ci: cache apt packages with awalsh128/cache-apt-pkgs-action (#42499)

setup-backend (used in 17 job steps across 13 workflows) bootstrapped uv
via `pip install --upgrade pip setuptools wheel uv` on every run, and only
cached pip's download dir via actions/setup-python's `cache: pip` -- pip
wasn't doing the actual installs (uv was), so that cache bought nothing.

astral-sh/setup-uv ships a prebuilt uv binary instead of installing it via
pip, and its own GitHub Actions cache (enable-cache: true) persists uv's
resolution/wheel cache across runs, keyed on requirements/*.txt and
pyproject.toml by default. Also drops the now-redundant pip/setuptools/wheel
upgrade -- uv's build isolation installs anything a package's build backend
declares (pyproject.toml's [build-system] already requires setuptools/wheel)
without needing them preinstalled in the target environment.

Also swaps the same `pip install uv` bootstrap in bump-python-package.yml.

The uv step is skipped when install-superset: false (helm-lint-test), since
otherwise there's nothing for it to install or cache and it fails the job.

.github/actions/setup-backend/action.yml

@@ -5,10 +5,6 @@ inputs:
     description: 'Python version to set up. Accepts a version number, "current", or "next".'
     required: true
     default: 'current'
-  cache:
-    description: 'Cache dependencies. Options: pip'
-    required: false
-    default: 'pip'
   requirements-type:
     description: 'Type of requirements to install. Options: base, development, default'
     required: false
@@ -43,17 +39,24 @@ runs:
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ steps.set-python-version.outputs.python-version }}
-        cache: ${{ inputs.cache }}
+    - name: Install uv
+      if: inputs.install-superset == 'true'
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      with:
+        python-version: ${{ steps.set-python-version.outputs.python-version }}
+        enable-cache: true
+    - name: Install apt packages
+      if: inputs.install-superset == 'true'
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+      with:
+        packages: libldap2-dev libsasl2-dev
+        version: 1.0
     - name: Install dependencies
       env:
         INPUT_INSTALL_SUPERSET: ${{ inputs.install-superset }}
         INPUT_REQUIREMENTS_TYPE: ${{ inputs.requirements-type }}
       run: |
         if [ "$INPUT_INSTALL_SUPERSET" = "true" ]; then
-          sudo apt-get update && sudo apt-get -y install libldap2-dev libsasl2-dev
-
-          pip install --upgrade pip setuptools wheel uv
-
           if [ "$INPUT_REQUIREMENTS_TYPE" = "dev" ]; then
             uv pip install --system -r requirements/development.txt
           elif [ "$INPUT_REQUIREMENTS_TYPE" = "base" ]; then

.github/workflows/bump-python-package.yml

@@ -45,7 +45,10 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        run: pip install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: "3.11"
+          enable-cache: true
 
       - name: supersetbot bump-python -p "${{ github.event.inputs.package }}"
         env:

.github/workflows/superset-docs-deploy.yml

@@ -76,7 +76,10 @@ jobs:
           distribution: "zulu"
           java-version: "21"
       - name: Install Graphviz
-        run: sudo apt-get install -y graphviz
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: graphviz
+          version: 1.0
       - name: Compute Entity Relationship diagram (ERD)
         env:
           SUPERSET_SECRET_KEY: not-a-secret

.github/workflows/superset-python-unittest-report.yml

@@ -1,65 +0,0 @@
-name: Python Unit Test Results
-
-on:
-  # zizmor: ignore[dangerous-triggers] - runs in base-branch context and only consumes artifacts uploaded by Python-Unit; never checks out PR code (see note below)
-  workflow_run:
-    workflows: ["Python-Unit"]
-    types: [completed]
-
-# This workflow publishes a check run annotating failing Python unit tests
-# inline on the PR diff, using JUnit XML uploaded by the Python-Unit workflow.
-# It uses the workflow_run trigger so that it always runs in the base-branch
-# context and can safely be granted write permissions, even for PRs from
-# forks or Dependabot.
-#
-# IMPORTANT: This workflow must NEVER check out code from the PR branch. All
-# data comes from artifacts uploaded by the Python-Unit workflow.
-permissions:
-  contents: read
-  checks: write
-  issues: read
-  actions: read
-
-jobs:
-  report:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 10
-    if: >
-      github.event.workflow_run.conclusion == 'success' ||
-      github.event.workflow_run.conclusion == 'failure'
-    steps:
-      # Fails soft (continue-on-error) because the source unit-tests job is
-      # itself gated on change detection: a docs-only PR skips it entirely,
-      # so there is nothing to download or report on.
-      - name: Download JUnit results
-        id: download
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          pattern: "junit-results-*"
-          path: artifacts
-          merge-multiple: true
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Download event file
-        id: download-event
-        if: steps.download.outcome == 'success'
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: "Event File"
-          path: event
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish test results
-        if: steps.download.outcome == 'success' && steps.download-event.outcome == 'success'
-        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
-        with:
-          commit: ${{ github.event.workflow_run.head_sha }}
-          event_file: event/event.json
-          event_name: ${{ github.event.workflow_run.event }}
-          files: "artifacts/**/*.xml"
-          check_name: "Python Unit Test Results"
-          comment_mode: "off"

.github/workflows/superset-python-unittest.yml

@@ -74,14 +74,14 @@ jobs:
           SUPERSET_TESTENV: true
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
-          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml
+          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50
       - name: Python 100% coverage unit tests
         env:
           SUPERSET_TESTENV: true
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
-          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
-          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
+          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100
+          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100
       - name: Upload code coverage
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
@@ -89,33 +89,6 @@ jobs:
           verbose: true
           use_oidc: true
           slug: apache/superset
-      # Uploaded even when a pytest step above fails, since that is exactly
-      # when the JUnit results are needed downstream, to annotate the PR with
-      # the failing tests. Consumed by the "Python Unit Test Results" workflow
-      # via workflow_run (see that workflow for why it can't just be a step
-      # here: it needs to run with write permissions, which this PR-triggered
-      # job can't safely have on a fork PR).
-      - name: Upload JUnit test results
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: junit-results-${{ matrix.python-version }}
-          path: test-results/
-          retention-days: 7
-
-  # Uploads the raw pull_request event payload so the "Python Unit Test
-  # Results" workflow (running via workflow_run, in base-branch context) can
-  # look up which PR/commit to annotate without checking out untrusted code.
-  event-file:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 5
-    steps:
-      - name: Upload event file
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: Event File
-          path: ${{ github.event_path }}
-          retention-days: 7
 
   # Stable required-status-check anchor. `unit-tests` is a matrix job gated on
   # change detection, so on non-Python PRs it is skipped and never produces its

.github/workflows/superset-translations.yml

@@ -78,7 +78,10 @@ jobs:
 
       - name: Install gettext tools
         if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
-        run: sudo apt-get update && sudo apt-get install -y gettext
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: gettext
+          version: 1.0
 
       # Fetch the base ref so we can compare PR-introduced regressions
       # against a fair baseline (also runs babel_update against the base