Save CI venv caches even when later steps fail

actions/cache's built-in post-step skips saving on job failure, which
threw away a perfectly good cold venv install just because a later
check, audit, test, or docs build failed afterward. Split each `Cache
all venvs` step into an explicit restore (actions/cache/restore) up
front and a save (actions/cache/save) gated on the install step's own
outcome, so a cold install is preserved regardless of what fails
later, and skipped when the key already had an exact hit.

- Bump actions/setup-python to v6, actions/cache to v5, and
  actions/upload-artifact to v6.
- Widen the `build` job's timeout from 40 to 120 minutes: a cold
  prepare-envs over the whole workspace plus the full check suite
  doesn't fit in 40 minutes on the slower matrix legs, and the venvs
  cache only keeps the happy path short.

Author: Aksem

.github/workflows/ci-cd.yml

@@ -34,7 +34,10 @@ env:
 jobs:
   build:
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 40
+    # A cold `prepare-envs` over the whole workspace plus the full check suite does
+    # not fit in 40 minutes on the slower matrix legs. The venvs cache keeps the
+    # happy path short; this budget only covers the cold run.
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -71,7 +74,7 @@ jobs:
           fi
 
       - name: Set up Python ${{ env.DEV_WORKSPACE_PYTHON_VERSION }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.DEV_WORKSPACE_PYTHON_VERSION }}
 
@@ -81,8 +84,9 @@ jobs:
       # skip reinstalling whenever a restored venv already looks valid, so a stale
       # partial-match restore could mask a dependency that was added since the cache
       # was written.
-      - name: Cache all venvs
-        uses: actions/cache@v4
+      - name: Restore venvs cache
+        id: venvs_cache
+        uses: actions/cache/restore@v5
         with:
           path: |
             .venvs
@@ -169,18 +173,33 @@ jobs:
 
       # TODO: try to replace by finecode action
       - name: Store the distribution packages
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         if: runner.os == 'Linux'
         with:
           name: python-package-distributions
           path: dist/
 
+      # Save the venvs explicitly instead of relying on actions/cache's own post-step:
+      # that post-step skips the save when the job fails, which throws away a perfectly
+      # good cold install just because a later check or test failed. The only
+      # precondition here is that the install itself succeeded; on an exact key match
+      # there is nothing new to save.
+      - name: Save venvs cache
+        if: ${{ always() && steps.install.outcome == 'success' && steps.venvs_cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v5
+        with:
+          path: |
+            .venvs
+            **/.venvs
+          key: ${{ runner.os }}-venvs-${{ hashFiles('**/pyproject.toml', '**/preset.toml') }}
+
   audit-private:
     name: Audit (private layer)
     runs-on: ubuntu-24.04
-    # The `build` job's 40min budget is not enough: this job pays a cold
-    # prepare-envs over ~74 projects and then a workspace-wide audit_code, which
-    # is slow by design (see docs/guides/developing-finecode.md "Running checks").
+    # This job pays a cold prepare-envs over ~74 projects and then a
+    # workspace-wide audit_code, which is slow by design (see
+    # docs/guides/developing-finecode.md "Running checks"), so it carries its own
+    # budget rather than inheriting the build matrix's.
     timeout-minutes: 60
     # `secrets` is NOT available in jobs.<job_id>.if -- only github, needs,
     # vars, inputs. An unavailable context evaluates to empty, so a secrets test
@@ -219,7 +238,7 @@ jobs:
 
       - name: Set up Python ${{ env.DEV_WORKSPACE_PYTHON_VERSION }}
         if: env.HAS_PRIVATE_CLONE_APP == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.DEV_WORKSPACE_PYTHON_VERSION }}
 
@@ -257,16 +276,18 @@ jobs:
         if: env.HAS_PRIVATE_CLONE_APP == 'true'
         run: cp .github/ci/finecode-user.ci.toml finecode-user.toml
 
-      - name: Cache all venvs
+      - name: Restore venvs cache
+        id: venvs_cache
         if: env.HAS_PRIVATE_CLONE_APP == 'true'
-        uses: actions/cache@v4
+        uses: actions/cache/restore@v5
         with:
           path: |
             .venvs
             **/.venvs
           key: ${{ runner.os }}-private-venvs-${{ hashFiles('**/pyproject.toml', '**/preset.toml', 'finecode-user.toml') }}
 
       - name: Install dependencies
+        id: install
         if: env.HAS_PRIVATE_CLONE_APP == 'true'
         run: |
           # CI must exercise this branch's local source, so finecode and its sibling
@@ -303,3 +324,14 @@ jobs:
           source .venvs/dev_workspace/bin/activate
           python -m finecode run --log-level="$FINECODE_LOG_LEVEL" run_tests
         shell: bash
+
+      # See the matching step in the `build` job for the rationale: save the venvs
+      # whenever the install succeeded, even if a later check, audit or test failed.
+      - name: Save venvs cache
+        if: ${{ always() && env.HAS_PRIVATE_CLONE_APP == 'true' && steps.install.outcome == 'success' && steps.venvs_cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v5
+        with:
+          path: |
+            .venvs
+            **/.venvs
+          key: ${{ runner.os }}-private-venvs-${{ hashFiles('**/pyproject.toml', '**/preset.toml', 'finecode-user.toml') }}

.github/workflows/docs.yml

@@ -27,21 +27,23 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.14'
 
       # Same cache key pattern as ci-cd.yml so a preceding CI run on the same commit
       # can seed this cache and skip most of the install work.
-      - name: Cache all venvs
-        uses: actions/cache@v4
+      - name: Restore venvs cache
+        id: venvs_cache
+        uses: actions/cache/restore@v5
         with:
           path: |
             .venvs
             **/.venvs
           key: ${{ runner.os }}-venvs-${{ hashFiles('**/pyproject.toml', '**/preset.toml') }}
 
       - name: Install dependencies
+        id: install
         run: sh scripts/setup-dev-workspace.sh
 
       - name: Build docs
@@ -58,3 +60,14 @@ jobs:
           external_repository: finecode-dev/finecode.github.io
           publish_branch: main
           publish_dir: ./site
+
+      # Save the venvs whenever the install succeeded, even if the docs build or
+      # deploy failed: the cold install is the expensive part and is still valid.
+      - name: Save venvs cache
+        if: ${{ always() && steps.install.outcome == 'success' && steps.venvs_cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v5
+        with:
+          path: |
+            .venvs
+            **/.venvs
+          key: ${{ runner.os }}-venvs-${{ hashFiles('**/pyproject.toml', '**/preset.toml') }}