From 53c1fd830574a57da0bcc21a3e00a52f39669d27 Mon Sep 17 00:00:00 2001
From: Alexander Lanin <Alexander.Lanin@etas.com>
Date: Thu, 10 Sep 2026 16:06:26 +0200
Subject: [PATCH 1/2] ci: try cached workflows

---
 .github/workflows/daily.yml                    |  3 ++-
 .github/workflows/downstream_compatibility.yml | 16 +++++++++++++++-
 .github/workflows/on-pr.yml                    | 12 ++++++------
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 105e97f46..3c7427c6e 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -19,6 +19,7 @@ permissions:
   pull-requests: write
   pages: write
   id-token: write
+  actions: write # cleanup old caches
 
 on:
   # Runs every day at midnight UTC
@@ -37,4 +38,4 @@ on:
 
 jobs:
   maintenance:
-    uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@8d80e8df150cae21d53cbc8031d0f970648f7a67 # v0.0.3
+    uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@cache
diff --git a/.github/workflows/downstream_compatibility.yml b/.github/workflows/downstream_compatibility.yml
index 16d0c4f49..987910310 100644
--- a/.github/workflows/downstream_compatibility.yml
+++ b/.github/workflows/downstream_compatibility.yml
@@ -15,12 +15,26 @@ name: Downstream Compatibility
 on:
   workflow_call:
   pull_request:
+    # Parallel to review
     types: [opened, reopened, synchronize]
   merge_group:
+    # Post-review, pre-merge
     types: [checks_requested]
+  push:
+    # Update cache
+    branches:
+      - main
+  schedule:
+    # Update cache
+    # Runs every day at midnight UTC
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+  actions: write # cleanup old caches
 
 jobs:
-  test:
+  downstream-test:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 398d8ffe3..9c9cab314 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -24,20 +24,20 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  actions: write # cleanup old caches
+
 jobs:
   common:
-    uses: eclipse-score/cicd-workflows/.github/workflows/on-pr.yml@88cb460c47cb49efeb25cd7b73c8945dd1c5bce2 # on-pr/v0.0.0
-    permissions:
-      contents: read
+    uses: eclipse-score/cicd-workflows/.github/workflows/on-pr.yml@cache
 
   tests:
     uses: ./.github/workflows/_test.yml
 
   docs-build:
     needs: [tests]
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@37eaadadfefc263d94a858d25665735659e916fa
-    permissions:
-      contents: read
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@cache
     with:
       bazel-target: "//:docs"
       tests-report-artifact: tests-report

From 1fa089e6250c9412a73f676572e934f90a8f0668 Mon Sep 17 00:00:00 2001
From: Alexander Lanin <Alexander.Lanin@etas.com>
Date: Thu, 10 Sep 2026 20:34:06 +0200
Subject: [PATCH 2/2] ci: fix cache warming workflow races

---
 .github/workflows/downstream_compatibility.yml | 12 ++++++++----
 .github/workflows/on-pr.yml                    |  4 +++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/downstream_compatibility.yml b/.github/workflows/downstream_compatibility.yml
index 987910310..911601782 100644
--- a/.github/workflows/downstream_compatibility.yml
+++ b/.github/workflows/downstream_compatibility.yml
@@ -71,13 +71,17 @@ jobs:
           packages: graphviz
           cache: false
 
+      - name: Checkout PR
+        uses: actions/checkout@v7
+
       - name: Setup Bazel with shared caching
         uses: eclipse-score/cicd-actions/setup-bazel-cache@cache
         with:
-          disk-cache-key: ${{ github.job }}
-
-      - name: Checkout PR
-        uses: actions/checkout@v7
+          # Matrix jobs need separate disk-cache archives because GitHub Actions
+          # cannot merge archives written concurrently under one cache key.
+          disk-cache-key: ${{ github.job }}-${{ matrix.consumer }}
+          # Keep the shared repository cache consistent by assigning one writer.
+          repository-cache-save: ${{ matrix.consumer == 'score and remote' && 'auto' || 'false' }}
 
       - name: Prepare Python
         run: bazel run //:ide_support
diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index 9c9cab314..1a6c653bf 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -26,7 +26,6 @@ on:
 
 permissions:
   contents: read
-  actions: write # cleanup old caches
 
 jobs:
   common:
@@ -34,6 +33,9 @@ jobs:
 
   tests:
     uses: ./.github/workflows/_test.yml
+    permissions:
+      contents: read
+      actions: write # cleanup old caches
 
   docs-build:
     needs: [tests]