[dotnet][java][py][rb][rust] Only use External Cache for GitHub Actions

[titusfortner]

User description

Problem

GitHub limits us to 10GB of cache, and they just started enforcing it. Some of our repo caches are > 3GB themselves. GitHub now removes the oldest caches as soon as the limit is hit. So caches aren't lasting more than an hour before being replaced.

This PR

• Disable repository-cache
• Disable directory-cache
• Prevents large infrequently used external-cache repositories (pin browsers)

Future considerations

1. We can set up external cache on Google Cloud or Azure and turn all this back on
2. After merging this, we should keep an eye on https://github.com/SeleniumHQ/selenium/actions/caches and see if we need to make more changes.

---

PR Type

Enhancement

---

Description

• Disable disk and repository caching to reduce GitHub Actions cache usage

• Remove cache-key input parameter from bazel.yml workflow

• Disable pin_browsers_extension caching across all platforms

• Keep Ruby Windows caching enabled while removing other cache-key references

---

Diagram Walkthrough

flowchart LR
  A["GitHub Actions Cache"] -->|"Disable disk-cache"| B["Bazel Setup"]
  A -->|"Disable repository-cache"| B
  A -->|"Disable pin_browsers"| C["External Cache"]
  D["cache-key Parameter"] -->|"Remove from all workflows"| E["CI Pipelines"]
  B -->|"Keep Ruby Windows"| F["Optimized Caching"]
  C -->|"Reduce cache size"| F

Loading

File Walkthrough

Relevant files

Configuration changes

9 files bazel.yml Disable disk and repository caching, remove cache-key parameter +8/-9      ci-dotnet.yml Remove cache-key parameter from workflow calls                      +0/-2      ci-java.yml Remove cache-key parameter from workflow calls                      +0/-3      ci-python.yml Remove cache-key parameter from workflow calls                      +0/-4      ci-ruby.yml Remove cache-key parameter from workflow calls                      +0/-5      ci-rust.yml Remove cache-key parameter from workflow calls                      +0/-2      ci.yml Disable repository-cache in check workflow                              +1/-1      nightly.yml Remove cache-key parameter from all nightly release workflows +0/-6      pin-browsers.yml Remove cache-key parameter from pin browsers workflow        +0/-1

---

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	add missing external-cache name Add the mandatory name field to the external-cache configuration to fix the cache step, which is currently broken due to invalid syntax. .github/workflows/bazel.yml [136-144] external-cache: | + name: github-actions-external manifest: crates: rust/Cargo.Bazel.lock rules_ruby++ruby+ruby: 'rb/.ruby-version' "pin_browsers_extension+mac_edge": false "pin_browsers_extension+mac_firefox": false "pin_browsers_extension+linux_edge": false "pin_browsers_extension+linux_chrome": false "pin_browsers_extension+linux_firefox": false Apply / Chat Suggestion importance[1-10]: 10 __ Why: This suggestion identifies a critical error where the name field for external-cache was removed, which would break the caching mechanism of the bazel-contrib/setup-bazel action. Fixing this is essential for the workflow to function as intended.	High
	Restore conditional logic for Ruby Restore the conditional logic for the rules_ruby++ruby+ruby cache manifest entry to prevent build failures on Windows. .github/workflows/bazel.yml [139] -- rules_ruby++ruby+ruby: ${{ inputs.os == 'windows' && 'false' || 'rb/.ruby-version' }} -+ rules_ruby++ruby+ruby: 'rb/.ruby-version' +rules_ruby++ruby+ruby: ${{ inputs.os == 'windows' && 'false' || 'rb/.ruby-version' }} [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 9 __ Why: This suggestion correctly identifies that removing the conditional logic for rules_ruby++ruby+ruby will likely break the Ruby build on Windows, as the hardcoded path is not suitable for that OS. Reverting this change is critical to maintaining workflow functionality.	High
	Re-enable Bazel repository caching Re-enable repository-cache to avoid re-downloading external dependencies on every run, which would improve build times and reduce network usage. .github/workflows/bazel.yml [145] -- repository-cache: true -+ repository-cache: false +repository-cache: true [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 5 __ Why: The suggestion correctly points out a significant performance regression by disabling repository-cache. While this change appears intentional as part of the caching refactor, the suggestion validly questions the performance impact, which might have been overlooked.	Low
More

[qodo-code-review]

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: Rust / Tests (windows) / Tests (windows)

Failed stage: Run Bazel [❌]

Failed test name: ""

Failure summary: The action failed during Bazel dependency fetching because an external repository download timed out: - Bazel failed to fetch repository aspect_rules_ts+ via http_archive while downloading https://github.com/aspect-build/rules_ts/releases/download/v3.6.0/rules_ts-v3.6.0.tar.gz. - The download returned 504 Gateway Time-out, causing ctx.download_and_extract to fail in D:/b/external/bazel_tools/tools/build_defs/repo/http.bzl:136:45. - This prevented Bazel from loading @aspect_rules_ts//ts:skipLibCheck, and the job exited with code 1.

Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 322: "enabled": false, 323: "files": [ 324: "./MODULE.bazel", 325: "./WORKSPACE.bazel", 326: "./WORKSPACE.bzlmod", 327: "./WORKSPACE" 328: ], 329: "name": "repository", 330: "paths": [ 331: "D://b-repo" 332: ] 333: } 334: } 335: ##[endgroup] 336: ##[group]Restore cache for bazelisk 337: Failed to restore bazelisk cache 338: ##[endgroup] 339: ##[group]Restore cache for external-ci-bazel-manifest 340: Failed to restore external-ci-bazel-manifest cache 341: ##[endgroup] ... 362: SEL_M2_PASS: 363: TWINE_PASSWORD: 364: TWINE_USERNAME: 365: NODE_AUTH_TOKEN: *** 366: SE_AVOID_STATS: true 367: BAZELISK_GITHUB_TOKEN: *** 368: ##[endgroup] 369: 2025/12/24 18:04:34 Downloading https://releases.bazel.build/7.4.1/release/bazel-7.4.1-windows-x86_64.exe... 370: Extracting Bazel installation... 371: Starting local Bazel server and connecting to it... 372: �[32mComputing main repo mapping:�[0m 373: �[32mComputing main repo mapping:�[0m 374: �[32mComputing main repo mapping:�[0m 375: �[32mComputing main repo mapping:�[0m 376: �[32mComputing main repo mapping:�[0m 377: �[35mWARNING: �[0mDownload from https://github.com/aspect-build/rules_ts/releases/download/v3.6.0/rules_ts-v3.6.0.tar.gz failed: class java.io.IOException GET returned 504 Gateway Time-out 378: �[32mINFO: �[0mRepository aspect_rules_ts+ instantiated at: 379: <builtin>: in <toplevel> 380: Repository rule http_archive defined at: 381: D:/b/external/bazel_tools/tools/build_defs/repo/http.bzl:387:31: in <toplevel> 382: �[31m�[1mERROR: �[0mD:/b/external/bazel_tools/tools/build_defs/repo/http.bzl:136:45: An error occurred during the fetch of repository 'aspect_rules_ts+': 383: Traceback (most recent call last): 384: File "D:/b/external/bazel_tools/tools/build_defs/repo/http.bzl", line 136, column 45, in _http_archive_impl 385: download_info = ctx.download_and_extract( 386: Error in download_and_extract: java.io.IOException: Error downloading [https://github.com/aspect-build/rules_ts/releases/download/v3.6.0/rules_ts-v3.6.0.tar.gz] to D:/b/external/aspect_rules_ts+/temp3361232265832826839/rules_ts-v3.6.0.tar.gz: GET returned 504 Gateway Time-out 387: �[31m�[1mERROR: �[0m@aspect_rules_ts//ts:skipLibCheck :: Error loading option @aspect_rules_ts//ts:skipLibCheck: java.io.IOException: Error downloading [https://github.com/aspect-build/rules_ts/releases/download/v3.6.0/rules_ts-v3.6.0.tar.gz] to D:/b/external/aspect_rules_ts+/temp3361232265832826839/rules_ts-v3.6.0.tar.gz: GET returned 504 Gateway Time-out 388: �[0m 389: ##[error]Process completed with exit code 1. 390: ##[group]Run actions/upload-artifact@v5