From 5cbcaac8653dfaf8206412b433168e4860dea703 Mon Sep 17 00:00:00 2001
From: Vyas Ramasubramani <vyasr@nvidia.com>
Date: Wed, 9 Sep 2026 09:00:59 -0700
Subject: [PATCH 1/7] fix: hash multiline caller cache key files

---
 .github/workflows/conda-cpp-build.yaml    | 26 +++++++++++++++++++++--
 .github/workflows/conda-cpp-tests.yaml    | 26 +++++++++++++++++++++--
 .github/workflows/conda-python-build.yaml | 26 +++++++++++++++++++++--
 .github/workflows/conda-python-tests.yaml | 26 +++++++++++++++++++++--
 .github/workflows/wheels-build.yaml       | 26 +++++++++++++++++++++--
 .github/workflows/wheels-test.yaml        | 26 +++++++++++++++++++++--
 6 files changed, 144 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml
index 98c353bb..03fb4698 100644
--- a/.github/workflows/conda-cpp-build.yaml
+++ b/.github/workflows/conda-cpp-build.yaml
@@ -88,7 +88,7 @@ on:
         required: false
         default: ""
         description: |
-          Newline-separated files or glob patterns to hash into the cache key. Use this for caches
+          Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
       cache-environment:
         type: string
@@ -161,12 +161,34 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
+      - name: Hash caller cache key files
+        if: inputs.cache-paths != ''
+        id: caller-cache
+        run: |
+          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
+            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+          key_files=$(mktemp)
+          trap 'rm -f "${key_files}"' EXIT
+          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+          if test -s "${key_files}"; then
+            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+          else
+            key_files_hash=none
+          fi
+          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
       - name: Cache caller paths
         if: inputs.cache-paths != ''
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ hashFiles(inputs.cache-key-files) }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml
index 8ec8e2d5..452f1508 100644
--- a/.github/workflows/conda-cpp-tests.yaml
+++ b/.github/workflows/conda-cpp-tests.yaml
@@ -94,7 +94,7 @@ on:
         required: false
         default: ""
         description: |
-          Newline-separated files or glob patterns to hash into the cache key. Use this for caches
+          Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
       cache-environment:
         type: string
@@ -203,12 +203,34 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
+      - name: Hash caller cache key files
+        if: inputs.cache-paths != ''
+        id: caller-cache
+        run: |
+          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
+            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+          key_files=$(mktemp)
+          trap 'rm -f "${key_files}"' EXIT
+          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+          if test -s "${key_files}"; then
+            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+          else
+            key_files_hash=none
+          fi
+          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
       - name: Cache caller paths
         if: inputs.cache-paths != ''
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ hashFiles(inputs.cache-key-files) }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
             ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
       - name: Configure caller cache environment
diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml
index 33c239b9..765698ac 100644
--- a/.github/workflows/conda-python-build.yaml
+++ b/.github/workflows/conda-python-build.yaml
@@ -98,7 +98,7 @@ on:
         required: false
         default: ""
         description: |
-          Newline-separated files or glob patterns to hash into the cache key. Use this for caches
+          Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
       cache-environment:
         type: string
@@ -171,12 +171,34 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
+      - name: Hash caller cache key files
+        if: inputs.cache-paths != ''
+        id: caller-cache
+        run: |
+          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
+            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+          key_files=$(mktemp)
+          trap 'rm -f "${key_files}"' EXIT
+          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+          if test -s "${key_files}"; then
+            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+          else
+            key_files_hash=none
+          fi
+          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
       - name: Cache caller paths
         if: inputs.cache-paths != ''
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ hashFiles(inputs.cache-key-files) }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
diff --git a/.github/workflows/conda-python-tests.yaml b/.github/workflows/conda-python-tests.yaml
index f31d8c2a..13c7e764 100644
--- a/.github/workflows/conda-python-tests.yaml
+++ b/.github/workflows/conda-python-tests.yaml
@@ -97,7 +97,7 @@ on:
         required: false
         default: ""
         description: |
-          Newline-separated files or glob patterns to hash into the cache key. Use this for caches
+          Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
       cache-environment:
         type: string
@@ -218,12 +218,34 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
+      - name: Hash caller cache key files
+        if: inputs.cache-paths != ''
+        id: caller-cache
+        run: |
+          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
+            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+          key_files=$(mktemp)
+          trap 'rm -f "${key_files}"' EXIT
+          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+          if test -s "${key_files}"; then
+            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+          else
+            key_files_hash=none
+          fi
+          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
       - name: Cache caller paths
         if: inputs.cache-paths != ''
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ hashFiles(inputs.cache-key-files) }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
             ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
       - name: Configure caller cache environment
diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml
index f8705584..a714c109 100644
--- a/.github/workflows/wheels-build.yaml
+++ b/.github/workflows/wheels-build.yaml
@@ -128,7 +128,7 @@ on:
         required: false
         default: ""
         description: |
-          Newline-separated files or glob patterns to hash into the cache key. Use this for caches
+          Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
       cache-environment:
         type: string
@@ -204,12 +204,34 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
+      - name: Hash caller cache key files
+        if: inputs.cache-paths != ''
+        id: caller-cache
+        run: |
+          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
+            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+          key_files=$(mktemp)
+          trap 'rm -f "${key_files}"' EXIT
+          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+          if test -s "${key_files}"; then
+            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+          else
+            key_files_hash=none
+          fi
+          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
       - name: Cache caller paths
         if: inputs.cache-paths != ''
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ hashFiles(inputs.cache-key-files) }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
diff --git a/.github/workflows/wheels-test.yaml b/.github/workflows/wheels-test.yaml
index 031d90ed..9e3e0306 100644
--- a/.github/workflows/wheels-test.yaml
+++ b/.github/workflows/wheels-test.yaml
@@ -113,7 +113,7 @@ on:
         required: false
         default: ""
         description: |
-          Newline-separated files or glob patterns to hash into the cache key. Use this for caches
+          Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
       cache-environment:
         type: string
@@ -226,12 +226,34 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
+      - name: Hash caller cache key files
+        if: inputs.cache-paths != ''
+        id: caller-cache
+        run: |
+          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
+            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+          key_files=$(mktemp)
+          trap 'rm -f "${key_files}"' EXIT
+          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+          if test -s "${key_files}"; then
+            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+          else
+            key_files_hash=none
+          fi
+          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
       - name: Cache caller paths
         if: inputs.cache-paths != ''
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ hashFiles(inputs.cache-key-files) }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
             ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
       - name: Configure caller cache environment

