From f702bba63c6be075532a711cca8718992efba8b2 Mon Sep 17 00:00:00 2001 From: ethernet Date: Fri, 31 Jul 2026 12:12:18 -0400 Subject: [PATCH] perf(ci): drop per-job ripgrep/uv/Python setup, use the baked runner image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Eleven jobs on every push repeated the same three network round-trips before doing any work: download ripgrep from GitHub releases, run astral-sh/setup-uv, then `uv python install 3.11`. The 8 test slices, e2e, lint x2, docker tests, and uv-lockfile-check all paid it, all for identical bytes. Each hop was also a failure mode — the 2026-07-28 slice-5 incident was a transient setup-uv manifest fetch failing a whole job, and pinning the version narrowed that window without closing it. hermes-agent-ci-infra now bakes ripgrep 15.1.0, uv 0.9.28, and CPython 3.11 into nousresearch/nous-gke-runner (same versions, so this is a move not an upgrade), so these steps are pure overhead. Remove them. The wheel cache is the one part of setup-uv still worth having: it is per-workspace, not per-image, and without it `uv sync` re-downloads and re-builds every wheel — the toolchain would be faster to set up and the sync dramatically slower, a net loss. Replace `enable-cache: true` with a small .github/actions/uv-cache composite doing the same actions/cache on ~/.cache/uv, keyed on pyproject.toml + uv.lock. runner.arch is in the key because the cache holds built wheels and docker.yml runs on arm64 too; the restore-keys prefix means a stale hit still saves most of the download, and `uv sync --locked` re-resolves from uv.lock regardless so a partial hit cannot produce a wrong environment. lint.yml and uv-lockfile-check.yml only `uv tool install` / `uv lock --check` and never build a project venv, so they drop the setup step without needing the cache action at all. Verified against the built image, running as the `runner` user with `--network none` so nothing can silently re-download: rg 15.1.0, uv 0.9.28, and `uv python find 3.11` all resolve. With hermes-agent's real pyproject.toml and uv.lock and no setup step of any kind, `uv sync --locked --python 3.11 --extra dev` completes in 3s into a working 3.11.14 venv. actionlint is clean (the remaining arc-runner-set and SC2016 warnings are pre-existing on main). Depends on the image change landing first: pods pull :latest on start, so merging this before the image is pushed breaks every runner. --- .github/actions/uv-cache/action.yml | 24 ++++++++ .github/workflows/docker.yml | 15 ++--- .github/workflows/e2e-desktop.yml | 19 ++---- .github/workflows/lint.yml | 20 ++----- .github/workflows/tests.yml | 78 ++++--------------------- .github/workflows/uv-lockfile-check.yml | 10 +--- 6 files changed, 53 insertions(+), 113 deletions(-) create mode 100644 .github/actions/uv-cache/action.yml diff --git a/.github/actions/uv-cache/action.yml b/.github/actions/uv-cache/action.yml new file mode 100644 index 00000000000..b9ee805a190 --- /dev/null +++ b/.github/actions/uv-cache/action.yml @@ -0,0 +1,24 @@ +name: Cache uv downloads +description: >- + Persist uv's download/wheel cache (~/.cache/uv) across runs, keyed on the + dependency manifests. This is the half of astral-sh/setup-uv we still need: + uv itself and CPython 3.11 are baked into the nousresearch/nous-gke-runner + image (see hermes-agent-ci-infra runner/Dockerfile), but the wheel cache is + per-workspace and must still be restored. Without it `uv sync` re-downloads + and re-builds every wheel on every job — the toolchain would be faster to + set up and the sync dramatically slower, a net loss. + +runs: + using: composite + steps: + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: ~/.cache/uv + # runner.arch in the key: the cache holds built wheels, which are + # arch-specific — the docker workflow runs this on arm64 too. + key: uv-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pyproject.toml', 'uv.lock') }} + # Fall back to any older cache for this arch: a stale wheel set still + # saves most of the download, and `uv sync --locked` re-resolves from + # uv.lock regardless, so a partial hit can't produce a wrong