fix(ci): cache verified build tool downloads

.github/actions/ci-archive-cache/action.yml

@@ -0,0 +1,33 @@
+name: Cache a pinned CI archive
+description: Restore an archive by tool version and content digest
+inputs:
+  tool:
+    description: Tool identifier
+    required: true
+  version:
+    description: Pinned tool version
+    required: true
+  sha256:
+    description: Pinned archive digest
+    required: true
+runs:
+  using: composite
+  steps:
+    - id: archive
+      shell: bash
+      env:
+        TOOL: ${{ inputs.tool }}
+        VERSION: ${{ inputs.version }}
+        SHA256: ${{ inputs.sha256 }}
+      run: |
+        set -euo pipefail
+        [[ "$TOOL" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]]
+        [[ "$VERSION" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ ]]
+        [[ "$SHA256" =~ ^[0-9a-f]{64}$ ]]
+        directory="$RUNNER_TEMP/coreav-ci-archives"
+        echo "path=$directory/$TOOL-$VERSION-$SHA256.archive" >> "$GITHUB_OUTPUT"
+        echo "COREAV_CI_ARCHIVE_DIR=$directory" >> "$GITHUB_ENV"
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      with:
+        path: ${{ steps.archive.outputs.path }}
+        key: ci-tool-archive-${{ inputs.tool }}-${{ inputs.version }}-${{ inputs.sha256 }}

.github/actions/ci-check-tool/action.yml

@@ -0,0 +1,34 @@
+name: Install a pinned CI check tool
+description: Restore and verify the pinned archive before installation
+inputs:
+  tool:
+    description: actionlint or cargo-deny
+    required: true
+runs:
+  using: composite
+  steps:
+    - id: pin
+      shell: bash
+      env:
+        TOOL: ${{ inputs.tool }}
+      run: |
+        set -euo pipefail
+        source "$GITHUB_ACTION_PATH/../../../scripts/ci-tools.env"
+        case "$TOOL" in
+          actionlint) version=$ACTIONLINT_VERSION; sha256=$ACTIONLINT_SHA256 ;;
+          cargo-deny) version=$CARGO_DENY_VERSION; sha256=$CARGO_DENY_SHA256 ;;
+          *) echo 'reason=ci_check_tool_unknown' >&2; exit 2 ;;
+        esac
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+        echo "sha256=$sha256" >> "$GITHUB_OUTPUT"
+    - uses: ./.github/actions/ci-archive-cache
+      with:
+        tool: ${{ inputs.tool }}
+        version: ${{ steps.pin.outputs.version }}
+        sha256: ${{ steps.pin.outputs.sha256 }}
+    - shell: bash
+      env:
+        TOOL: ${{ inputs.tool }}
+      run: |
+        bash "$GITHUB_ACTION_PATH/../../../scripts/install-ci-check-tool.sh" "$TOOL" "$RUNNER_TEMP/coreav-ci-tools"
+        echo "$RUNNER_TEMP/coreav-ci-tools" >> "$GITHUB_PATH"

.github/workflows/deny.yml

@@ -84,6 +84,9 @@ jobs:
           python3 -I scripts/oracle_pin.py --check
           python3 -I scripts/workflow_check_selftest.py
           python3 -I -m unittest discover -s scripts/tests -p 'test_oracle_install.py' -v
+          for suite in test_ci_downloads.py test_ci_reference_downloads.py test_maturin_downloads.py; do
+            python3 -I -m unittest discover -s scripts/tests -p "$suite" -v
+          done
           python3 -m unittest discover -s scripts/encoders/macos -p 'test_source_freeze.py' -v
           python3 -I -m unittest discover -s .github/actions/changed-paths/tests -p 'test_*.py'
           python3 -I scripts/pr_text_check_selftest.py
@@ -100,24 +103,20 @@ jobs:
       # Its shellcheck and pyflakes passes are off: they judge scripts, not
       # expressions. The fixture it writes is the mistake this step exists
       # for, which has to fail.
+      - uses: ./.github/actions/ci-check-tool
+        with:
+          tool: actionlint
       - name: Check the expressions of the workflows
-        env:
-          VERSION: 1.7.12
-          SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
         run: |
           set -euo pipefail
-          curl -sSfL -o "$RUNNER_TEMP/actionlint.tar.gz" \
-            "https://github.com/rhysd/actionlint/releases/download/v$VERSION/actionlint_${VERSION}_linux_amd64.tar.gz"
-          echo "$SHA256  $RUNNER_TEMP/actionlint.tar.gz" | sha256sum -c -
-          tar -xzf "$RUNNER_TEMP/actionlint.tar.gz" -C "$RUNNER_TEMP" actionlint
-          "$RUNNER_TEMP/actionlint" -shellcheck= -pyflakes=
+          actionlint -shellcheck= -pyflakes=
           # GitHub expands an expression anywhere in this script before it
           # runs, so the fixture's opening is put together here.
           open='$''{{'
           printf '%s\n' 'on: push' 'jobs:' '  probe:' '    runs-on: ubuntu-24.04' '    env:' \
             "      DIR: $open runner.temp }}/out" '    steps:' '      - run: echo hi' \
             > "$RUNNER_TEMP/runner-in-job-env.yml"
-          if found=$("$RUNNER_TEMP/actionlint" -shellcheck= -pyflakes= "$RUNNER_TEMP/runner-in-job-env.yml" 2>&1); then
+          if found=$(actionlint -shellcheck= -pyflakes= "$RUNNER_TEMP/runner-in-job-env.yml" 2>&1); then
             echo 'actionlint accepted a runner expression in a job env' >&2
             exit 1
           fi
@@ -192,25 +191,21 @@ jobs:
           set -euo pipefail
           python3 -m pip install --quiet --require-hashes -r bench/opus-speed/requirements.txt
           python3 -I -m unittest discover -s bench/opus-speed/tests -p 'test_*.py'
-      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
-        if: steps.result.outputs.reuse != 'true'
       # The fuzz projects are outside the workspace; check their own license
       # graphs. Projects are found as scripts/fuzz_plan.py finds them
       # (crates/*/fuzz), so a new one is checked without editing this file;
-      # finding none fails. cargo-deny is the version the action above runs.
+      # finding none fails.
       - name: Install cargo-deny
         if: steps.result.outputs.reuse != 'true' || github.event_name == 'merge_group'
-        env:
-          VERSION: 0.20.2
-          SHA256: 9f12ed4c49936e09b48bf862b595cde2fe64fcbd9d74dfacac6131ca824c8d5f
+        uses: ./.github/actions/ci-check-tool
+        with:
+          tool: cargo-deny
+      - name: Check the workspace dependency policy
+        if: steps.result.outputs.reuse != 'true'
         run: |
           set -euo pipefail
-          name="cargo-deny-$VERSION-x86_64-unknown-linux-musl"
-          curl -sSfL -o "$RUNNER_TEMP/deny.tar.gz" \
-            "https://github.com/EmbarkStudios/cargo-deny/releases/download/$VERSION/$name.tar.gz"
-          echo "$SHA256  $RUNNER_TEMP/deny.tar.gz" | sha256sum -c -
-          tar -xzf "$RUNNER_TEMP/deny.tar.gz" -C "$RUNNER_TEMP" "$name/cargo-deny"
-          echo "$RUNNER_TEMP/$name" >> "$GITHUB_PATH"
+          rustup show active-toolchain || rustup toolchain install
+          CARGO_TERM_COLOR=always cargo-deny --log-level warn --manifest-path ./Cargo.toml --all-features check
       - name: Refresh advisory checks on a reused merge group
         id: fresh-advisories
         if: github.event_name == 'merge_group' && steps.result.outputs.reuse == 'true'

