Cache Azure Linux packages in CI

.github/actions/install-ci-dependencies/action.yml

@@ -0,0 +1,94 @@
+name: Install Azure Linux CI dependencies
+description: Restore and populate the Azure Linux package cache
+
+runs:
+  using: composite
+  steps:
+    - name: Configure package cache
+      id: configure
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        source /etc/os-release
+        case "$VERSION_ID" in
+          3.0)
+            package_manager=tdnf
+            setup_script=scripts/setup-ci.sh
+            cache_dir=/github/home/.ccf-package-cache/tdnf
+            config_file=/etc/tdnf/tdnf.conf
+            cache_option=cachedir
+            keepcache_value=1
+            ;;
+          4.0)
+            package_manager=dnf
+            setup_script=scripts/setup-ci-al4.sh
+            cache_dir=/github/home/.ccf-package-cache/dnf
+            config_file=/etc/dnf/dnf.conf
+            cache_option=system_cachedir
+            keepcache_value=True
+            ;;
+          *)
+            echo "Unsupported Azure Linux version: $VERSION_ID" >&2
+            exit 1
+            ;;
+        esac
+
+        for attempt in 1 2 3; do
+          if "$package_manager" -y install tar zstd; then
+            break
+          fi
+          if (( attempt == 3 )); then
+            echo "Failed to install package cache tools" >&2
+            exit 1
+          fi
+          if (( attempt == 1 )); then
+            sleep 5
+          else
+            sleep 30
+          fi
+        done
+
+        set_config_option() {
+          local name=$1
+          local value=$2
+
+          if grep -q "^${name}=" "$config_file"; then
+            sed -i "s|^${name}=.*|${name}=${value}|" "$config_file"
+          else
+            sed -i "/^\[main\]/a ${name}=${value}" "$config_file"
+          fi
+        }
+
+        set_config_option "$cache_option" "$cache_dir"
+        set_config_option keepcache "$keepcache_value"
+        mkdir -p "$cache_dir"
+
+        day_of_week=$(date -u +%u)
+        days_since_sunday=$((day_of_week % 7))
+        cache_week=$(date -u -d "$days_since_sunday days ago" +%Y-%m-%d)
+
+        echo "cache-dir=$cache_dir" >> "$GITHUB_OUTPUT"
+        echo "cache-week=$cache_week" >> "$GITHUB_OUTPUT"
+        echo "package-manager=$package_manager" >> "$GITHUB_OUTPUT"
+        echo "setup-script=$setup_script" >> "$GITHUB_OUTPUT"
+
+    - name: Restore package cache
+      continue-on-error: true
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.configure.outputs.cache-dir }}
+        key: azure-linux-${{ steps.configure.outputs.package-manager }}-rpms-${{ runner.arch }}-${{ hashFiles('scripts/setup-ci*.sh') }}-${{ steps.configure.outputs.cache-week }}
+        restore-keys: |
+          azure-linux-${{ steps.configure.outputs.package-manager }}-rpms-${{ runner.arch }}-${{ hashFiles('scripts/setup-ci*.sh') }}-
+          azure-linux-${{ steps.configure.outputs.package-manager }}-rpms-${{ runner.arch }}-
+
+    - name: Install dependencies
+      shell: bash
+      env:
+        PACKAGE_MANAGER: ${{ steps.configure.outputs.package-manager }}
+        SETUP_SCRIPT: ${{ steps.configure.outputs.setup-script }}
+      run: |
+        set -euo pipefail
+        "$PACKAGE_MANAGER" clean metadata
+        bash "$SETUP_SCRIPT"

.github/workflows/README.md

@@ -1,5 +1,13 @@
 Documents the various GitHub Actions workflows, the role they fulfill and 3rd party (i.e. outside of https://github.com/actions/) dependencies if any.
 
+# Shared actions
+
+## Azure Linux CI dependencies
+
+The local composite action in `.github/actions/install-ci-dependencies/action.yml` installs Azure Linux 3 and 4 CI dependencies and caches downloaded RPMs. Its cache key separates package managers and runner architectures, includes a hash of `scripts/setup-ci*.sh`, and includes the date of the most recent Sunday at midnight UTC. The weekly date makes GitHub Actions create a refreshed immutable cache each week.
+
+At a weekly rollover, restore keys first reuse the latest cache for the same dependency scripts and then fall back to any cache for the same package manager and architecture. The package manager refreshes repository metadata and downloads only missing or updated RPMs. `actions/cache` saves the populated directory automatically after a successful job when the exact weekly key was not restored.
+
 # Maintained
 