From 3dd7d3ae3390eee3159052be4af264e4ef20b46a Mon Sep 17 00:00:00 2001
From: Vyas Ramasubramani <vyasr@nvidia.com>
Date: Wed, 9 Sep 2026 11:21:50 -0700
Subject: [PATCH 2/7] fix: restore caller caches without saving

---
 .github/workflows/conda-cpp-tests.yaml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml
index 452f1508..2252ea16 100644
--- a/.github/workflows/conda-cpp-tests.yaml
+++ b/.github/workflows/conda-cpp-tests.yaml
@@ -96,6 +96,13 @@ on:
         description: |
           Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
+      cache-read-only:
+        type: boolean
+        required: false
+        default: false
+        description: |
+          Restore caller cache paths without saving them at job completion. Use this for untrusted or
+          short-lived workflow refs that should consume caches maintained by a trusted workflow.
       cache-environment:
         type: string
         required: false
@@ -225,8 +232,16 @@ jobs:
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+      - name: Restore caller cache paths
+        if: inputs.cache-paths != '' && inputs.cache-read-only
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ inputs.cache-paths }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: |
+            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
       - name: Cache caller paths
-        if: inputs.cache-paths != ''
+        if: inputs.cache-paths != '' && inputs.cache-read-only == false
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}

From e01ca11afe335e95cccf24bbc48b0cc2a23f9a48 Mon Sep 17 00:00:00 2001
From: Vyas Ramasubramani <vyasr@nvidia.com>
Date: Wed, 9 Sep 2026 11:28:49 -0700
Subject: [PATCH 3/7] Revert "fix: restore caller caches without saving"

This reverts commit 3dd7d3ae3390eee3159052be4af264e4ef20b46a.
---
 .github/workflows/conda-cpp-tests.yaml | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml
index 2252ea16..452f1508 100644
--- a/.github/workflows/conda-cpp-tests.yaml
+++ b/.github/workflows/conda-cpp-tests.yaml
@@ -96,13 +96,6 @@ on:
         description: |
           Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
-      cache-read-only:
-        type: boolean
-        required: false
-        default: false
-        description: |
-          Restore caller cache paths without saving them at job completion. Use this for untrusted or
-          short-lived workflow refs that should consume caches maintained by a trusted workflow.
       cache-environment:
         type: string
         required: false
@@ -232,16 +225,8 @@ jobs:
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
-      - name: Restore caller cache paths
-        if: inputs.cache-paths != '' && inputs.cache-read-only
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
       - name: Cache caller paths
-        if: inputs.cache-paths != '' && inputs.cache-read-only == false
+        if: inputs.cache-paths != ''
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}

From bc674bb58acb0a79a3301b663db06e75ce4d8761 Mon Sep 17 00:00:00 2001
From: Vyas Ramasubramani <vyasr@nvidia.com>
Date: Wed, 9 Sep 2026 13:37:23 -0700
Subject: [PATCH 4/7] feat: support read-only caller caches

---
 .github/workflows/conda-cpp-build.yaml    | 16 +++++++++++++++-
 .github/workflows/conda-cpp-tests.yaml    | 17 ++++++++++++++++-
 .github/workflows/conda-python-build.yaml | 16 +++++++++++++++-
 .github/workflows/conda-python-tests.yaml | 17 ++++++++++++++++-
 .github/workflows/wheels-build.yaml       | 16 +++++++++++++++-
 .github/workflows/wheels-test.yaml        | 17 ++++++++++++++++-
 6 files changed, 93 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml
index 03fb4698..10ecb0a3 100644
--- a/.github/workflows/conda-cpp-build.yaml
+++ b/.github/workflows/conda-cpp-build.yaml
@@ -97,6 +97,13 @@ on:
         description: |
           Newline-separated literal NAME=VALUE pairs exported before the caller script runs.
           Use workspace-relative paths for directories managed by cache-paths.
+      cache-read-only:
+        type: boolean
+        required: false
+        default: false
+        description: |
+          Restore caller cache paths without saving them at job completion. Use this for
+          short-lived refs that should consume a cache maintained by a trusted ref.
 
 defaults:
   run:
@@ -183,8 +190,15 @@ jobs:
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+      - name: Restore caller cache paths
+        if: inputs.cache-paths != '' && inputs.cache-read-only
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ inputs.cache-paths }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
       - name: Cache caller paths
-        if: inputs.cache-paths != ''
+        if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml
index 452f1508..4ac69419 100644
--- a/.github/workflows/conda-cpp-tests.yaml
+++ b/.github/workflows/conda-cpp-tests.yaml
@@ -103,6 +103,13 @@ on:
         description: |
           Newline-separated literal NAME=VALUE pairs exported before the caller script runs.
           Use workspace-relative paths for directories managed by cache-paths.
+      cache-read-only:
+        type: boolean
+        required: false
+        default: false
+        description: |
+          Restore caller cache paths without saving them at job completion. Use this for
+          short-lived refs that should consume a cache maintained by a trusted ref.
     secrets:
       script-env-secret-1-key:
         description: |
@@ -225,8 +232,16 @@ jobs:
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+      - name: Restore caller cache paths
+        if: inputs.cache-paths != '' && inputs.cache-read-only
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ inputs.cache-paths }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: |
+            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
       - name: Cache caller paths
-        if: inputs.cache-paths != ''
+        if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml
index 765698ac..df6b0b71 100644
--- a/.github/workflows/conda-python-build.yaml
+++ b/.github/workflows/conda-python-build.yaml
@@ -107,6 +107,13 @@ on:
         description: |
           Newline-separated literal NAME=VALUE pairs exported before the caller script runs.
           Use workspace-relative paths for directories managed by cache-paths.
+      cache-read-only:
+        type: boolean
+        required: false
+        default: false
+        description: |
+          Restore caller cache paths without saving them at job completion. Use this for
+          short-lived refs that should consume a cache maintained by a trusted ref.
 
