CI: drop actions/cache apt-deps layer from install-apt-deps

The ci-cache-offload work added a ghcr .deb bundle path to
install-apt-deps, making the actions/cache apt-archive layer redundant.
Remove it so no apt-deps-* cache entries are produced. Apt packages now
install either offline from the ghcr bundle (when ghcr-debs-tag is set)
or via plain apt-get with the existing retry/backoff.

- Strip the Compute/Restore/Pre-seed/Collect/Save cache steps and the
  cache-hit fast path; drop the now-unused 'cache' input.
- Update callers that passed 'cache': membrowse-onboard, membrowse-report
  (and the apt_cache matrix key in membrowse-targets.json), and sssd.

The ghcr offline path and the ccache actions/cache usage are untouched.

.github/actions/install-apt-deps/action.yml

@@ -1,5 +1,5 @@
 name: 'Install apt dependencies'
-description: 'Install apt packages with retry logic and caching'
+description: 'Install apt packages with retry logic and an optional offline ghcr bundle'
 inputs:
   packages:
     description: 'Space-separated list of apt packages to install'
@@ -16,16 +16,12 @@ inputs:
     description: 'Pass --no-install-recommends to apt-get install'
     required: false
     default: 'false'
-  cache:
-    description: 'Cache apt archives (disable for dynamic package names)'
-    required: false
-    default: 'true'
   ghcr-debs-tag:
     description: >
       Tag of a prebuilt .deb bundle published to
       ghcr.io/<owner>/wolfssl-ci-debs by the ci-deps-image workflow
       (e.g. "ubuntu-24.04-minimal"). When set, the packages are installed
-      offline from that bundle and the apt cache path below is skipped; on
+      offline from that bundle and the apt path below is skipped; on
       that happy path the apt mirror is not contacted. The offline install
       is all-or-nothing (a single --no-download install of the whole set),
       so any failure - bundle missing, not public, or not covering every
@@ -39,7 +35,7 @@ runs:
     # Preferred path: install from a prebuilt .deb bundle pulled from ghcr,
     # entirely offline (--no-download), so a flaky/timing-out apt mirror
     # cannot break the build. Best-effort: on any failure we leave
-    # "satisfied" unset and the apt steps below run unchanged. The bundle
+    # "satisfied" unset and the apt step below runs unchanged. The bundle
     # image must be PUBLIC so anonymous `docker pull` works (including from
     # fork PRs whose GITHUB_TOKEN cannot read private packages).
     - name: Install from ghcr .deb bundle (offline)
@@ -77,40 +73,9 @@ runs:
           echo "::notice::offline install incomplete for $IMG; using apt"
         fi
 
-    - name: Compute cache key
-      if: inputs.cache == 'true' && steps.ghcr.outputs.satisfied != 'true'
-      id: cache-key
-      shell: bash
-      run: |
-        SORTED_PKGS=$(echo "${{ inputs.packages }}" | tr ' ' '\n' | sort -u | tr '\n' ' ')
-        PKG_HASH=$(echo "$SORTED_PKGS" | sha256sum | cut -d' ' -f1 | head -c 16)
-        OS_VERSION=$(lsb_release -rs 2>/dev/null || echo "unknown")
-        echo "key=apt-deps-${{ runner.os }}-${{ runner.arch }}-${OS_VERSION}-${PKG_HASH}" >> $GITHUB_OUTPUT
-        echo "restore-key=apt-deps-${{ runner.os }}-${{ runner.arch }}-${OS_VERSION}-" >> $GITHUB_OUTPUT
-
-    - name: Restore apt cache
-      if: inputs.cache == 'true' && steps.ghcr.outputs.satisfied != 'true'
-      id: apt-cache
-      uses: actions/cache/restore@v5
-      with:
-        path: ~/apt-cache
-        key: ${{ steps.cache-key.outputs.key }}
-        restore-keys: ${{ steps.cache-key.outputs.restore-key }}
-
-    - name: Pre-seed apt archives from cache
-      if: inputs.cache == 'true' && steps.apt-cache.outputs.cache-hit == 'true' && steps.ghcr.outputs.satisfied != 'true'
-      shell: bash
-      run: |
-        if [ -d ~/apt-cache ] && ls ~/apt-cache/*.deb >/dev/null 2>&1; then
-          sudo cp ~/apt-cache/*.deb /var/cache/apt/archives/
-          echo "Restored $(ls ~/apt-cache/*.deb | wc -l) cached .deb files"
-        fi
-
     - name: Install packages
       if: steps.ghcr.outputs.satisfied != 'true'
       shell: bash
-      env:
-        APT_CACHE_HIT: ${{ steps.apt-cache.outputs.cache-hit }}
       run: |
         export DEBIAN_FRONTEND=noninteractive
         RETRIES=${{ inputs.retries }}
@@ -120,17 +85,6 @@ runs:
           NO_REC="--no-install-recommends"
         fi
 
