feat: add an optional uv cache to run-script and fix its pre-commit cache

### what

- Add a `uv-cache` input (default false) that restores uv's cache on every
  run, falling back to the newest one when `uv.lock` moved, and prunes it
  with `uv cache prune --ci` and saves it off pull requests.
- Key the pre-commit cache on the mise config and lockfiles and the selected
  `mise-env` as well as `.pre-commit-config.yaml`.
- Export `PREK_HOME` from `$HOME` in the script instead of setting it in the
  step's `env:`.

### why

Hook environments are built with the toolchains mise installs, so a Python
bump restored environments built against the old interpreter. `PREK_HOME`
was the literal string `~/.cache/pre-commit`, since `env:` values don't
expand `~`, so prek wrote its environments to a `~` directory in the
checkout and the cache step saved an empty one.

### testing

actionlint, zizmor, ruff and codespell pass (`prek run --all-files`). This
repository's CI uses `pre-commit-cache`, so it exercises the new key and
`PREK_HOME`.

### docs

The README's `run-script` section describes both caches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: albertodonato

.github/workflows/run-script.yml

@@ -10,6 +10,10 @@ on:
         description: "Restore the pre-commit cache, saving it on non-PR events"
         type: boolean
         default: false
+      uv-cache:
+        description: "Restore uv's cache, saving it on non-PR events"
+        type: boolean
+        default: false
       full-git-history:
         type: boolean
         description: "Whether to fetch full git history rather than just current HEAD"
@@ -87,32 +91,63 @@ jobs:
           minimum_release_age: 7d
           cache: true
 
-      # Always read the cache, it's safe to do so even on untrusted PRs.
+      # Always read the caches, it's safe to do so even on untrusted PRs.
+      #
+      # Hook environments are built with the toolchains mise installs (Python,
+      # Node, ...), so the key covers the mise config and lockfiles and the
+      # selected environment as well as the hook pins: a toolchain bump must
+      # not restore environments built against the old one.
       - name: Restore pre-commit cache
         if: inputs.pre-commit-cache
         id: pre-commit-cache
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pre-commit
-          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
+          key: pre-commit-${{ runner.os }}-${{ runner.arch }}-${{ inputs.mise-env }}-${{ hashFiles('.pre-commit-config.yaml', 'mise.toml', 'mise.lock', 'mise.*.toml', 'mise.*.lock') }}
+
+      # uv verifies what it installs against uv.lock's hashes, so a stale entry
+      # only costs a download; restore the newest cache when the lock moved.
+      - name: Restore uv cache
+        if: inputs.uv-cache
+        id: uv-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            uv-${{ runner.os }}-${{ runner.arch }}-
 
       - name: Run
         # Some tools reject an empty GH_TOKEN (e.g. zizmor), so unset it rather
         # than leaving it empty.
         run: | # zizmor: ignore[template-injection] caller-provided script
           [ -n "$GH_TOKEN" ] || unset GH_TOKEN
+          # Point prek at the pre-commit cache path so the cache step covers
+          # both. Exported here because `env:` values don't expand `~`.
+          export PREK_HOME="$HOME/.cache/pre-commit"
           ${{ inputs.run }}
         env:
           GH_TOKEN: ${{ inputs.github-token && github.token || '' }}
-          # Point prek at the pre-commit cache path so the cache step covers both.
-          PREK_HOME: ~/.cache/pre-commit
 
-      # Cache ssave is gated to non-PR events: an untrusted PR run must not be
-      # able to write a hook-environment cache that a later trusted build
-      # restores and executes (cache poisoning).
+      # Cache saves are gated to non-PR events: an untrusted PR run must not be
+      # able to write a cache that a later trusted build restores and executes
+      # (cache poisoning).
       - name: Save pre-commit cache
         if: inputs.pre-commit-cache && github.event_name != 'pull_request' && steps.pre-commit-cache.outputs.cache-hit != 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pre-commit
           key: ${{ steps.pre-commit-cache.outputs.cache-primary-key }}
+
+      # Keep only what's slow to rebuild: --ci drops pre-built wheels, which
+      # download again quickly, and keeps wheels built from source.
+      - name: Prune uv cache
+        if: inputs.uv-cache && github.event_name != 'pull_request' && steps.uv-cache.outputs.cache-hit != 'true'
+        run: uv cache prune --ci
+
+      - name: Save uv cache
+        if: inputs.uv-cache && github.event_name != 'pull_request' && steps.uv-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/uv
+          key: ${{ steps.uv-cache.outputs.cache-primary-key }}

README.md

@@ -57,6 +57,11 @@ are loaded on top of the default config.
         just lint
 ```
 
+Set `pre-commit-cache` to keep pre-commit's (or prek's) hook environments between
+runs, and `uv-cache` to keep uv's cache. Both are restored on every run but saved only
+off pull requests, so an untrusted pull request can't write a cache a later trusted run
+restores.
+
 The job runs with exactly the permissions the caller grants, so grant at least
 `contents: read`.