Cache pip and Ansible Galaxy dependencies in CI

[randomparity]

Problem

Every CI job reinstalls its Python and Ansible dependencies from scratch. No caching is configured anywhere: setup-python supports a cache: input that is not used, and the Galaxy collection install has no cache at all.

Evidence

Uncached pip install (all three setup-python steps omit cache:):

• .github/workflows/lint.yml:19-21 / .github/workflows/lint.yml:24
• .github/workflows/test.yml:19-21 / .github/workflows/test.yml:24
• .github/workflows/test.yml:42-44 / .github/workflows/test.yml:47

Uncached ansible-galaxy collection install:

• .github/workflows/lint.yml:27
• .github/workflows/test.yml:50

Measured on main — test.yml run 30255506463 and the corresponding lint run:

Job	Total	pip install	Galaxy install	Deps as % of job
lint	53s	8s	17s	47%
pytest	19s	11s	—	58%
molecule (base_system)	104s	11s	14s	24%
molecule (quadlet_service)	252s	19s	15s	13%
molecule (open_notebook)	251s	9s	11s	8%
molecule (traefik)	258s	11s	21s	12%

Totals: ~69s of pip install across 6 jobs, ~78s of Galaxy install across 5.

Expected

Dependencies restore from cache when requirements-dev.txt and requirements.yml are unchanged.

Proposed approach

1. Add cache: pip and cache-dependency-path: requirements-dev.txt to the three setup-python steps (lint.yml:19-21, test.yml:19-21, test.yml:42-44).
2. Add a separate actions/cache step for ~/.ansible/collections, keyed on a hash of requirements.yml. The setup-python pip cache does not cover Galaxy collections — that needs its own cache.

Realistic payoff

This will not meaningfully shorten a CI run. The four molecule jobs run in parallel and are dominated by the Molecule step itself (206-218s for three of them), which caching does not touch — so the critical path stays around 260s either way.

The honest win is on the two fast jobs: lint roughly 53s to ~30s, and pytest roughly 19s to ~10s. Filed at P3 accordingly. Worth doing as cheap hygiene, not worth prioritizing as a CI speedup.

Notes

Filed from the review of #122 and #123, where this was recorded as an informational finding out of scope for a version bump. Both PRs touch the setup-python lines above; merge them first to avoid conflicts.

[randomparity]

WORK:SCOPE

• Blast radius: CI configuration only — .github/workflows/lint.yml, .github/workflows/test.yml. No runtime/Ansible code touched.
• Risk flags: none material. A cache restore that goes stale is self-correcting (key is a hash of requirements.yml / requirements-dev.txt). New third-party action ref (actions/cache) must be SHA-pinned or it fails the zizmor --min-severity high gate added by Pin GitHub Actions to commit SHAs and add zizmor to CI #124.
• Complexity: S
• Decompose verdict: no — single logical change, one commit.
• Design skipped: trivial chore. No API, schema, auth, migration, or public-contract change.
• Note: issue body line numbers are stale (workflows were rewritten by ci: pin GitHub Actions to commit SHAs and add zizmor to CI #126); re-derived against current main at c0ab605.