From c78558b6bd58b1157af05fe1b5bc9957576de55f Mon Sep 17 00:00:00 2001
From: Bryce Lynn <bryce.lynn@nttdata.com>
Date: Fri, 31 Jul 2026 10:55:41 -0700
Subject: [PATCH] perf: cache Terraform provider plugins in terraform-check

The Makefile inits the root module and every example directory separately, so
each one currently downloads the same providers again from scratch. Setting a
shared TF_PLUGIN_CACHE_DIR collapses that to one download per run, and caching
the directory across runs removes it almost entirely.

Applied to both jobs that run terraform init (lint and tests). The directory is
created explicitly because Terraform silently ignores the plugin cache when the
directory does not already exist.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../workflows/reusable-terraform-check.yml    | 44 +++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/.github/workflows/reusable-terraform-check.yml b/.github/workflows/reusable-terraform-check.yml
index 86e6f20..8a547db 100644
--- a/.github/workflows/reusable-terraform-check.yml
+++ b/.github/workflows/reusable-terraform-check.yml
@@ -157,6 +157,28 @@ jobs:
           path: ~/.asdf
           key: ${{ runner.os }}-tool-versions-${{ hashFiles('.tool-versions') }}
 
+      - id: tf-plugin-cache-dir
+        name: Configure Terraform plugin cache directory
+        # Terraform silently ignores the plugin cache if the directory does not
+        # already exist, so create it before any init runs.
+        shell: bash
+        run: |
+          echo "TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin-cache" >> "$GITHUB_ENV"
+          mkdir -p "$HOME/.terraform.d/plugin-cache"
+
+      - id: tf-plugin-cache
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
+        # Provider downloads dominate the cost of `terraform init`, and the
+        # Makefile inits the root module and every example separately, so each
+        # one currently re-downloads the same providers. A single shared cache
+        # serves all of them within a run and persists across runs.
+        name: Cache Terraform provider plugins
+        with:
+          path: ~/.terraform.d/plugin-cache
+          key: ${{ runner.os }}-tf-plugins-${{ hashFiles('**/versions.tf') }}
+          restore-keys: |
+            ${{ runner.os }}-tf-plugins-
+
       - id: configure
         name: Setup Repository for Checks
         # Ensure the 'repo' tool is installed, set up git to make the Makefile happy, and then configure to clone LCAF.
@@ -230,6 +252,28 @@ jobs:
           path: ~/.asdf
           key: ${{ runner.os }}-tool-versions-${{ hashFiles('.tool-versions') }}
 
+      - id: tf-plugin-cache-dir
+        name: Configure Terraform plugin cache directory
+        # Terraform silently ignores the plugin cache if the directory does not
+        # already exist, so create it before any init runs.
+        shell: bash
+        run: |
+          echo "TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin-cache" >> "$GITHUB_ENV"
+          mkdir -p "$HOME/.terraform.d/plugin-cache"
+
+      - id: tf-plugin-cache
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306
+        # Provider downloads dominate the cost of `terraform init`, and the
+        # Makefile inits the root module and every example separately, so each
+        # one currently re-downloads the same providers. A single shared cache
+        # serves all of them within a run and persists across runs.
+        name: Cache Terraform provider plugins
+        with:
+          path: ~/.terraform.d/plugin-cache
+          key: ${{ runner.os }}-tf-plugins-${{ hashFiles('**/versions.tf') }}
+          restore-keys: |
+            ${{ runner.os }}-tf-plugins-
+
       - id: configure
         name: Setup Repository for Checks
         # Ensure the 'repo' tool is installed, set up git to make the Makefile happy, and then configure to clone LCAF.