 defaults:
   run:
@@ -193,8 +200,15 @@ jobs:
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+      - name: Restore caller cache paths
+        if: inputs.cache-paths != '' && inputs.cache-read-only
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ inputs.cache-paths }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
       - name: Cache caller paths
-        if: inputs.cache-paths != ''
+        if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
diff --git a/.github/workflows/conda-python-tests.yaml b/.github/workflows/conda-python-tests.yaml
index 13c7e764..5d078559 100644
--- a/.github/workflows/conda-python-tests.yaml
+++ b/.github/workflows/conda-python-tests.yaml
@@ -106,6 +106,13 @@ on:
         description: |
           Newline-separated literal NAME=VALUE pairs exported before the caller script runs. Use
           workspace-relative paths for directories managed by cache-paths.
+      cache-read-only:
+        type: boolean
+        required: false
+        default: false
+        description: |
+          Restore caller cache paths without saving them at job completion. Use this for
+          short-lived refs that should consume a cache maintained by a trusted ref.
     secrets:
       script-env-secret-1-key:
         description: |
@@ -240,8 +247,16 @@ jobs:
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+      - name: Restore caller cache paths
+        if: inputs.cache-paths != '' && inputs.cache-read-only
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ inputs.cache-paths }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: |
+            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
       - name: Cache caller paths
-        if: inputs.cache-paths != ''
+        if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml
index a714c109..dc7984ec 100644
--- a/.github/workflows/wheels-build.yaml
+++ b/.github/workflows/wheels-build.yaml
@@ -137,6 +137,13 @@ on:
         description: |
           Newline-separated literal NAME=VALUE pairs exported before the caller script runs.
           Use workspace-relative paths for directories managed by cache-paths.
+      cache-read-only:
+        type: boolean
+        required: false
+        default: false
+        description: |
+          Restore caller cache paths without saving them at job completion. Use this for
+          short-lived refs that should consume a cache maintained by a trusted ref.
 
 defaults:
   run:
@@ -226,8 +233,15 @@ jobs:
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+      - name: Restore caller cache paths
+        if: inputs.cache-paths != '' && inputs.cache-read-only
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ inputs.cache-paths }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
       - name: Cache caller paths
-        if: inputs.cache-paths != ''
+        if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
diff --git a/.github/workflows/wheels-test.yaml b/.github/workflows/wheels-test.yaml
index 9e3e0306..299d9911 100644
--- a/.github/workflows/wheels-test.yaml
+++ b/.github/workflows/wheels-test.yaml
@@ -122,6 +122,13 @@ on:
         description: |
           Newline-separated literal NAME=VALUE pairs exported before the caller script runs. Use
           workspace-relative paths for directories managed by cache-paths.
+      cache-read-only:
+        type: boolean
+        required: false
+        default: false
+        description: |
+          Restore caller cache paths without saving them at job completion. Use this for
+          short-lived refs that should consume a cache maintained by a trusted ref.
     secrets:
       script-env-secret-1-key:
         description: |
@@ -248,8 +255,16 @@ jobs:
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+      - name: Restore caller cache paths
+        if: inputs.cache-paths != '' && inputs.cache-read-only
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ inputs.cache-paths }}
+          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: |
+            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
       - name: Cache caller paths
-        if: inputs.cache-paths != ''
+        if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}

From f78ccb8bd82e79377a9fb5a507dda3a23966ad76 Mon Sep 17 00:00:00 2001
From: Vyas Ramasubramani <vyasr@nvidia.com>
Date: Wed, 9 Sep 2026 13:41:32 -0700
Subject: [PATCH 5/7] feat: configure caller cache matrix keys

---
 .github/workflows/conda-cpp-build.yaml    | 52 ++++++++++++++-------
 .github/workflows/conda-cpp-tests.yaml    | 55 ++++++++++++++++-------
 .github/workflows/conda-python-build.yaml | 52 ++++++++++++++-------
 .github/workflows/conda-python-tests.yaml | 55 ++++++++++++++++-------
 .github/workflows/wheels-build.yaml       | 52 ++++++++++++++-------
 .github/workflows/wheels-test.yaml        | 55 ++++++++++++++++-------
 6 files changed, 219 insertions(+), 102 deletions(-)

diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml
index 10ecb0a3..46defa7b 100644
--- a/.github/workflows/conda-cpp-build.yaml
+++ b/.github/workflows/conda-cpp-build.yaml
@@ -90,6 +90,17 @@ on:
         description: |
           Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
+      cache-key-matrix-fields:
+        type: string
+        required: false
+        default: |
+          CUDA_VER
+          PY_VER
+          ARCH
+          LINUX_VER
+        description: |
+          Newline-separated matrix fields that scope the caller cache key. Override only when the
+          cache is known to be independent of one of this workflow's default compatibility fields.
       cache-environment:
         type: string
         required: false
@@ -168,42 +179,49 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Hash caller cache key files
+      - name: Compute caller cache key
         if: inputs.cache-paths != ''
         id: caller-cache
         run: |
           if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-          key_files=$(mktemp)
-          trap 'rm -f "${key_files}"' EXIT
-          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-          if test -s "${key_files}"; then
-            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-          else
             key_files_hash=none
+          else
+            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+            key_files=$(mktemp)
+            trap 'rm -f "${key_files}"' EXIT
+            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+            if test -s "${key_files}"; then
+              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+            else
+              key_files_hash=none
+            fi
           fi
+
+          matrix_key=$(jq -er --raw-output \
+            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
+            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
+            <<< "${MATRIX}")
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
+          MATRIX: ${{ toJSON(matrix) }}
       - name: Restore caller cache paths
         if: inputs.cache-paths != '' && inputs.cache-read-only
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Cache caller paths
         if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
         run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml
index 4ac69419..f19dd8a0 100644
--- a/.github/workflows/conda-cpp-tests.yaml
+++ b/.github/workflows/conda-cpp-tests.yaml
@@ -96,6 +96,20 @@ on:
         description: |
           Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
+      cache-key-matrix-fields:
+        type: string
+        required: false
+        default: |
+          CUDA_VER
+          PY_VER
+          ARCH
+          LINUX_VER
+          GPU
+          DRIVER
+          DEPENDENCIES
+        description: |
+          Newline-separated matrix fields that scope the caller cache key. Override only when the
+          cache is known to be independent of one of this workflow's default compatibility fields.
       cache-environment:
         type: string
         required: false
@@ -210,44 +224,51 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Hash caller cache key files
+      - name: Compute caller cache key
         if: inputs.cache-paths != ''
         id: caller-cache
         run: |
           if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-          key_files=$(mktemp)
-          trap 'rm -f "${key_files}"' EXIT
-          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-          if test -s "${key_files}"; then
-            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-          else
             key_files_hash=none
+          else
+            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+            key_files=$(mktemp)
+            trap 'rm -f "${key_files}"' EXIT
+            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+            if test -s "${key_files}"; then
+              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+            else
+              key_files_hash=none
+            fi
           fi
+
+          matrix_key=$(jq -er --raw-output \
+            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
+            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
+            <<< "${MATRIX}")
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
+          MATRIX: ${{ toJSON(matrix) }}
       - name: Restore caller cache paths
         if: inputs.cache-paths != '' && inputs.cache-read-only
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
+            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Cache caller paths
         if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
+            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
         run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml
index df6b0b71..26928b9f 100644
--- a/.github/workflows/conda-python-build.yaml
+++ b/.github/workflows/conda-python-build.yaml
@@ -100,6 +100,17 @@ on:
         description: |
           Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
+      cache-key-matrix-fields:
+        type: string
+        required: false
+        default: |
+          CUDA_VER
+          PY_VER
+          ARCH
+          LINUX_VER
+        description: |
+          Newline-separated matrix fields that scope the caller cache key. Override only when the
+          cache is known to be independent of one of this workflow's default compatibility fields.
       cache-environment:
         type: string
         required: false
@@ -178,42 +189,49 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Hash caller cache key files
+      - name: Compute caller cache key
         if: inputs.cache-paths != ''
         id: caller-cache
         run: |
           if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-          key_files=$(mktemp)
-          trap 'rm -f "${key_files}"' EXIT
-          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-          if test -s "${key_files}"; then
-            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-          else
             key_files_hash=none
+          else
+            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+            key_files=$(mktemp)
+            trap 'rm -f "${key_files}"' EXIT
+            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+            if test -s "${key_files}"; then
+              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+            else
+              key_files_hash=none
+            fi
           fi
+
+          matrix_key=$(jq -er --raw-output \
+            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
+            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
+            <<< "${MATRIX}")
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
+          MATRIX: ${{ toJSON(matrix) }}
       - name: Restore caller cache paths
         if: inputs.cache-paths != '' && inputs.cache-read-only
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Cache caller paths
         if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
         run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
diff --git a/.github/workflows/conda-python-tests.yaml b/.github/workflows/conda-python-tests.yaml
index 5d078559..1465c240 100644
--- a/.github/workflows/conda-python-tests.yaml
+++ b/.github/workflows/conda-python-tests.yaml
@@ -99,6 +99,20 @@ on:
         description: |
           Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
+      cache-key-matrix-fields:
+        type: string
+        required: false
+        default: |
+          CUDA_VER
+          PY_VER
+          ARCH
+          LINUX_VER
+          GPU
+          DRIVER
+          DEPENDENCIES
+        description: |
+          Newline-separated matrix fields that scope the caller cache key. Override only when the
