Retry the apt cache on actions/cache@v4

My last conclusion was wrong. The GHES warning is not evidence that the
runner has no cache server; it is actions/cache v3 disabling itself.
v3's isGhes() reads GITHUB_SERVER_URL, and anything that is not
github.com reads as GitHub Enterprise, so on Gitea it always trips and
the action returns before touching the cache. That explains the 0.2s
save perfectly well without any runner setting being off.

Gitea's runner 3.0.0 release notes say every runner starts its own cache
server and that the runner "patches action bundles at load time to open
the GHES gate and read the cache endpoint from ACTIONS_CACHE_URL", with
actions/cache supported unforked. Our runners report v3.0.0, so the
server should be there and the gate should be open — but the patching
evidently does not reach a v3 bundle.

So this reapplies the apt cache and moves every actions/cache to v4. If
the hypothesis holds the GHES warning disappears, the save step actually
takes time, and a second run restores the .debs. The Composer cache gets
the bump too, since it has been silently doing nothing for the same
reason.

Refs #178.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Uw545F1vveNJKjzLxdi2ks

.gitea/workflows/ci.yml

@@ -19,6 +19,35 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # setup-php installs PHP 8.3+ through php-builder, which apt-installs ~70
+      # -dev packages before unpacking the build (#178). Ubuntu's own image
+      # deletes the .debs after install, so every job re-downloads them from
+      # the archive. Keep them and restore them from the cache server, which
+      # lives in the cluster, turning a WAN download into a local one.
+      #
+      # The dep list is the same for every PHP version on the builder path, so
+      # one shared key serves them all. Only the .debs are cached, never
+      # /var/lib/apt/lists — a stale index is how you get 404s on install.
+      - name: Keep downloaded .debs
+        run: |
+          sudo rm -f /etc/apt/apt.conf.d/docker-clean
+          echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' \
+            | sudo tee /etc/apt/apt.conf.d/99keep-downloaded-packages >/dev/null
+
+      - name: Cache apt packages
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives/*.deb
+          key: apt-php-builder-deps-${{ runner.arch }}-v1
+
+      # Temporary, for #178: shows whether the cache actually served the
+      # builder's dependencies, and times the step that consumes them.
+      - name: Report restored .debs
+        run: |
+          echo "restored .debs: $(ls /var/cache/apt/archives/*.deb 2>/dev/null | wc -l)"
+          echo "restored size:  $(du -sh /var/cache/apt/archives 2>/dev/null | cut -f1)"
+          date -u +'setup-php start: %H:%M:%S'
+
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
@@ -26,7 +55,7 @@ jobs:
           tools: composer:v2
 
       - name: Cache Composer packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.composer/cache
           key: composer-${{ hashFiles('composer.json') }}
@@ -54,6 +83,35 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # setup-php installs PHP 8.3+ through php-builder, which apt-installs ~70
+      # -dev packages before unpacking the build (#178). Ubuntu's own image
+      # deletes the .debs after install, so every job re-downloads them from
+      # the archive. Keep them and restore them from the cache server, which
+      # lives in the cluster, turning a WAN download into a local one.
+      #
+      # The dep list is the same for every PHP version on the builder path, so
+      # one shared key serves them all. Only the .debs are cached, never
+      # /var/lib/apt/lists — a stale index is how you get 404s on install.
+      - name: Keep downloaded .debs
+        run: |
+          sudo rm -f /etc/apt/apt.conf.d/docker-clean
+          echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' \
+            | sudo tee /etc/apt/apt.conf.d/99keep-downloaded-packages >/dev/null
+
+      - name: Cache apt packages
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives/*.deb
+          key: apt-php-builder-deps-${{ runner.arch }}-v1
+
+      # Temporary, for #178: shows whether the cache actually served the
+      # builder's dependencies, and times the step that consumes them.
+      - name: Report restored .debs
+        run: |
+          echo "restored .debs: $(ls /var/cache/apt/archives/*.deb 2>/dev/null | wc -l)"
+          echo "restored size:  $(du -sh /var/cache/apt/archives 2>/dev/null | cut -f1)"
+          date -u +'setup-php start: %H:%M:%S'
+
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
@@ -63,7 +121,7 @@ jobs:
           tools: composer:v2
 
       - name: Cache Composer packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.composer/cache
           key: ${{ matrix.php }}-composer-${{ hashFiles('composer.json') }}
@@ -97,6 +155,35 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # setup-php installs PHP 8.3+ through php-builder, which apt-installs ~70
+      # -dev packages before unpacking the build (#178). Ubuntu's own image
+      # deletes the .debs after install, so every job re-downloads them from
+      # the archive. Keep them and restore them from the cache server, which
+      # lives in the cluster, turning a WAN download into a local one.
+      #
+      # The dep list is the same for every PHP version on the builder path, so
+      # one shared key serves them all. Only the .debs are cached, never
+      # /var/lib/apt/lists — a stale index is how you get 404s on install.
+      - name: Keep downloaded .debs
+        run: |
+          sudo rm -f /etc/apt/apt.conf.d/docker-clean
+          echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' \
+            | sudo tee /etc/apt/apt.conf.d/99keep-downloaded-packages >/dev/null
+
+      - name: Cache apt packages
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives/*.deb
+          key: apt-php-builder-deps-${{ runner.arch }}-v1
+
+      # Temporary, for #178: shows whether the cache actually served the
+      # builder's dependencies, and times the step that consumes them.
+      - name: Report restored .debs
+        run: |
+          echo "restored .debs: $(ls /var/cache/apt/archives/*.deb 2>/dev/null | wc -l)"
+          echo "restored size:  $(du -sh /var/cache/apt/archives 2>/dev/null | cut -f1)"
+          date -u +'setup-php start: %H:%M:%S'
+
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with: