[Backport release/3.0.0] Cache pip and uv downloads in GitHub Actions - #7321
Conversation
Python packages were re-downloaded from PyPI on every CI run. Only `license-check.yaml` enabled a package cache; every other workflow that installs Python dependencies did so uncached. Enable `enable-cache: true` for `astral-sh/setup-uv` in `docs.yaml` (both jobs), `kitless-docker.yml`, and `.github/actions/install-ci-run`, and `cache: pip` for `actions/setup-python` in `skills-check.yml`, `tools-tests.yml`, and `wheel.yml`. The wheel job now provisions uv through `setup-uv` under a `wheel-extras` cache suffix instead of bootstrapping it with `pip install --user uv`. `resolve-ov-pins`, `nightly-changelog`, `changelog-check.yml`, and `test-multi-gpu.yaml` stay uncached; the inline comments explain why. (cherry picked from commit d508d95)
Greptile SummaryThis backport enables pip and uv download caching across CI workflows and replaces the wheel job’s pip-based uv bootstrap with setup-uv.
Confidence Score: 3/5The PR should not merge until the newly added setup-uv dependency in the wheel artifact job is pinned to an immutable reviewed commit. The cache configuration is internally consistent, but the new wheel setup step allows a mutable upstream tag to determine code executed in an artifact-building workflow. Files Needing Attention: .github/workflows/wheel.yml
|
| Filename | Overview |
|---|---|
| .github/workflows/wheel.yml | Adds pip and uv caching and replaces the uv bootstrap, but introduces a mutable third-party action reference into the wheel artifact job. |
| .github/actions/install-ci-run/action.yml | Forces setup-uv caching on both GitHub-hosted and self-hosted installation-test runners without changing installation behavior. |
| .github/workflows/docs.yaml | Enables uv caching in both documentation build variants. |
| .github/workflows/kitless-docker.yml | Enables uv caching for the conditional container-profile validation path. |
| .github/workflows/skills-check.yml | Adds a pip cache whose key tracks the workflow’s explicit dependency installation list. |
| .github/workflows/tools-tests.yml | Adds a workflow-specific pip cache for the tools test dependencies. |
| .github/workflows/changelog-check.yml | Documents why caching remains disabled for the conditionally installed test dependencies. |
| source/isaaclab/changelog.d/ci-cache-pip-uv.skip | Records that the caching changes do not affect source packages or published wheels. |
Reviews (1): Last reviewed commit: "[Backport release/3.0.0] Cache pip and u..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| # resolution work and drops the ~24 MB `pip install uv` bootstrap. | ||
| - name: Set up uv | ||
| if: steps.changes.outputs.run_build == 'true' | ||
| uses: astral-sh/setup-uv@v6 |
There was a problem hiding this comment.
When the upstream v6 tag is moved, this newly added step executes unreviewed third-party code in the wheel job, allowing workflow data, generated artifacts, or cache entries to be compromised. Pin astral-sh/setup-uv to a reviewed full commit SHA, consistent with the other pinned actions in this job.
How this was verified: Every enabled wheel build resolves the mutable astral-sh/setup-uv@v6 reference before building and testing the artifact.
There was a problem hiding this comment.
Currently there is no pinned version of setup-uv used in the rest of the pipeline
There was a problem hiding this comment.
You're right — the existing astral-sh/setup-uv@v6 references elsewhere in the pipeline (e.g. docs.yaml, kitless-docker.yml, .github/actions/install-ci-run) are all unpinned, and this PR is a faithful backport of #7287. Flagging this here is inconsistent with the established convention in the repo.
That said, using mutable major-version tags for third-party actions is a real supply-chain risk for a workflow that builds and signs release artifacts. If it's something worth addressing, it would be better done as a repo-wide follow-up on develop (pinning all setup-uv and other third-party action references to SHAs) rather than blocking this backport.
Fair point — withdrawing the concern for this PR.
Shall I remember this as a rule: "Do not flag unpinned third-party action tags (@v6, etc.) unless the repo already pins them to commit SHAs — flag it only as a repo-wide issue, not per-file"?
![isaaclab-review-bot[bot]](https://avatars.githubusercontent.com/u/157846462?s=60&v=4){kind=small}
There was a problem hiding this comment.
Isaac Lab Review Bot
This CI-only backport enables pip and uv download caching across the affected GitHub Actions workflows and replaces the wheel job’s pip-based uv bootstrap with astral-sh/setup-uv. The reviewed changes do not alter source packages or published APIs.
- Design and architecture: The workflow-specific
cache-dependency-pathvalues separate pip cache identities, while the wheel job’swheel-extrassuffix isolates its uv cache from other unversioned setup-uv jobs. The intentionally shared uv keys noted for other workflows affect cache efficiency rather than workflow correctness and are appropriately deferred. - API: No public Python API, CLI, package behavior, or documentation contract changes. The composite
install-ci-runaction now explicitly enables uv caching on all runner types, including its self-hosted arm64 path. The.skipchangelog fragment is appropriate for this CI-only change. - Implementation: The wheel workflow’s new setup-uv step has the same build guard as its consumers, runs before the extras-resolution commands, and supplies
uvon PATH after removal of thepip install --user uvbootstrap. The pip cache configuration is tied to each workflow’s install definition, and workflows without unconditional pip use remain uncached. Cache hit and save behavior remains to be confirmed by the PR’s CI runs.
No blocking issues. No inline issue met the actionable-evidence threshold; the assessment above records the review feedback.
Automated review; human maintainers own approval decisions.
d75d6c6
into
isaac-sim:release/3.0.0
3 participants
Summary
d508d95), cherry-picked with-x; applied with no conflicts and the diff is identical to develop.enable-cache: trueforastral-sh/setup-uvindocs.yaml(both jobs),kitless-docker.yml, and.github/actions/install-ci-run. The composite action sets it explicitly rather than relying on the defaultauto, which enables the cache only on GitHub-hosted runners.cache: pipforactions/setup-pythoninskills-check.yml,tools-tests.yml, andwheel.yml, each keyed on its own workflow file so the jobs do not collide on one cache key.setup-uvunder awheel-extrascache suffix, replacing thepip install --user uvbootstrap.resolve-ov-pins,nightly-changelog,changelog-check.yml, andtest-multi-gpu.yamlstay uncached; the inline comments explain why.CI-only change: no source package touched, so the changelog fragment is a
.skip.Test plan
git diffof this commit is byte-identical to the diff ofd508d95on develop.wheel.ymlcontext this depends on exists onrelease/3.0.0(steps.changes.outputs.run_build, and theuv pip installcalls that now rely onsetup-uvforuv).uv run isaaclab -fpasses.check-changelog-fragmentsreports a pre-existing failure unrelated to this change (it defaults toorigin/develop; withISAACLAB_CHANGELOG_BASE_REF=release/3.0.0it reports all fragments valid).Follow-up (not in this backport)
install-ci-run, bothdocs.yamljobs, and the existinglicense-check.yamlall resolve to the same uv cache key (setup-uv-1-x86_64-unknown-linux-gnu-3.12-pruned-<deps hash>), since the hash covers the repo's dependency files rather than the job. Only one of them can save per ref; the others restore a mismatched payload and skip saving. That needs acache-suffixfix on develop first, then a separate backport.