+          cache is known to be independent of one of this workflow's default compatibility fields.
       cache-environment:
         type: string
         required: false
@@ -225,44 +239,51 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Hash caller cache key files
+      - name: Compute caller cache key
         if: inputs.cache-paths != ''
         id: caller-cache
         run: |
           if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-          key_files=$(mktemp)
-          trap 'rm -f "${key_files}"' EXIT
-          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-          if test -s "${key_files}"; then
-            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-          else
             key_files_hash=none
+          else
+            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+            key_files=$(mktemp)
+            trap 'rm -f "${key_files}"' EXIT
+            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+            if test -s "${key_files}"; then
+              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+            else
+              key_files_hash=none
+            fi
           fi
+
+          matrix_key=$(jq -er --raw-output \
+            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
+            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
+            <<< "${MATRIX}")
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
+          MATRIX: ${{ toJSON(matrix) }}
       - name: Restore caller cache paths
         if: inputs.cache-paths != '' && inputs.cache-read-only
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
+            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Cache caller paths
         if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
+            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
         run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml
index dc7984ec..e6f13645 100644
--- a/.github/workflows/wheels-build.yaml
+++ b/.github/workflows/wheels-build.yaml
@@ -130,6 +130,17 @@ on:
         description: |
           Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
+      cache-key-matrix-fields:
+        type: string
+        required: false
+        default: |
+          CUDA_VER
+          PY_VER
+          ARCH
+          LINUX_VER
+        description: |
+          Newline-separated matrix fields that scope the caller cache key. Override only when the
+          cache is known to be independent of one of this workflow's default compatibility fields.
       cache-environment:
         type: string
         required: false
@@ -211,42 +222,49 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Hash caller cache key files
+      - name: Compute caller cache key
         if: inputs.cache-paths != ''
         id: caller-cache
         run: |
           if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-          key_files=$(mktemp)
-          trap 'rm -f "${key_files}"' EXIT
-          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-          if test -s "${key_files}"; then
-            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-          else
             key_files_hash=none
+          else
+            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+            key_files=$(mktemp)
+            trap 'rm -f "${key_files}"' EXIT
+            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+            if test -s "${key_files}"; then
+              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+            else
+              key_files_hash=none
+            fi
           fi
+
+          matrix_key=$(jq -er --raw-output \
+            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
+            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
+            <<< "${MATRIX}")
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
+          MATRIX: ${{ toJSON(matrix) }}
       - name: Restore caller cache paths
         if: inputs.cache-paths != '' && inputs.cache-read-only
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Cache caller paths
         if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
         run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
diff --git a/.github/workflows/wheels-test.yaml b/.github/workflows/wheels-test.yaml
index 299d9911..93a89975 100644
--- a/.github/workflows/wheels-test.yaml
+++ b/.github/workflows/wheels-test.yaml
@@ -115,6 +115,20 @@ on:
         description: |
           Newline-separated tracked files or glob patterns to hash into the cache key. Use this for caches
           that must be saved again when relevant source or dependency files change.
+      cache-key-matrix-fields:
+        type: string
+        required: false
+        default: |
+          CUDA_VER
+          PY_VER
+          ARCH
+          LINUX_VER
+          GPU
+          DRIVER
+          DEPENDENCIES
+        description: |
+          Newline-separated matrix fields that scope the caller cache key. Override only when the
+          cache is known to be independent of one of this workflow's default compatibility fields.
       cache-environment:
         type: string
         required: false
@@ -233,44 +247,51 @@ jobs:
         env:
           INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
           INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Hash caller cache key files
+      - name: Compute caller cache key
         if: inputs.cache-paths != ''
         id: caller-cache
         run: |
           if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            echo "key-files-hash=none" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-          key_files=$(mktemp)
-          trap 'rm -f "${key_files}"' EXIT
-          git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-          if test -s "${key_files}"; then
-            key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-          else
             key_files_hash=none
+          else
+            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
+            key_files=$(mktemp)
+            trap 'rm -f "${key_files}"' EXIT
+            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
+
+            if test -s "${key_files}"; then
+              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
+            else
+              key_files_hash=none
+            fi
           fi
+
+          matrix_key=$(jq -er --raw-output \
+            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
+            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
+            <<< "${MATRIX}")
           echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
+          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
         env:
           INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
+          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
+          MATRIX: ${{ toJSON(matrix) }}
       - name: Restore caller cache paths
         if: inputs.cache-paths != '' && inputs.cache-read-only
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
+            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Cache caller paths
         if: inputs.cache-paths != '' && !inputs.cache-read-only
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-${{ steps.caller-cache.outputs.key-files-hash }}
+          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
           restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ matrix.CUDA_VER }}-${{ matrix.PY_VER }}-${{ matrix.ARCH }}-${{ matrix.LINUX_VER }}-${{ matrix.GPU }}-${{ matrix.DRIVER }}-${{ matrix.DEPENDENCIES }}-
+            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
       - name: Configure caller cache environment
         if: inputs.cache-environment != ''
         run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"

