ci: setup survives npm registry outages

.github/actions/setup-ci-deps/action.yml

@@ -3,22 +3,38 @@ description: Install Vite+ and the workspace dependencies from cache.
 runs:
   using: composite
   steps:
-    # setup-vp reuses an installed exact version, so restoring its home skips the
-    # installer download on every job.
+    # ~/.vite-plus holds vp, the Node.js runtime, and pnpm. A cache entry never
+    # updates, so the key names all three versions; otherwise a pnpm or Node.js
+    # bump makes every job download them from npm again.
     - name: Resolve Vite+ version
       id: vp
       shell: bash
       run: |
         echo "version=$(sed -nE 's/^  vite-plus: ([0-9][^ ]*)$/\1/p' pnpm-workspace.yaml)" >> "$GITHUB_OUTPUT"
+        echo "node=$(jq -r '.engines.node' package.json)" >> "$GITHUB_OUTPUT"
+        echo "pnpm=$(jq -r '.packageManager' package.json)" >> "$GITHUB_OUTPUT"
 
     - name: Cache Vite+
+      id: vp_cache
       if: steps.vp.outputs.version != ''
       uses: actions/cache@v6
       with:
         path: ~/.vite-plus
-        key: vite-plus-home-v1-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}
+        key: vite-plus-home-v2-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}-node${{ steps.vp.outputs.node }}-${{ steps.vp.outputs.pnpm }}
+
+    # setup-vp always runs the installer, which fetches vp from npm even when
+    # this exact version is installed. A cache hit already has everything, so
+    # skip setup-vp and do its remaining work here. This keeps npm outages from
+    # failing jobs.
+    - name: Use cached Vite+
+      if: steps.vp_cache.outputs.cache-hit == 'true'
+      shell: bash
+      run: |
+        echo "$HOME/.vite-plus/bin" >> "$GITHUB_PATH"
+        "$HOME/.vite-plus/bin/vp" env use "${{ steps.vp.outputs.node }}"
 
     - name: Setup Vite+
+      if: steps.vp_cache.outputs.cache-hit != 'true'
       uses: voidzero-dev/setup-vp@v1
       with:
         node-version-file: package.json