chore: add dependency cache for fork PR CI support#1386
Merged
Conversation
Fork PRs cannot authenticate to JFrog (no OIDC token available). This adds a cache-based dependency strategy so fork PRs get full CI feedback. - Add warmDepsCache.yml: trusted workflow that downloads all deps via JFrog and saves to GitHub Actions cache (triggers on push to main, daily schedule, and manual dispatch with optional PR number) - Add setup-python-deps composite action: restores cached deps and enables offline mode (UV_OFFLINE + PIP_NO_INDEX) - Update main.yml to use setup-python-deps instead of setup-jfrog-pypi, remove id-token:write permission (no longer needed)
The unindented heredoc body ([global] and EOF at column 1) was parsed as YAML instead of shell script content, breaking the action manifest.
setup-python-deps now outputs cache-hit. On cache miss, main.yml falls back to setup-jfrog-pypi for package resolution. Also fixes YAML parse error from unindented heredoc by using printf instead.
- Always checkout main first for trusted CI actions, then overlay only lockfiles from fork (prevents malicious action injection) - Remove redundant echo and comments from setup-python-deps - Quote hashFiles expressions in shell context
Coverage report
This PR does not seem to contain any modification to coverable code. |
Cache key format changed from python-deps-{TIMESTAMP}-{HASH} to
python-deps-{HASH}-{TIMESTAMP}. Consumers now prefix-match on the
hash, so only caches matching the current lockfiles are restored.
If lockfiles changed, no cache matches and the JFrog fallback runs.
This eliminates stale cache issues without shell hash comparisons.
…comment - Add id: coverage_comment to Coverage Comment step so artifact upload condition works - Remove fail-fast: false from matrixless code-quality job (no-op) - Remove redundant comment from cache key in setup-python-deps
tejassp-db
approved these changes
Apr 10, 2026
sd-db
added a commit
that referenced
this pull request
Apr 13, 2026
## Summary Fixes issues preventing the dependency cache (#1386) from working on fork PRs: - **uv cache path**: `setup-uv` overrode the cache dir to a temp path. Use `cache-local-path` to pin it. - **uv offline lookups**: cache is scoped by index URL hash. Set `UV_INDEX_URL` to match the warmer's JFrog URL. - **Pre-commit broken symlinks**: warmer's Python path differed from consumer's. Use `setup-python` in warmer. - **pip offline**: `PIP_NO_INDEX` blocks all index access. Create a pip wheelhouse and use `PIP_FIND_LINKS`. - **Version-specific wheels**: create test envs for all matrix versions in the warmer. - Misc: removed no-op `strategy.fail-fast`, added missing `id: coverage_comment`. ## Test plan - [x] `warm-cache` job succeeds on this PR - [x] All `main.yml` jobs pass offline
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fork PRs cannot authenticate to JFrog (no OIDC token available). This adds a cache-based dependency strategy so fork PRs get full CI feedback.
Checklist
CHANGELOG.mdand added information about my change to the "dbt-databricks next" section. - NA