env. + restore-keys: | + uv-cache-${{ runner.os }}-${{ runner.arch }}- diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 31c3375db3a..50c88bb25d2 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -154,16 +154,11 @@ jobs: # than the build itself. Reusing the existing daemon state is the # cheapest path to coverage on every PR that touches docker code. # --------------------------------------------------------------------- - - name: Install uv (for docker tests) - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0 - with: - # Pinned: unpinned setup-uv fetches a 'latest' manifest from - # raw.githubusercontent.com every job; transient fetch failures - # fail the job (2026-07-28 incident). Keep in sync with tests.yml. - version: '0.9.28' - - - name: Set up Python 3.11 (for docker tests) - run: uv python install 3.11 + # uv and CPython 3.11 are baked into the nousresearch/nous-gke-runner + # image (hermes-agent-ci-infra runner/Dockerfile) — no setup-uv, no + # `uv python install`. + - name: Restore uv cache (for docker tests) + uses: ./.github/actions/uv-cache - name: Install Python dependencies (for docker tests) # ``dev`` extra pulls in pytest, pytest-asyncio — diff --git a/.github/workflows/e2e-desktop.yml b/.github/workflows/e2e-desktop.yml index 8d4487ef70a..a3ee1fe42cd 100644 --- a/.github/workflows/e2e-desktop.yml +++ b/.github/workflows/e2e-desktop.yml @@ -59,20 +59,11 @@ jobs: if: steps.npm-cache.outputs.cache-hit != 'true' # ── Python (for the hermes serve backend) ────────────────────────── - - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0 - with: - # Pin the uv version: unpinned, setup-uv resolves "latest" by - # fetching a manifest from raw.githubusercontent.com on EVERY job — - # a transient fetch failure fails the whole job (2026-07-28 slice-5 - # incident). Pinned, the binary downloads directly; no manifest hop. - version: "0.9.28" - enable-cache: true - cache-dependency-glob: | - pyproject.toml - uv.lock - - name: Set up Python 3.11 - run: uv python install 3.11 + # uv and CPython 3.11 are baked into the nousresearch/nous-gke-runner + # image (hermes-agent-ci-infra runner/Dockerfile) — no setup-uv, no + # `uv python install`. + - name: Restore uv cache + uses: ./.github/actions/uv-cache - name: Install Python dependencies uses: ./.github/actions/retry with: diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index fffd59c0ecd..43c278b24ae 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -38,13 +38,9 @@ jobs: with: fetch-depth: 0 # need full history for merge-base + worktree - - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0 - with: - # Pinned: unpinned setup-uv fetches a 'latest' manifest from - # raw.githubusercontent.com every job; transient fetch failures - # fail the job (2026-07-28 incident). Keep in sync with tests.yml. - version: "0.9.28" + # uv and CPython 3.11 are baked into the nousresearch/nous-gke-runner + # image (hermes-agent-ci-infra runner/Dockerfile) — no setup-uv, no + # `uv python install`. - name: Install ruff + ty uses: ./.github/actions/retry @@ -132,13 +128,9 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0 - with: - # Pinned: unpinned setup-uv fetches a 'latest' manifest from - # raw.githubusercontent.com every job; transient fetch failures - # fail the job (2026-07-28 incident). Keep in sync with tests.yml. - version: "0.9.28" + # uv and CPython 3.11 are baked into the nousresearch/nous-gke-runner + # image (hermes-agent-ci-infra runner/Dockerfile) — no setup-uv, no + # `uv python install`. - name: Install ruff uses: ./.github/actions/retry diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index d0c0a861961..97e12357f7b 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -57,40 +57,11 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Install ripgrep (prebuilt binary) - run: | - set -euo pipefail - RG_VERSION=15.1.0 - RG_SHA256=1c9297be4a084eea7ecaedf93eb03d058d6faae29bbc57ecdaf5063921491599 - RG_TARBALL=ripgrep-${RG_VERSION}-x86_64-unknown-linux-musl.tar.gz - curl -sSfL --retry 3 --retry-delay 5 -o "$RG_TARBALL" \ - "https://github.com/BurntSushi/ripgrep/releases/download/${RG_VERSION}/${RG_TARBALL}" - echo "${RG_SHA256} ${RG_TARBALL}" | sha256sum -c - - tar -xzf "$RG_TARBALL" - sudo mv "ripgrep-${RG_VERSION}-x86_64-unknown-linux-musl/rg" /usr/local/bin/rg - rm -rf "$RG_TARBALL" "ripgrep-${RG_VERSION}-x86_64-unknown-linux-musl" - rg --version - - - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0 - with: - # Pin the uv version: unpinned, setup-uv resolves "latest" by - # fetching a manifest from raw.githubusercontent.com on EVERY job — - # a transient fetch failure fails the whole job (2026-07-28 slice-5 - # incident). Pinned, the binary downloads directly; no manifest hop. - version: "0.9.28" - # Persist uv's download/wheel cache (~/.cache/uv) across runs. - # Keyed on the dependency manifests, so the cache is reused until - # pyproject.toml or uv.lock changes. `uv sync` still runs every - # time, but resolves from the warm cache instead of re-downloading - # and re-building wheels. - enable-cache: true - cache-dependency-glob: | - pyproject.toml - uv.lock - - - name: Set up Python 3.11 - run: uv python install 3.11 + # uv and CPython 3.11 are baked into the nousresearch/nous-gke-runner + # image (hermes-agent-ci-infra runner/Dockerfile) — no setup-uv, no + # `uv python install`. Only the wheel cache still needs restoring. + - name: Restore uv cache + uses: ./.github/actions/uv-cache - name: Install dependencies # `uv sync --locked` installs the exact pinned set from uv.lock (and @@ -188,40 +159,11 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Install ripgrep (prebuilt binary) - run: | - set -euo pipefail - RG_VERSION=15.1.0 - RG_SHA256=1c9297be4a084eea7ecaedf93eb03d058d6faae29bbc57ecdaf5063921491599 - RG_TARBALL=ripgrep-${RG_VERSION}-x86_64-unknown-linux-musl.tar.gz - curl -sSfL --retry 3 --retry-delay 5 -o "$RG_TARBALL" \ - "https://github.com/BurntSushi/ripgrep/releases/download/${RG_VERSION}/${RG_TARBALL}" - echo "${RG_SHA256} ${RG_TARBALL}" | sha256sum -c - - tar -xzf "$RG_TARBALL" - sudo mv "ripgrep-${RG_VERSION}-x86_64-unknown-linux-musl/rg" /usr/local/bin/rg - rm -rf "$RG_TARBALL" "ripgrep-${RG_VERSION}-x86_64-unknown-linux-musl" - rg --version - - - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0 - with: - # Pin the uv version: unpinned, setup-uv resolves "latest" by - # fetching a manifest from raw.githubusercontent.com on EVERY job — - # a transient fetch failure fails the whole job (2026-07-28 slice-5 - # incident). Pinned, the binary downloads directly; no manifest hop. - version: "0.9.28" - # Persist uv's download/wheel cache (~/.cache/uv) across runs. - # Keyed on the dependency manifests, so the cache is reused until - # pyproject.toml or uv.lock changes. `uv sync` still runs every - # time, but resolves from the warm cache instead of re-downloading - # and re-building wheels. - enable-cache: true - cache-dependency-glob: | - pyproject.toml - uv.lock - - - name: Set up Python 3.11 - run: uv python install 3.11 + # uv and CPython 3.11 are baked into the nousresearch/nous-gke-runner + # image (hermes-agent-ci-infra runner/Dockerfile) — no setup-uv, no + # `uv python install`. Only the wheel cache still needs restoring. + - name: Restore uv cache + uses: ./.github/actions/uv-cache - name: Install dependencies # `uv sync --locked` installs the exact pinned set from uv.lock (and diff --git a/.github/workflows/uv-lockfile-check.yml b/.github/workflows/uv-lockfile-check.yml index 4fb733cb5af..dd692fb166c 100644 --- a/.github/workflows/uv-lockfile-check.yml +++ b/.github/workflows/uv-lockfile-check.yml @@ -68,13 +68,9 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0 - with: - # Pinned: unpinned setup-uv fetches a 'latest' manifest from - # raw.githubusercontent.com every job; transient fetch failures - # fail the job (2026-07-28 incident). Keep in sync with tests.yml. - version: "0.9.28" + # uv and CPython 3.11 are baked into the nousresearch/nous-gke-runner + # image (hermes-agent-ci-infra runner/Dockerfile) — no setup-uv, no + # `uv python install`. # `uv lock --check` re-resolves the project from pyproject.toml and # compares the result to uv.lock, exiting non-zero if they disagree.