From 3d65113a579c558350ccf0ecf907b8233ca280d9 Mon Sep 17 00:00:00 2001
From: Vyas Ramasubramani <vyasr@nvidia.com>
Date: Wed, 9 Sep 2026 21:39:21 -0700
Subject: [PATCH 6/7] refactor: reuse caller cache setup action

---
 .github/workflows/conda-cpp-build.yaml    | 65 +++-------------------
 .github/workflows/conda-cpp-tests.yaml    | 67 +++--------------------
 .github/workflows/conda-python-build.yaml | 65 +++-------------------
 .github/workflows/conda-python-tests.yaml | 67 +++--------------------
 .github/workflows/wheels-build.yaml       | 65 +++-------------------
 .github/workflows/wheels-test.yaml        | 67 +++--------------------
 6 files changed, 54 insertions(+), 342 deletions(-)

diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml
index 46defa7b..4829f860 100644
--- a/.github/workflows/conda-cpp-build.yaml
+++ b/.github/workflows/conda-cpp-build.yaml
@@ -169,64 +169,17 @@ jobs:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
           persist-credentials: true
-      - name: Validate caller cache configuration
+      - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        run: |
-          if test -z "${INPUTS_CACHE_PATHS}" || test -z "${INPUTS_CACHE_KEY_PREFIX}"; then
-            echo "ERROR: cache-paths and cache-key-prefix must be provided together."
-            exit 1
-          fi
-        env:
-          INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
-          INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Compute caller cache key
-        if: inputs.cache-paths != ''
-        id: caller-cache
-        run: |
-          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            key_files_hash=none
-          else
-            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-            key_files=$(mktemp)
-            trap 'rm -f "${key_files}"' EXIT
-            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-            if test -s "${key_files}"; then
-              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-            else
-              key_files_hash=none
-            fi
-          fi
-
-          matrix_key=$(jq -er --raw-output \
-            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
-            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
-            <<< "${MATRIX}")
-          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
-          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
-        env:
-          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
-          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
-          MATRIX: ${{ toJSON(matrix) }}
-      - name: Restore caller cache paths
-        if: inputs.cache-paths != '' && inputs.cache-read-only
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
         with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Cache caller paths
-        if: inputs.cache-paths != '' && !inputs.cache-read-only
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Configure caller cache environment
-        if: inputs.cache-environment != ''
-        run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
-        env:
-          INPUTS_CACHE_ENVIRONMENT: ${{ inputs.cache-environment }}
+          cache-paths: ${{ inputs.cache-paths }}
+          cache-key-prefix: ${{ inputs.cache-key-prefix }}
+          cache-key-files: ${{ inputs.cache-key-files }}
+          cache-key-matrix-fields: ${{ inputs.cache-key-matrix-fields }}
+          cache-environment: ${{ inputs.cache-environment }}
+          cache-read-only: ${{ inputs.cache-read-only }}
+          matrix: ${{ toJSON(matrix) }}
       - name: Standardize repository information
         env:
           RAPIDS_REPOSITORY: ${{ inputs.repo || github.repository }}
diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml
index f19dd8a0..dcb65fee 100644
--- a/.github/workflows/conda-cpp-tests.yaml
+++ b/.github/workflows/conda-cpp-tests.yaml
@@ -214,66 +214,17 @@ jobs:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
           persist-credentials: true
-      - name: Validate caller cache configuration
+      - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        run: |
-          if test -z "${INPUTS_CACHE_PATHS}" || test -z "${INPUTS_CACHE_KEY_PREFIX}"; then
-            echo "ERROR: cache-paths and cache-key-prefix must be provided together."
-            exit 1
-          fi
-        env:
-          INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
-          INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Compute caller cache key
-        if: inputs.cache-paths != ''
-        id: caller-cache
-        run: |
-          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            key_files_hash=none
-          else
-            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-            key_files=$(mktemp)
-            trap 'rm -f "${key_files}"' EXIT
-            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-            if test -s "${key_files}"; then
-              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-            else
-              key_files_hash=none
-            fi
-          fi
-
-          matrix_key=$(jq -er --raw-output \
-            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
-            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
-            <<< "${MATRIX}")
-          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
-          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
-        env:
-          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
-          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
-          MATRIX: ${{ toJSON(matrix) }}
-      - name: Restore caller cache paths
-        if: inputs.cache-paths != '' && inputs.cache-read-only
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Cache caller paths
-        if: inputs.cache-paths != '' && !inputs.cache-read-only
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
         with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Configure caller cache environment
-        if: inputs.cache-environment != ''
-        run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
-        env:
-          INPUTS_CACHE_ENVIRONMENT: ${{ inputs.cache-environment }}
+          cache-paths: ${{ inputs.cache-paths }}
+          cache-key-prefix: ${{ inputs.cache-key-prefix }}
+          cache-key-files: ${{ inputs.cache-key-files }}
+          cache-key-matrix-fields: ${{ inputs.cache-key-matrix-fields }}
+          cache-environment: ${{ inputs.cache-environment }}
+          cache-read-only: ${{ inputs.cache-read-only }}
+          matrix: ${{ toJSON(matrix) }}
       # This has to be AFTER the checkout step. It creates a telemetry-artifacts directory,
       # and the checkout step would destroy it.
       - name: Telemetry setup
diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml
index 26928b9f..26689cfa 100644
--- a/.github/workflows/conda-python-build.yaml
+++ b/.github/workflows/conda-python-build.yaml
@@ -179,64 +179,17 @@ jobs:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
           persist-credentials: true
-      - name: Validate caller cache configuration
+      - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        run: |
-          if test -z "${INPUTS_CACHE_PATHS}" || test -z "${INPUTS_CACHE_KEY_PREFIX}"; then
-            echo "ERROR: cache-paths and cache-key-prefix must be provided together."
-            exit 1
-          fi
-        env:
-          INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
-          INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Compute caller cache key
-        if: inputs.cache-paths != ''
-        id: caller-cache
-        run: |
-          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            key_files_hash=none
-          else
-            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-            key_files=$(mktemp)
-            trap 'rm -f "${key_files}"' EXIT
-            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-            if test -s "${key_files}"; then
-              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-            else
-              key_files_hash=none
-            fi
-          fi
-
-          matrix_key=$(jq -er --raw-output \
-            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
-            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
-            <<< "${MATRIX}")
-          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
-          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
-        env:
-          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
-          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
-          MATRIX: ${{ toJSON(matrix) }}
-      - name: Restore caller cache paths
-        if: inputs.cache-paths != '' && inputs.cache-read-only
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
         with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Cache caller paths
-        if: inputs.cache-paths != '' && !inputs.cache-read-only
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Configure caller cache environment
-        if: inputs.cache-environment != ''
-        run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
-        env:
-          INPUTS_CACHE_ENVIRONMENT: ${{ inputs.cache-environment }}
+          cache-paths: ${{ inputs.cache-paths }}
+          cache-key-prefix: ${{ inputs.cache-key-prefix }}
+          cache-key-files: ${{ inputs.cache-key-files }}
+          cache-key-matrix-fields: ${{ inputs.cache-key-matrix-fields }}
+          cache-environment: ${{ inputs.cache-environment }}
+          cache-read-only: ${{ inputs.cache-read-only }}
+          matrix: ${{ toJSON(matrix) }}
       - name: Standardize repository information
         env:
           RAPIDS_REPOSITORY: ${{ inputs.repo || github.repository }}
diff --git a/.github/workflows/conda-python-tests.yaml b/.github/workflows/conda-python-tests.yaml
index 1465c240..5fdab33d 100644
--- a/.github/workflows/conda-python-tests.yaml
+++ b/.github/workflows/conda-python-tests.yaml
@@ -229,66 +229,17 @@ jobs:
           fetch-depth: 0
           persist-credentials: true
 