 ## Bencher

.github/workflows/bencher-ab.yml

@@ -46,7 +46,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install dependencies
-        run: ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: Confirm platform
         run: python3 tests/infra/platform_detection.py virtual

.github/workflows/bencher.yml

@@ -42,10 +42,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Machine info"
         shell: bash

.github/workflows/ci-al4.yml

@@ -41,10 +41,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci-al4.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build Debug"
         run: |
@@ -114,10 +111,7 @@ jobs:
         shell: bash
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci-al4.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Confirm running on Virtual"
         run: |
@@ -184,10 +178,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci-al4.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build Debug"
         run: |

.github/workflows/ci-verification.yml

@@ -203,10 +203,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: Install TLC dependencies
         run: |

.github/workflows/ci.yml

@@ -50,10 +50,12 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
+        uses: ./.github/actions/install-ci-dependencies
+
+      - name: "Install development dependencies"
         shell: bash
         run: |
           set -ex
-          ./scripts/setup-ci.sh
           ./scripts/setup-dev.sh
 
       - name: "Run Checks and Build Debug with clang-tidy"
@@ -144,10 +146,7 @@ jobs:
         shell: bash
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Confirm running on Virtual"
         run: |
@@ -215,10 +214,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build Debug"
         run: |

.github/workflows/codeql-analysis.yml

@@ -70,10 +70,7 @@ jobs:
           queries: security-extended
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Run CMake"
         run: |

.github/workflows/coverage.yml

@@ -44,10 +44,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build Debug with coverage"
         run: |

.github/workflows/doc.yml

@@ -28,14 +28,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install dependencies
+        uses: ./.github/actions/install-ci-dependencies
+
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Build Documentation
         run: |
           set -x
-          ./scripts/setup-ci.sh
           python3 -m venv env
           source env/bin/activate
           pip install -U pip

.github/workflows/long-test.yml

@@ -48,10 +48,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build Debug (Long Test)"
         run: |
@@ -109,10 +106,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build Debug (Long Test)"
         run: |
@@ -173,10 +167,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build"
         run: |
@@ -246,10 +237,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build"
         run: |
@@ -311,10 +299,7 @@ jobs:
           fetch-depth: 0
 
       - name: "Install dependencies"
-        shell: bash
-        run: |
-          set -ex
-          ./scripts/setup-ci.sh
+        uses: ./.github/actions/install-ci-dependencies
 
       - name: "Build"
         run: |

scripts/setup-ci.sh

@@ -6,8 +6,11 @@ set -exo pipefail
 
 H2SPEC_VERSION="v2.6.0"
 
-export SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(date +%s)}
-echo "Using SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}"
+TDNF_OPTIONS=(-y)
+if [[ -n ${SOURCE_DATE_EPOCH:-} ]]; then
+    echo "Using SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}"
+    TDNF_OPTIONS+=("--snapshottime=$SOURCE_DATE_EPOCH")
+fi
 
 retry() {
     local description=$1
@@ -44,14 +47,14 @@ retry() {
 
 install_source_control() {
     # Source control
-    tdnf --snapshottime=$SOURCE_DATE_EPOCH -y install  \
+    tdnf "${TDNF_OPTIONS[@]}" install  \
         git  \
         ca-certificates
 }
 
 install_build_dependencies() {
     # To build CCF
-    tdnf --snapshottime=$SOURCE_DATE_EPOCH -y install  \
+    tdnf "${TDNF_OPTIONS[@]}" install  \
         build-essential  \
         clang  \
         cmake  \
@@ -85,7 +88,7 @@ install_test_dependencies() {
         iptables
         strace
     )
-    tdnf --snapshottime=$SOURCE_DATE_EPOCH -y install "${packages[@]}" &&
+    tdnf "${TDNF_OPTIONS[@]}" install "${packages[@]}" &&
     gem install cddl
 }
 
@@ -106,7 +109,7 @@ install_node() {
     # constraint pins the major version (failing rather than silently selecting
     # an older nodejs); `nodejs-npm` provides npm and depends on that same
     # `nodejs`, so it follows the selected version.
-    tdnf --snapshottime=$SOURCE_DATE_EPOCH -y install  \
+    tdnf "${TDNF_OPTIONS[@]}" install  \
         "nodejs >= 24"  \
         nodejs-npm
 }
@@ -118,7 +121,7 @@ install_packaging_and_python() {
         # For end to end tests and scripts
         python3-pip
     )
-    tdnf --snapshottime=$SOURCE_DATE_EPOCH -y install "${packages[@]}" &&
+    tdnf "${TDNF_OPTIONS[@]}" install "${packages[@]}" &&
     pip install uv==0.11.19
 }