-          apt-get update
-          apt-get install -y --no-install-recommends gh
+      - name: Install container CLI tools
+        uses: ./.github/actions/greenlight-container-tools
+        with:
+          gh: "true"
+          jq: "true"
 
       - name: Configure AWS credentials via OIDC
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a  # v4.3.1
@@ -332,15 +319,11 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Install AWS CLI v2 and jq
-        run: |
-          set -euo pipefail
-          apt-get update
-          apt-get install -y --no-install-recommends ca-certificates curl unzip jq
-          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/awscliv2.zip
-          unzip -q /tmp/awscliv2.zip -d /tmp
-          /tmp/aws/install
-          rm -rf /tmp/awscliv2.zip /tmp/aws
+      - name: Install container CLI tools
+        uses: ./.github/actions/greenlight-container-tools
+        with:
+          awscli: "true"
+          jq: "true"
 
       - name: Set up Python 3.14
         # greenlight pins requires-python >=3.14 with uv python-preference=only-system,