-      - name: Validate caller cache configuration
+      - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        run: |
-          if test -z "${INPUTS_CACHE_PATHS}" || test -z "${INPUTS_CACHE_KEY_PREFIX}"; then
-            echo "ERROR: cache-paths and cache-key-prefix must be provided together."
-            exit 1
-          fi
-        env:
-          INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
-          INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Compute caller cache key
-        if: inputs.cache-paths != ''
-        id: caller-cache
-        run: |
-          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            key_files_hash=none
-          else
-            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-            key_files=$(mktemp)
-            trap 'rm -f "${key_files}"' EXIT
-            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-            if test -s "${key_files}"; then
-              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-            else
-              key_files_hash=none
-            fi
-          fi
-
-          matrix_key=$(jq -er --raw-output \
-            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
-            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
-            <<< "${MATRIX}")
-          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
-          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
-        env:
-          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
-          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
-          MATRIX: ${{ toJSON(matrix) }}
-      - name: Restore caller cache paths
-        if: inputs.cache-paths != '' && inputs.cache-read-only
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Cache caller paths
-        if: inputs.cache-paths != '' && !inputs.cache-read-only
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
         with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Configure caller cache environment
-        if: inputs.cache-environment != ''
-        run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
-        env:
-          INPUTS_CACHE_ENVIRONMENT: ${{ inputs.cache-environment }}
+          cache-paths: ${{ inputs.cache-paths }}
+          cache-key-prefix: ${{ inputs.cache-key-prefix }}
+          cache-key-files: ${{ inputs.cache-key-files }}
+          cache-key-matrix-fields: ${{ inputs.cache-key-matrix-fields }}
+          cache-environment: ${{ inputs.cache-environment }}
+          cache-read-only: ${{ inputs.cache-read-only }}
+          matrix: ${{ toJSON(matrix) }}
 
       - name: Standardize repository information
         uses: rapidsai/shared-actions/rapids-github-info@main
diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml
index e6f13645..b8fab3ae 100644
--- a/.github/workflows/wheels-build.yaml
+++ b/.github/workflows/wheels-build.yaml
@@ -212,64 +212,17 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Validate caller cache configuration
+      - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        run: |
-          if test -z "${INPUTS_CACHE_PATHS}" || test -z "${INPUTS_CACHE_KEY_PREFIX}"; then
-            echo "ERROR: cache-paths and cache-key-prefix must be provided together."
-            exit 1
-          fi
-        env:
-          INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
-          INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Compute caller cache key
-        if: inputs.cache-paths != ''
-        id: caller-cache
-        run: |
-          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            key_files_hash=none
-          else
-            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-            key_files=$(mktemp)
-            trap 'rm -f "${key_files}"' EXIT
-            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-            if test -s "${key_files}"; then
-              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-            else
-              key_files_hash=none
-            fi
-          fi
-
-          matrix_key=$(jq -er --raw-output \
-            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
-            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
-            <<< "${MATRIX}")
-          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
-          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
-        env:
-          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
-          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
-          MATRIX: ${{ toJSON(matrix) }}
-      - name: Restore caller cache paths
-        if: inputs.cache-paths != '' && inputs.cache-read-only
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
         with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Cache caller paths
-        if: inputs.cache-paths != '' && !inputs.cache-read-only
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Configure caller cache environment
-        if: inputs.cache-environment != ''
-        run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
-        env:
-          INPUTS_CACHE_ENVIRONMENT: ${{ inputs.cache-environment }}
+          cache-paths: ${{ inputs.cache-paths }}
+          cache-key-prefix: ${{ inputs.cache-key-prefix }}
+          cache-key-files: ${{ inputs.cache-key-files }}
+          cache-key-matrix-fields: ${{ inputs.cache-key-matrix-fields }}
+          cache-environment: ${{ inputs.cache-environment }}
+          cache-read-only: ${{ inputs.cache-read-only }}
+          matrix: ${{ toJSON(matrix) }}
 
       - name: Standardize repository information
         uses: rapidsai/shared-actions/rapids-github-info@main
diff --git a/.github/workflows/wheels-test.yaml b/.github/workflows/wheels-test.yaml
index 93a89975..0bac3fb3 100644
--- a/.github/workflows/wheels-test.yaml
+++ b/.github/workflows/wheels-test.yaml
@@ -237,66 +237,17 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Validate caller cache configuration
+      - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        run: |
-          if test -z "${INPUTS_CACHE_PATHS}" || test -z "${INPUTS_CACHE_KEY_PREFIX}"; then
-            echo "ERROR: cache-paths and cache-key-prefix must be provided together."
-            exit 1
-          fi
-        env:
-          INPUTS_CACHE_PATHS: ${{ inputs.cache-paths }}
-          INPUTS_CACHE_KEY_PREFIX: ${{ inputs.cache-key-prefix }}
-      - name: Compute caller cache key
-        if: inputs.cache-paths != ''
-        id: caller-cache
-        run: |
-          if test -z "${INPUTS_CACHE_KEY_FILES}"; then
-            key_files_hash=none
-          else
-            mapfile -t patterns < <(sed '/^[[:space:]]*$/d' <<< "${INPUTS_CACHE_KEY_FILES}")
-            key_files=$(mktemp)
-            trap 'rm -f "${key_files}"' EXIT
-            git ls-files -z -- "${patterns[@]}" | sort -z > "${key_files}"
-
-            if test -s "${key_files}"; then
-              key_files_hash=$(xargs -0 -r sha256sum < "${key_files}" | sha256sum | cut -d ' ' -f 1)
-            else
-              key_files_hash=none
-            fi
-          fi
-
-          matrix_key=$(jq -er --raw-output \
-            --arg fields "${INPUTS_CACHE_KEY_MATRIX_FIELDS}" \
-            '[($fields | split("\n")[] | select(length > 0)) as $field | .[$field]] | join("-")' \
-            <<< "${MATRIX}")
-          echo "key-files-hash=${key_files_hash}" >> "$GITHUB_OUTPUT"
-          echo "matrix-key=${matrix_key}" >> "$GITHUB_OUTPUT"
-        env:
-          INPUTS_CACHE_KEY_FILES: ${{ inputs.cache-key-files }}
-          INPUTS_CACHE_KEY_MATRIX_FIELDS: ${{ inputs.cache-key-matrix-fields }}
-          MATRIX: ${{ toJSON(matrix) }}
-      - name: Restore caller cache paths
-        if: inputs.cache-paths != '' && inputs.cache-read-only
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Cache caller paths
-        if: inputs.cache-paths != '' && !inputs.cache-read-only
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
         with:
-          path: ${{ inputs.cache-paths }}
-          key: ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-${{ steps.caller-cache.outputs.key-files-hash }}
-          restore-keys: |
-            ${{ inputs.cache-key-prefix }}-${{ steps.caller-cache.outputs.matrix-key }}-
-      - name: Configure caller cache environment
-        if: inputs.cache-environment != ''
-        run: printf '%s\n' "$INPUTS_CACHE_ENVIRONMENT" >> "$GITHUB_ENV"
-        env:
-          INPUTS_CACHE_ENVIRONMENT: ${{ inputs.cache-environment }}
+          cache-paths: ${{ inputs.cache-paths }}
+          cache-key-prefix: ${{ inputs.cache-key-prefix }}
+          cache-key-files: ${{ inputs.cache-key-files }}
+          cache-key-matrix-fields: ${{ inputs.cache-key-matrix-fields }}
+          cache-environment: ${{ inputs.cache-environment }}
+          cache-read-only: ${{ inputs.cache-read-only }}
+          matrix: ${{ toJSON(matrix) }}
 