-        # Fast path: on cache hit the .debs are already pre-seeded into
-        # /var/cache/apt/archives. Try installing directly first; if that
-        # fails (e.g. the cached .debs were superseded in the index) fall
-        # through to the regular update + install path.
-        if [ "$APT_CACHE_HIT" = "true" ]; then
-          if sudo apt-get install -y $NO_REC ${{ inputs.packages }}; then
-            exit 0
-          fi
-          echo "::warning::install from cached .debs failed, falling back to apt-get update"
-        fi
-
         for i in $(seq 1 $RETRIES); do
           if sudo apt-get update -q && \
              sudo apt-get install -y $NO_REC ${{ inputs.packages }}; then
@@ -144,21 +98,3 @@ runs:
           sleep $DELAY
           DELAY=$((DELAY * 2))
         done
-
-    # PR runs never write the apt cache (no churn); only push/schedule runs
-    # refresh it. The make-check family does not need it anyway - it installs
-    # from the ghcr bundle above.
-    - name: Collect .deb files for cache
-      if: inputs.cache == 'true' && github.event_name != 'pull_request' && steps.apt-cache.outputs.cache-hit != 'true' && steps.ghcr.outputs.satisfied != 'true'
-      shell: bash
-      run: |
-        mkdir -p ~/apt-cache
-        cp /var/cache/apt/archives/*.deb ~/apt-cache/ 2>/dev/null || true
-        echo "Cached $(ls ~/apt-cache/*.deb 2>/dev/null | wc -l) .deb files"
-
-    - name: Save apt cache
-      if: inputs.cache == 'true' && github.event_name != 'pull_request' && steps.apt-cache.outputs.cache-hit != 'true' && steps.ghcr.outputs.satisfied != 'true'
-      uses: actions/cache/save@v5
-      with:
-        path: ~/apt-cache
-        key: ${{ steps.cache-key.outputs.key }}

.github/membrowse-targets.json

@@ -204,8 +204,7 @@
     "build_cmd": "./autogen.sh && ./configure --with-linux-source=/lib/modules/$(uname -r)/build EXTRA_CPPFLAGS=-Werror --enable-option-checking=fatal --enable-linuxkm --enable-linuxkm-lkcapi-register=all --enable-all --enable-kyber=yes,original --enable-lms --enable-xmss --enable-dilithium --enable-experimental --enable-dual-alg-certs --disable-qt --disable-quic --with-sys-crypto-policy=no --disable-testcert --enable-all-asm --enable-crypttests --enable-linuxkm-benchmarks CFLAGS='-Wframe-larger-than=2048 -Wstack-usage=4096 -DBENCH_EMBEDDED -DBENCH_MIN_RUNTIME_SEC=0.01 -DBENCH_NTIMES=1 -DBENCH_AGREETIMES=1' --with-max-rsa-bits=16384 && make -j$(nproc) KERNEL_EXTRA_CFLAGS_REMOVE=-pg FORCE_NO_MODULE_SIG=1",
     "elf": "linuxkm/libwolfssl.ko",
     "ld": "linuxkm/wolfcrypt.lds",
-    "linker_vars": "",
-    "apt_cache": "false"
+    "linker_vars": ""
   },
   {
     "target_name": "linuxkm-pie",
@@ -215,7 +214,6 @@
     "build_cmd": "./autogen.sh && ./configure --with-linux-source=/lib/modules/$(uname -r)/build EXTRA_CPPFLAGS=-Werror --enable-option-checking=fatal --enable-linuxkm --enable-linuxkm-pie --enable-reproducible-build --enable-linuxkm-lkcapi-register=all --enable-all-crypto --enable-cryptonly --enable-kyber=yes,original --enable-lms --enable-xmss --enable-dilithium --enable-experimental --disable-qt --disable-quic --with-sys-crypto-policy=no --disable-opensslextra --disable-testcert --enable-intelasm --disable-sp-asm --enable-crypttests --enable-linuxkm-benchmarks CFLAGS='-DWOLFSSL_LINUXKM_VERBOSE_DEBUG -DDEBUG_LINUXKM_PIE_SUPPORT -Wframe-larger-than=2048 -Wstack-usage=4096 -DBENCH_EMBEDDED -DBENCH_MIN_RUNTIME_SEC=0.01 -DBENCH_NTIMES=1 -DBENCH_AGREETIMES=1' --with-max-rsa-bits=16384 && make -j$(nproc) KERNEL_EXTRA_CFLAGS_REMOVE=-pg FORCE_NO_MODULE_SIG=1",
     "elf": "linuxkm/libwolfssl.ko",
     "ld": "linuxkm/wolfcrypt.lds",
-    "linker_vars": "",
-    "apt_cache": "false"
+    "linker_vars": ""
   }
 ]

.github/workflows/membrowse-onboard.yml

@@ -47,7 +47,6 @@ jobs:
         uses: ./.github/actions/install-apt-deps
         with:
           packages: ${{ matrix.apt_packages }}
-          cache: ${{ matrix.apt_cache || 'true' }}
 
       - name: Run Membrowse Onboard Action
         uses: membrowse/membrowse-action/onboard-action@v1

.github/workflows/membrowse-report.yml

@@ -86,7 +86,6 @@ jobs:
         uses: ./.github/actions/install-apt-deps
         with:
           packages: ${{ matrix.apt_packages }}
-          cache: ${{ matrix.apt_cache || 'true' }}
 
       - name: Build firmware
         if: needs.check-changes.outputs.needs_build == 'true'

.github/workflows/sssd.yml

@@ -67,7 +67,6 @@ jobs:
         uses: ./.github/actions/install-apt-deps
         with:
           packages: build-essential autoconf libldb-dev libldb2 python3-ldb bc libcap-dev
-          cache: 'false'
 
       - name: Setup env
         run: |