.github/workflows/h264-encoder.yml

@@ -22,6 +22,10 @@ on:
       - scripts/tests/test_h264_crf.py
       - scripts/tests/test_h264_p.py
       - scripts/install-jm-decoder.sh
+      - scripts/install-ci-jm-decoder.sh
+      - scripts/fetch-ci-archive.sh
+      - scripts/tests/test_ci_reference_downloads.py
+      - .github/actions/ci-archive-cache/action.yml
       - scripts/jm-decoder.env
       - scripts/oracle-ffmpeg.env
       - scripts/oracle_pin.py
@@ -50,6 +54,10 @@ on:
       - scripts/tests/test_h264_crf.py
       - scripts/tests/test_h264_p.py
       - scripts/install-jm-decoder.sh
+      - scripts/install-ci-jm-decoder.sh
+      - scripts/fetch-ci-archive.sh
+      - scripts/tests/test_ci_reference_downloads.py
+      - .github/actions/ci-archive-cache/action.yml
       - scripts/jm-decoder.env
       - scripts/oracle-ffmpeg.env
       - scripts/oracle_pin.py
@@ -173,6 +181,7 @@ jobs:
           components: clippy
       - name: Unit tests and opt-in driver
         run: |
+          python3 -I -m unittest discover -s scripts/tests -p 'test_ci_reference_downloads.py' -v
           H264_VUI_FIXTURE_DIR="$RUNNER_TEMP/vui" H264_P_FIXTURE_DIR="$RUNNER_TEMP/p-forced" cargo test --locked --release -p coreav-h264-encoder --features full
           cargo clippy --locked -p coreav-h264-encoder --features full --all-targets -- -D warnings
           cargo build --locked --release -p coreav-h264-encoder --features full --example g1
@@ -194,10 +203,27 @@ jobs:
           python3 -I -m unittest discover -s scripts/tests -p 'test_h264_p.py'
           python3 -I -m unittest discover -s scripts/tests -p 'test_h264_crf.py'
       - uses: ./.github/actions/oracle-cache
+      - name: Read the decoder archive pins
+        id: jm
+        run: |
+          . scripts/jm-decoder.env
+          echo "version=$JM_VERSION" >> "$GITHUB_OUTPUT"
+          echo "sha256=$JM_SHA256" >> "$GITHUB_OUTPUT"
+          echo "ca-sha256=$JM_CA_SHA256" >> "$GITHUB_OUTPUT"
+      - uses: ./.github/actions/ci-archive-cache
+        with:
+          tool: jm
+          version: ${{ steps.jm.outputs.version }}
+          sha256: ${{ steps.jm.outputs.sha256 }}
+      - uses: ./.github/actions/ci-archive-cache
+        with:
+          tool: jm-ca
+          version: ${{ steps.jm.outputs.version }}
+          sha256: ${{ steps.jm.outputs.ca-sha256 }}
       - name: Install black-box decoder oracles
         run: |
           scripts/install-ci-oracle-ffmpeg.sh "$RUNNER_TEMP/g1-oracles"
-          bash scripts/install-jm-decoder.sh "$RUNNER_TEMP/g1-oracles"
+          bash scripts/install-ci-jm-decoder.sh "$RUNNER_TEMP/g1-oracles"
           python3 -I scripts/oracle_pin.py --verify-bin "$RUNNER_TEMP/g1-oracles"
           cat "$RUNNER_TEMP/g1-oracles/jm-build.txt"
       - name: Generate existing non-judged fixtures

.github/workflows/npm.yml

@@ -102,6 +102,10 @@ jobs:
             .github/actions/oracle-cache/action.yml
             scripts/binaryen.env
             scripts/install-binaryen.sh
+            scripts/install-ci-binaryen.sh
+            scripts/fetch-ci-archive.sh
+            scripts/tests/test_ci_reference_downloads.py
+            .github/actions/ci-archive-cache/action.yml
             .github/workflows/npm.yml
             .github/actions/changed-paths/**
             .github/actions/merge-group-result/**
@@ -140,10 +144,21 @@ jobs:
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
+      - name: Read the optimizer archive pin
+        id: binaryen
+        run: |
+          . scripts/binaryen.env
+          echo "version=$BINARYEN_VERSION" >> "$GITHUB_OUTPUT"
+          echo "sha256=$BINARYEN_SHA256_X86_64_LINUX" >> "$GITHUB_OUTPUT"
+      - uses: ./.github/actions/ci-archive-cache
+        with:
+          tool: binaryen
+          version: ${{ steps.binaryen.outputs.version }}
+          sha256: ${{ steps.binaryen.outputs.sha256 }}
       - name: Install binaryen
         run: |
           set -euo pipefail
-          opt="$(scripts/install-binaryen.sh "$RUNNER_TEMP/binaryen")"
+          opt="$(bash scripts/install-ci-binaryen.sh "$RUNNER_TEMP/binaryen")"
           echo "WASM_OPT=$opt" >> "$GITHUB_ENV"
       - name: Lint the command for WASI
         run: cargo clippy --locked -p coreav-cli --no-default-features --features cli --target wasm32-wasip1 -- -D warnings