       - name: Telemetry setup
         uses: rapidsai/shared-actions/telemetry-dispatch-setup@main

From 8a039e57f5b710861c9c2cbf44d522f054b6411e Mon Sep 17 00:00:00 2001
From: Vyas Ramasubramani <vyasr@nvidia.com>
Date: Thu, 10 Sep 2026 09:46:54 -0700
Subject: [PATCH 7/7] ci: use released caller cache action

---
 .github/workflows/conda-cpp-build.yaml    | 2 +-
 .github/workflows/conda-cpp-tests.yaml    | 2 +-
 .github/workflows/conda-python-build.yaml | 2 +-
 .github/workflows/conda-python-tests.yaml | 2 +-
 .github/workflows/wheels-build.yaml       | 2 +-
 .github/workflows/wheels-test.yaml        | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml
index 4829f860..8ccb0f6a 100644
--- a/.github/workflows/conda-cpp-build.yaml
+++ b/.github/workflows/conda-cpp-build.yaml
@@ -171,7 +171,7 @@ jobs:
           persist-credentials: true
       - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
+        uses: rapidsai/shared-actions/setup-caller-cache@main
         with:
           cache-paths: ${{ inputs.cache-paths }}
           cache-key-prefix: ${{ inputs.cache-key-prefix }}
diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml
index dcb65fee..b81395da 100644
--- a/.github/workflows/conda-cpp-tests.yaml
+++ b/.github/workflows/conda-cpp-tests.yaml
@@ -216,7 +216,7 @@ jobs:
           persist-credentials: true
       - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
+        uses: rapidsai/shared-actions/setup-caller-cache@main
         with:
           cache-paths: ${{ inputs.cache-paths }}
           cache-key-prefix: ${{ inputs.cache-key-prefix }}
diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml
index 26689cfa..7eb43dc6 100644
--- a/.github/workflows/conda-python-build.yaml
+++ b/.github/workflows/conda-python-build.yaml
@@ -181,7 +181,7 @@ jobs:
           persist-credentials: true
       - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
+        uses: rapidsai/shared-actions/setup-caller-cache@main
         with:
           cache-paths: ${{ inputs.cache-paths }}
           cache-key-prefix: ${{ inputs.cache-key-prefix }}
diff --git a/.github/workflows/conda-python-tests.yaml b/.github/workflows/conda-python-tests.yaml
index 5fdab33d..71eccf0c 100644
--- a/.github/workflows/conda-python-tests.yaml
+++ b/.github/workflows/conda-python-tests.yaml
@@ -231,7 +231,7 @@ jobs:
 
       - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
+        uses: rapidsai/shared-actions/setup-caller-cache@main
         with:
           cache-paths: ${{ inputs.cache-paths }}
           cache-key-prefix: ${{ inputs.cache-key-prefix }}
diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml
index b8fab3ae..ebe4968e 100644
--- a/.github/workflows/wheels-build.yaml
+++ b/.github/workflows/wheels-build.yaml
@@ -214,7 +214,7 @@ jobs:
 
       - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
+        uses: rapidsai/shared-actions/setup-caller-cache@main
         with:
           cache-paths: ${{ inputs.cache-paths }}
           cache-key-prefix: ${{ inputs.cache-key-prefix }}
diff --git a/.github/workflows/wheels-test.yaml b/.github/workflows/wheels-test.yaml
index 0bac3fb3..9e1b1908 100644
--- a/.github/workflows/wheels-test.yaml
+++ b/.github/workflows/wheels-test.yaml
@@ -239,7 +239,7 @@ jobs:
 
       - name: Setup caller cache
         if: inputs.cache-paths != '' || inputs.cache-key-prefix != '' || inputs.cache-key-files != '' || inputs.cache-environment != ''
-        uses: rapidsai/shared-actions/setup-caller-cache@codex/caller-cache-setup
+        uses: rapidsai/shared-actions/setup-caller-cache@main
         with:
           cache-paths: ${{ inputs.cache-paths }}
           cache-key-prefix: ${{ inputs.cache-key-prefix }}