fix: add JFrog OIDC fallback when dependency cache is cold

setup-python-deps now outputs cache-hit. On cache miss, main.yml falls
back to setup-jfrog-pypi for package resolution. Also fixes YAML parse
error from unindented heredoc by using printf instead.

Author: sd-db

.github/actions/setup-python-deps/action.yml

@@ -1,13 +1,18 @@
 name: "Setup Python Dependencies"
 description: |
   Restores pre-cached Python dependencies and enables offline mode.
-  All package installs (uv, pip, pre-commit) use only the local cache
-  populated by the warmDepsCache workflow — no registry access needed.
+  Outputs cache-hit so callers can fall back to setup-jfrog-pypi on miss.
+
+outputs:
+  cache-hit:
+    description: "Whether the dependency cache was restored"
+    value: ${{ steps.uv-cache.outputs.cache-matched-key != '' }}
 
 runs:
   using: "composite"
   steps:
     - name: Restore uv and pip cache
+      id: uv-cache
       uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: |
@@ -24,10 +29,12 @@ runs:
         restore-keys: pre-commit-deps-
 
     - name: Enable offline mode
+      if: steps.uv-cache.outputs.cache-matched-key != ''
       shell: bash
       run: |
         echo "UV_OFFLINE=true" >> "$GITHUB_ENV"
         # verify env uses pip, not uv
         echo "PIP_NO_INDEX=1" >> "$GITHUB_ENV"
         mkdir -p ~/.config/pip
         printf '[global]\nno-index = true\n' > ~/.config/pip/pip.conf
+        echo "Cache restored — offline mode enabled"

.github/workflows/main.yml

@@ -1,8 +1,8 @@
 # **what?**
 # Runs code quality checks, unit tests, and verifies python build on
-# all code commited to the repository. This workflow does not require
-# any secrets — dependencies are served from a pre-populated cache
-# (see warmDepsCache.yml), so it works for both internal and fork PRs.
+# all code commited to the repository. Dependencies are served from a
+# pre-populated cache (see warmDepsCache.yml) when available, with a
+# JFrog OIDC fallback when the cache is cold.
 
 # **why?**
 # Ensure code for dbt meets a certain quality standard.
@@ -29,6 +29,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  id-token: write
   contents: read
 
 # will cancel previous workflows triggered by the same event and for the same ref for PRs or same SHA otherwise
@@ -60,8 +61,13 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Setup Python Dependencies
+        id: deps
         uses: ./.github/actions/setup-python-deps
 
+      - name: Setup JFrog PyPI Proxy (fallback)
+        if: steps.deps.outputs.cache-hit != 'true'
+        uses: ./.github/actions/setup-jfrog-pypi
+
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
@@ -85,6 +91,7 @@ jobs:
     timeout-minutes: 15
 
     permissions:
+      id-token: write
       # Gives the action the necessary permissions for publishing new
       # comments in pull requests.
       pull-requests: write
@@ -106,8 +113,13 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Setup Python Dependencies
+        id: deps
         uses: ./.github/actions/setup-python-deps
 
+      - name: Setup JFrog PyPI Proxy (fallback)
+        if: steps.deps.outputs.cache-hit != 'true'
+        uses: ./.github/actions/setup-jfrog-pypi
+
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
@@ -150,8 +162,13 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 
       - name: Setup Python Dependencies
+        id: deps
         uses: ./.github/actions/setup-python-deps
 
+      - name: Setup JFrog PyPI Proxy (fallback)
+        if: steps.deps.outputs.cache-hit != 'true'
+        uses: ./.github/actions/setup-jfrog-pypi
+
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with: