Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/actions/install-ci-run/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,9 @@ runs:
uses: astral-sh/setup-uv@v6
with:
python-version: "3.12"
# `auto` (the default) enables the cache only on GitHub-hosted runners;
# this action also runs on the self-hosted arm64 runner, so force it on.
enable-cache: true
- name: Run Tests
shell: bash
env:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/changelog-check.yml
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,10 @@ jobs:
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: "3.12"
# No `cache: pip` here: the pytest install below is conditional on the
# PR touching tools/changelog/, so on most runs pip never executes and
# ~/.cache/pip is never created. setup-python's post-job save treats a
# missing cache dir as an error and fails the job.

- name: Resolve base ref
id: base
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/docs.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ jobs:
uses: astral-sh/setup-uv@v6
with:
python-version: "3.12"
enable-cache: true

- name: Install docs dependencies
run: |
Expand Down Expand Up @@ -97,6 +98,7 @@ jobs:
uses: astral-sh/setup-uv@v6
with:
python-version: "3.12"
enable-cache: true

- name: Install docs dependencies
run: |
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/kitless-docker.yml
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,8 @@ jobs:
- name: Set up uv
if: steps.detect.outputs.should_run == 'true'
uses: astral-sh/setup-uv@v6
with:
enable-cache: true

- name: Validate kit-less container profile
if: steps.detect.outputs.should_run == 'true'
Expand Down
7 changes: 7 additions & 0 deletions .github/workflows/skills-check.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,13 @@ jobs:
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: "3.12"
cache: pip
# Keyed on this workflow file, not pyproject.toml: the pip cache key is
# otherwise identical across every 3.12 ubuntu job here, so they collide
# and all but the first fail to save. Hashing the workflow also ties
# invalidation to the install list below rather than to unrelated
# dependency churn.
cache-dependency-path: .github/workflows/skills-check.yml

- name: Verify skills
run: python3 tools/skills/cli.py check
Expand Down
7 changes: 7 additions & 0 deletions .github/workflows/tools-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,13 @@ jobs:
- uses: actions/setup-python@v5
with:
python-version: "3.12"
cache: pip
# Keyed on this workflow file, not pyproject.toml: the pip cache key is
# otherwise identical across every 3.12 ubuntu job here, so they collide
# and all but the first fail to save. Hashing the workflow also ties
# invalidation to the install list below rather than to unrelated
# dependency churn.
cache-dependency-path: .github/workflows/tools-tests.yml

# These tests only need pytest, junitparser (imported by tools/crash_journal.py) and
# flaky, so they run without an Isaac Sim install or a full project sync. flaky drives the
Expand Down
22 changes: 19 additions & 3 deletions .github/workflows/wheel.yml
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,25 @@ jobs:
with:
python-version: "3.12"
architecture: x64
cache: pip
# Keyed on this workflow file, not pyproject.toml: the pip cache key is
# otherwise identical across every 3.12 ubuntu job here, so they collide
# and all but the first fail to save. Covers the `build` and `wheel`
# packages that tools/wheel_builder/build.sh installs with pip.
cache-dependency-path: .github/workflows/wheel.yml

# The extras-resolution step below drives uv, whose downloads land in
# ~/.cache/uv rather than pip's cache. Provisioning uv here caches that
# resolution work and drops the ~24 MB `pip install uv` bootstrap.
- name: Set up uv
if: steps.changes.outputs.run_build == 'true'
uses: astral-sh/setup-uv@v6

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Mutable wheel-build action reference

When the upstream v6 tag is moved, this newly added step executes unreviewed third-party code in the wheel job, allowing workflow data, generated artifacts, or cache entries to be compromised. Pin astral-sh/setup-uv to a reviewed full commit SHA, consistent with the other pinned actions in this job.

How this was verified: Every enabled wheel build resolves the mutable astral-sh/setup-uv@v6 reference before building and testing the artifact.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently there is no pinned version of setup-uv used in the rest of the pipeline

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right — the existing astral-sh/setup-uv@v6 references elsewhere in the pipeline (e.g. docs.yaml, kitless-docker.yml, .github/actions/install-ci-run) are all unpinned, and this PR is a faithful backport of #7287. Flagging this here is inconsistent with the established convention in the repo.

That said, using mutable major-version tags for third-party actions is a real supply-chain risk for a workflow that builds and signs release artifacts. If it's something worth addressing, it would be better done as a repo-wide follow-up on develop (pinning all setup-uv and other third-party action references to SHAs) rather than blocking this backport.

Fair point — withdrawing the concern for this PR.

Shall I remember this as a rule: "Do not flag unpinned third-party action tags (@v6, etc.) unless the repo already pins them to commit SHAs — flag it only as a repo-wide issue, not per-file"?

with:
enable-cache: true
# Neither this job nor kitless-docker pins python-version, so both land
# on the same `-unknown-` cache key and only one can save. This job
# caches the wheel's full extras resolution; keep it separate.
cache-suffix: wheel-extras

# Compose Docker-image-style metadata for the artifact. The artifact
# name is what QA sees in `gh run download`, so we make it scannable:
Expand Down Expand Up @@ -177,9 +196,6 @@ jobs:
run: |
set -euo pipefail

bash "$GITHUB_WORKSPACE/.github/actions/_lib/with-python-package-retries.sh" python -m pip install --user uv
export PATH="$HOME/.local/bin:$PATH"

overrides="$GITHUB_WORKSPACE/tools/wheel_builder/uv-overrides.txt"

cd /tmp
Expand Down
5 changes: 5 additions & 0 deletions source/isaaclab/changelog.d/ci-cache-pip-uv.skip
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# No changelog entry / version bump: CI-only change. Enables the pip cache in
# actions/setup-python and the uv cache in astral-sh/setup-uv across the
# workflows that install Python packages, so an index outage no longer fails a
# job once with-python-package-retries.sh exhausts its retries. No source
# package or published wheel is affected.
Loading