ci: port OIIO improvements - shared steps, upgrade to new actions

OpenImageIO and OSL have similar CI infrastructure, mostly share a
design of such, and copy the files back and forth to synchronize from
time to time. Turns out it's been a while since the last sync, and a
lot of small improvements have accumulated on the OIIO side.

* Bump our CI workflow externally-hosted actions to the latest versions.
* Use shared-steps workflow for the old aswf container jobs.
* Split some of the steps of the shared-steps workflow into "old" and
  "new" in cases where the 2022 ASWF docker containers containers cannot
  run the latest actions, only update those to the most recent that are
  able for those containers.
* Restore bleeding edge test to pybind11 master -- the reason we locked
  it down has since been fixed on the OIIO side.

Signed-off-by: Larry Gritz <lg@larrygritz.com>

Author: lgritz

.github/workflows/build-steps.yml

@@ -40,6 +40,12 @@ on:
         type: string
       fmt_ver:
         type: string
+      fmt_commit:
+        type: string
+      gcc_action_ver:
+        type: string
+      llvm_action_ver:
+        type: string
       opencolorio_ver:
         type: string
       openexr_ver:
@@ -48,9 +54,9 @@ on:
         type: string
       pybind11_ver:
         type: string
-      python_ver:
+      python_action_ver:
         type: string
-      llvm_action_ver:
+      python_ver:
         type: string
       setenvs:
         type: string
@@ -62,6 +68,8 @@ on:
         type: string
       abi_check:
         type: string
+      benchmark:
+        type: string
       build_docs:
         type: string
       clang_format:
@@ -76,8 +84,17 @@ on:
         type: string
       sonar:
         type: string
+      old_node:
+        type: string
+        default: 0
       nametag:
         type: string
+      required_deps:
+        type: string
+      optional_deps:
+        type: string
+      build_local_deps:
+        type: string
     secrets:
         PASSED_GITHUB_TOKEN:
           required: false
@@ -111,6 +128,7 @@ jobs:
       USE_SIMD: ${{inputs.simd}}
       FMT_VERSION: ${{inputs.fmt_ver}}
       fmt_BUILD_VERSION: ${{inputs.fmt_ver}}
+      fmt_GIT_COMMIT: ${{inputs.fmt_commit}}
       OPENCOLORIO_VERSION: ${{inputs.opencolorio_ver}}
       OPENEXR_VERSION: ${{inputs.openexr_ver}}
       OPENIMAGEIO_VERSION: ${{inputs.openimageio_ver}}
@@ -120,13 +138,31 @@ jobs:
       ABI_CHECK: ${{inputs.abi_check}}
       ACTIONS_RUNNER_FORCE_ACTIONS_NODE_VERSION: node16
       ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+      # For CI, sometimes we want to require all dependencies to be present,
+      # except for a select few listed explicitly. This ensures that we don't
+      # accidentally have a situation in which we think we are building
+      # against and testing an optional dependency, but in fact are not.
+      OSL_REQUIRED_DEPS: ${{inputs.required_deps}}
+      OSL_OPTIONAL_DEPS: ${{inputs.optional_deps}}
+      OSL_BUILD_LOCAL_DEPS: ${{inputs.build_local_deps}}
       SETENVS: ${{inputs.setenvs}}
       DEPCMDS: ${{inputs.depcmds}}
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: '0'
+      # Install nodejs 20 with glibc 2.17, to work around the face that the
+      # GHA runners are insisting on a node version that is too new for the
+      # glibc in the ASWF containers prior to 2023.
+      - name: install nodejs20glibc2.17
+        if: inputs.old_node == '1'
+        run: |
+          curl --silent https://unofficial-builds.nodejs.org/download/release/v20.18.1/node-v20.18.1-linux-x64-glibc-217.tar.xz | tar -xJ --strip-components 1 -C /node20217 -f -
+      - name: Checkout repo
+        if: inputs.old_node != '1'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout repo-OLD
+        if: inputs.old_node == '1'
+        # Must use an old checkout action for old containers
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - name: Install LLVM and Clang
         if: inputs.llvm_action_ver != ''
         uses: KyleMayes/install-llvm-action@ebc0426251bc40c7cd31162802432c68818ab8f0 # v2.0.9
@@ -142,13 +178,34 @@ jobs:
         shell: bash
         run: echo "date=`date -u +'%Y-%m-%dT%H:%M:%SZ'`" >> $GITHUB_OUTPUT
       - name: ccache-restore
+        if: inputs.old_node != '1'
         id: ccache-restore
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: ${{ env.CCACHE_DIR }}
+          key: ${{inputs.nametag}}-${{steps.ccache_cache_keys.outputs.date}}
+          restore-keys: ${{inputs.nametag}}
+      - name: ccache-restore-OLD
+        if: inputs.old_node == '1'
+        id: ccache-restore-old
+        # Must use an old cache restore action for old containers
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ env.CCACHE_DIR }}
           # path: ./ccache
           key: ${{inputs.nametag}}-${{steps.ccache_cache_keys.outputs.date}}
           restore-keys: ${{inputs.nametag}}
+      - name: Install gcc
+        if: inputs.gcc_action_ver != ''
+        run: |
+            sudo add-apt-repository ppa:ubuntu-toolchain-r/test -y
+            sudo apt-get update -y
+            sudo apt-get install -y g++-${{inputs.gcc_action_ver}}
+      - name: Install python
+        if: inputs.python_action_ver != ''
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: ${{ inputs.python_action_ver }}
       - name: Dependencies
         shell: bash
         run: |
@@ -170,14 +227,14 @@ jobs:
             fi
       - name:  Install sonar-scanner and build-wrapper
         if: inputs.sonar == '1'
-        uses: sonarsource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
+        uses: sonarsource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0
       - name: Build
         if: inputs.skip_build != '1'
         shell: bash
         run: src/build-scripts/ci-build.bash
       - name: Check out ABI standard
         if: inputs.abi_check != ''
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{inputs.abi_check}}
           path: abi_standard
@@ -190,7 +247,16 @@ jobs:
             src/build-scripts/ci-build.bash
             popd
       - name: ccache-save
+        if: inputs.old_node != '1'
         id: ccache-save
+        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: ${{ env.CCACHE_DIR }}
+          key: ${{inputs.nametag}}-${{steps.ccache_cache_keys.outputs.date}}
+      - name: ccache-save-OLD
+        if: inputs.old_node == '1'
+        id: ccache-save-old
+        # Must use an old cache action for old containers
         uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -199,6 +265,10 @@ jobs:
         if: inputs.skip_tests != '1'
         shell: bash
         run: src/build-scripts/ci-test.bash
+      - name: Benchmarks
+        if: inputs.benchmark == '1'
+        shell: bash
+        run: src/build-scripts/ci-benchmark.bash
       - name: clang-format
         if: inputs.clang_format == '1'
         shell: bash
@@ -232,14 +302,30 @@ jobs:
             cd src/doc
             time make doxygen
             time make sphinx
-      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
-        if: ${{ failure() || inputs.build_docs == '1'}}
+      - name: Upload testsuite debugging artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        if: ${{ inputs.old_node != '1' && (failure() || inputs.build_docs == '1' || inputs.benchmark == '1' || inputs.abi_check != '') }}
+        with:
+          name: osl-${{github.job}}-${{inputs.nametag}}
+          path: |
+            build/cmake-save
+            build/compat_reports
+            build/sphinx
+            build/benchmarks
+            build/*.cmake
+            build/CMake*
+            build/testsuite/*/*.*
+            ${{ inputs.extra_artifacts }}
+      - name: Upload testsuite debugging artifacts-OLD
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        if: ${{ inputs.old_node == '1' && (failure() || inputs.build_docs == '1' || inputs.benchmark == '1' || inputs.abi_check != '') }}
         with:
           name: osl-${{github.job}}-${{inputs.nametag}}
           path: |
             build/cmake-save
             build/compat_reports
             build/sphinx
+            build/benchmarks
             build/*.cmake
             build/CMake*
             build/testsuite/*/*.*