sops: add cache

Add GH runner caching for ephemeral runners

sops/README.md

@@ -2,4 +2,4 @@
 
 generate new age keys with `age-keygen -o ~/.config/sops/age/key-name.txt`. encrypt local secrets with `sops -e service-name/.env > service-name/.sops.env`.
 
-the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch and decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.
+the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch, caching it under `$RUNNER_TEMP/sops` keyed on the version and runner platform so later runs skip the download. it then decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.

sops/action.yml

@@ -9,7 +9,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: install SOPS
+    - name: resolve SOPS target
       shell: bash
       env:
         ## renovate: datasource=github-releases depName=getsops/sops
@@ -19,7 +19,27 @@ runs:
 
         os=$(uname -s | tr '[:upper:]' '[:lower:]')
         arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-        asset="sops-${SOPS_VERSION}.${os}.${arch}"
+
+        {
+          echo "SOPS_VERSION=$SOPS_VERSION"
+          echo "SOPS_OS=$os"
+          echo "SOPS_ARCH=$arch"
+        } >> "$GITHUB_ENV"
+
+    - name: restore cached SOPS
+      id: sops-cache
+      uses: actions/cache@v4
+      with:
+        path: ${{ runner.temp }}/sops
+        key: sops-${{ runner.os }}-${{ runner.arch }}-${{ env.SOPS_VERSION }}
+
+    - name: install SOPS
+      if: steps.sops-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        asset="sops-${SOPS_VERSION}.${SOPS_OS}.${SOPS_ARCH}"
         url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"
 
         tmp=$(mktemp -d)
@@ -29,8 +49,17 @@ runs:
           -o "$tmp/checksums.txt" "$url/sops-${SOPS_VERSION}.checksums.txt"
         (cd "$tmp" && grep " ${asset}$" checksums.txt | shasum -a 256 -c -)
 
+        mkdir -p "$RUNNER_TEMP/sops"
         chmod +x "$tmp/$asset"
-        sudo mv "$tmp/$asset" /usr/local/bin/sops
+        mv "$tmp/$asset" "$RUNNER_TEMP/sops/sops"
+
+    - name: add SOPS to PATH
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        chmod +x "$RUNNER_TEMP/sops/sops"
+        echo "$RUNNER_TEMP/sops" >> "$GITHUB_PATH"
 
     - name: decrypt .sops files
       shell: bash