chore: add cache-maintenance, bump workflow versions

.github/workflows/build-linux.yml

@@ -28,7 +28,6 @@ on:
       - main
   merge_group:
     types: [checks_requested]
-  workflow_call:
 jobs:
   build:
     runs-on: ubuntu-24.04
@@ -39,12 +38,9 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v4.2.2
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}-${{ matrix.config }}
-          repository-cache: true
-          cache-save: ${{ github.event_name == 'push' }}
+          unique-cache-name: ${{ github.job }}-${{ matrix.config }}
 
       - name: Build with Bazel
         run: |

.github/workflows/build-qnx.yml

@@ -25,12 +25,10 @@ on:
     types: [opened, reopened, synchronize]
   merge_group:
     types: [checks_requested]
-  push:
-    branches:
-      - main
+  workflow_call:
 jobs:
   qnx-build:
-    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@c644440e1f98e65db039cd66bcaa557314e6201b
     permissions:
       contents: read
       pull-requests: read

.github/workflows/bzlmod-lock.yml

@@ -33,6 +33,6 @@ on:
 
 jobs:
   bzlmod-lock:
-    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@c644440e1f98e65db039cd66bcaa557314e6201b
     with:
       working-directory: .

.github/workflows/cache_maintenance.yml

@@ -0,0 +1,68 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+name: Cache maintenance
+
+# Refreshes caches and rebuilds a new bazel repository cache when MODULE.bazel.lock changes.
+# Caches are only saved on pushes to the main branch or on workflow_dispatch events.
+# In merge_groups and pull requests a fast dry-run is executed to ensure inputs are valid and caches can be rebuilt successfully.
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+  merge_group:
+    types: [checks_requested]
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+jobs:
+  repository_cache_maintenance:
+    permissions:
+      actions: write # needed for cache deletion after cache refresh
+      contents: read
+    secrets:
+      score-qnx-license: ${{ secrets.SCORE_QNX_LICENSE }}
+      score-qnx-user: ${{ secrets.SCORE_QNX_USER }}
+      score-qnx-password: ${{ secrets.SCORE_QNX_PASSWORD }}
+    uses: eclipse-score/cicd-workflows/.github/workflows/cache-maintenance.yml@c644440e1f98e65db039cd66bcaa557314e6201b
+    with:
+      variants: |
+        //...
+        --config=time-x86_64-linux //...
+        --config=time-arm64-linux //...
+        --config=time-x86_64-qnx //score/... //examples/...
+        --config=time-arm64-qnx //score/... //examples/...
+
+  warmup-qnx:
+    needs: repository_cache_maintenance
+    # PR and merge-queue runs validate variants above but never warm or write
+    # shared caches.
+    if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+    permissions:
+      contents: read
+      pull-requests: read
+    secrets: inherit
+    uses: ./.github/workflows/build-qnx.yml
+
+  delete_old_caches:
+    runs-on: ubuntu-24.04
+    needs:
+      - warmup-qnx
+    permissions:
+      actions: write # needed for deletion of old caches
+      contents: read
+    if: ${{ !cancelled() && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
+    steps:
+      - name: Prune obsolete Bazel caches
+        uses: eclipse-score/cicd-actions/prune-cache@212bbf86267e9381da9d2daf962d12f6feafbc90

.github/workflows/clang-tidy.yml

@@ -41,12 +41,9 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}
-          repository-cache: true
-          cache-save: ${{ github.event_name == 'push' }}
+          unique-cache-name: ${{ github.job }}
 
       - name: Run clang-tidy
         # continue-on-error is required: bazel exits non-zero when violations exist.

.github/workflows/code-coverage.yml

@@ -30,7 +30,7 @@ on:
 
 jobs:
   code-coverage:
-    uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@c644440e1f98e65db039cd66bcaa557314e6201b
     with:
       bazel-target: "//score/..."
       bazel-config: "time-x86_64-linux"

.github/workflows/codeql.yml

@@ -39,12 +39,9 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}-codeql
-          repository-cache: true
-          cache-save: true
+          unique-cache-name: ${{ github.job }}-${{ matrix.config }}
 
       - name: Run MISRA C++:2023 analysis
         run: |

.github/workflows/comp-tests.yml

@@ -31,7 +31,7 @@ on:
 
 jobs:
   run-comp-tests:
-    uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@c644440e1f98e65db039cd66bcaa557314e6201b
     permissions:
       contents: read
       pull-requests: read

.github/workflows/copyright.yml

@@ -27,4 +27,4 @@ on:
     types: [checks_requested]
 jobs:
   copyright-check:
-    uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@c644440e1f98e65db039cd66bcaa557314e6201b

.github/workflows/docs-cleanup.yml

@@ -24,6 +24,6 @@ on:
 
 jobs:
   docs-cleanup:
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@c644440e1f98e65db039cd66bcaa557314e6201b
     secrets:
       token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docs.yml

@@ -30,7 +30,7 @@ on:
 
 jobs:
   docs-verify:
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@c644440e1f98e65db039cd66bcaa557314e6201b
     permissions:
       pull-requests: write
       contents: read
@@ -39,7 +39,7 @@ jobs:
 
   docs-build:
     needs: docs-verify
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@c644440e1f98e65db039cd66bcaa557314e6201b
     permissions:
       contents: write
       pages: write

.github/workflows/format.yml

@@ -40,12 +40,9 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}-format-check
-          repository-cache: true
-          cache-save: ${{ github.event_name == 'push' }}
+          unique-cache-name: ${{ github.job }}
 
       - name: Run format check
         run: bazel test //:format.check

.github/workflows/license-check.yml

@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   license-check:
-    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
+    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@c644440e1f98e65db039cd66bcaa557314e6201b
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
     secrets:

.github/workflows/sanitizers.yml

@@ -42,12 +42,9 @@ jobs:
         uses: actions/checkout@v4.2.2
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90
         with:
-          bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}-${{ matrix.config }}
-          repository-cache: true
-          cache-save: ${{ github.event_name == 'push' }}
+          unique-cache-name: ${{ github.job }}-${{ matrix.config }}
 
       - name: Run tests with sanitizers
         # continue-on-error is required: bazel exits non-zero when tests fail.