.github/workflows/python.yml

@@ -77,6 +77,11 @@ jobs:
             scripts/oracle-ffmpeg.env
             scripts/install-ci-oracle-ffmpeg.sh
             .github/actions/oracle-cache/action.yml
+            scripts/maturin.env
+            scripts/install-ci-maturin.sh
+            scripts/fetch-ci-archive.sh
+            scripts/tests/test_maturin_downloads.py
+            .github/actions/ci-archive-cache/**
             .github/workflows/python.yml
             .github/actions/changed-paths/**
             .github/actions/merge-group-result/**
@@ -129,12 +134,17 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-      - name: Build the wheel (manylinux)
-        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+      - id: maturin-pin
+        run: scripts/install-ci-maturin.sh metadata linux-x86_64 >> "$GITHUB_OUTPUT"
+      - uses: ./.github/actions/ci-archive-cache
         with:
-          target: x86_64
-          manylinux: auto
-          args: --profile dist --locked --out dist --manifest-path crates/coreav-py/Cargo.toml
+          tool: ${{ steps.maturin-pin.outputs.tool }}
+          version: ${{ steps.maturin-pin.outputs.version }}
+          sha256: ${{ steps.maturin-pin.outputs.sha256 }}
+      - name: Build the wheel (manylinux)
+        run: scripts/install-ci-maturin.sh build linux-x86_64 --profile dist --locked --out dist --manifest-path crates/coreav-py/Cargo.toml
+      - name: Keep CI build glue out of the wheel
+        run: scripts/install-ci-maturin.sh verify-artifacts linux-x86_64
       - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
           toolchain: stable
@@ -189,14 +199,17 @@ jobs:
           persist-credentials: false
       # Cross-compiled in the manylinux image, so no arm64 runner is needed;
       # the test runs under QEMU.
-      - name: Build the wheel (manylinux, cross-compiled)
-        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+      - id: maturin-pin
+        run: scripts/install-ci-maturin.sh metadata linux-arm64 >> "$GITHUB_OUTPUT"
+      - uses: ./.github/actions/ci-archive-cache
         with:
-          target: aarch64
-          # manylinux_2_28: the manylinux2014 cross compiler does not define
-          # __ARM_ARCH, which ring's assembly needs (docs/design/python.md).
-          manylinux: 2_28
-          args: --profile dist --locked --out dist --manifest-path crates/coreav-py/Cargo.toml
+          tool: ${{ steps.maturin-pin.outputs.tool }}
+          version: ${{ steps.maturin-pin.outputs.version }}
+          sha256: ${{ steps.maturin-pin.outputs.sha256 }}
+      - name: Build the wheel (manylinux, cross-compiled)
+        run: scripts/install-ci-maturin.sh build linux-arm64 --profile dist --locked --out dist --manifest-path crates/coreav-py/Cargo.toml
+      - name: Keep CI build glue out of the wheel
+        run: scripts/install-ci-maturin.sh verify-artifacts linux-arm64
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: fixtures
@@ -236,11 +249,17 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
-      - name: Build the wheel
-        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+      - id: maturin-pin
+        run: scripts/install-ci-maturin.sh metadata macos-arm64 >> "$GITHUB_OUTPUT"
+      - uses: ./.github/actions/ci-archive-cache
         with:
-          target: aarch64-apple-darwin
-          args: --profile dist --locked --out dist --manifest-path crates/coreav-py/Cargo.toml
+          tool: ${{ steps.maturin-pin.outputs.tool }}
+          version: ${{ steps.maturin-pin.outputs.version }}
+          sha256: ${{ steps.maturin-pin.outputs.sha256 }}
+      - name: Build the wheel
+        run: scripts/install-ci-maturin.sh build macos-arm64 --profile dist --locked --out dist --manifest-path crates/coreav-py/Cargo.toml
+      - name: Keep CI build glue out of the wheel
+        run: scripts/install-ci-maturin.sh verify-artifacts macos-arm64
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: fixtures

.github/workflows/videotoolbox.yml

@@ -15,6 +15,11 @@ on:
       - Cargo.toml
       - deny.toml
       - scripts/encoders/macos/**
+      - scripts/ci-tools.env
+      - scripts/fetch-ci-archive.sh
+      - scripts/install-ci-check-tool.sh
+      - .github/actions/ci-archive-cache/action.yml
+      - .github/actions/ci-check-tool/action.yml
       - scripts/install-oracle-ffmpeg.sh
       - scripts/install-ci-oracle-ffmpeg.sh
       - .github/actions/oracle-cache/action.yml
@@ -37,6 +42,11 @@ on:
       - Cargo.toml
       - deny.toml
       - scripts/encoders/macos/**
+      - scripts/ci-tools.env
+      - scripts/fetch-ci-archive.sh
+      - scripts/install-ci-check-tool.sh
+      - .github/actions/ci-archive-cache/action.yml
+      - .github/actions/ci-check-tool/action.yml
       - scripts/install-oracle-ffmpeg.sh
       - scripts/install-ci-oracle-ffmpeg.sh
       - .github/actions/oracle-cache/action.yml
@@ -127,12 +137,11 @@ jobs:
           toolchain: stable
       - name: Build the independent Rust decoder and error calculator
         run: cargo build --locked --manifest-path crates/coreav-backend-apple/Cargo.toml --profile dist --example videotoolbox
-      - name: Check the standalone dependency licenses
-        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+      - uses: ./.github/actions/ci-check-tool
         with:
-          manifest-path: crates/coreav-backend-apple/Cargo.toml
-          command: check licenses
-          rust-version: stable
+          tool: cargo-deny
+      - name: Check the standalone dependency licenses
+        run: CARGO_TERM_COLOR=always cargo-deny --log-level warn --manifest-path crates/coreav-backend-apple/Cargo.toml --all-features check licenses
       - name: Test Linux evidence replay and child cleanup
         run: python3 -m unittest discover -s scripts/encoders/macos -p 'test_*.py' -v
       - uses: ./.github/actions/oracle-cache