Merge bitcoin-core/secp256k1#1816: ci: Rotate Docker cache keys

2ccff6eb73 ci: Add weekly schedule (Hennadii Stepanov)
2f18567d24 ci: Rotate Docker cache keys every 4 weeks (Hennadii Stepanov)
0ffb1749a5 ci, docker: Fix LLVM repository signature failure (Hennadii Stepanov)

Pull request description:

  This is an alternative to https://github.com/bitcoin-core/secp256k1/pull/1807 that avoids introducing a new workflow with the write permissions.

  Closes https://github.com/bitcoin-core/secp256k1/issues/1691.

  The 4-week rotation interval was chosen based on the following [rationale](https://github.com/bitcoin-core/secp256k1/pull/1816#issuecomment-3833536293):
  > My thinking is that we may want to take only every fourth one. I assume this is still good enough to catch changes introduced by new compiler optimizations, and this is what we care about.
  >
  > We could just take the ISO week number mod 4. That results in an off-by-one error after every (rare) year with 53 ISO weeks, but ok, who cares... And if the cache is evicted for whatever other reason, we'll also get the most recent snapshot, but also that seems acceptable.

  ---

  **IMPORTANT NOTE:** Due to a mere coincidence, LLVM apt signatures became [rejected](https://github.com/llvm/llvm-project/issues/153385) by Debian Trixie today. A commit containing a temporary workaround has been included to address this.

ACKs for top commit:
  real-or-random:
    ACK 2ccff6eb73

Tree-SHA512: c0362b107169d7cd7d36e0f7286d0bd183b734963beaa3915f198bedfd83f14222b779cb87eb6de2b1b940592954947d348a17a416e5db737a757397bd916447

.github/actions/run-in-docker-action/action.yml

@@ -6,8 +6,7 @@ inputs:
     required: true
   scope:
     description: 'A cached image scope'
-    required: false
-    default: ${{ runner.arch }}
+    required: true
   command:
     description: 'A command to run in a container'
     required: true

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
       - '**'
     tags-ignore:
       - '**'
+  schedule:
+    # Run on the default branch every Monday morning.
+    # This also warms the Docker caches after key rotation.
+    - cron: '22 2 * * 1'
 
 concurrency:
   group: ${{ github.event_name != 'pull_request' && github.run_id || github.ref }}
@@ -48,6 +52,8 @@ jobs:
   docker_cache:
     name: "Build ${{ matrix.arch }} Docker image"
     runs-on: ${{ matrix.runner }}
+    outputs:
+      cache_scope: ${{ steps.cache_timestamp.outputs.period }}
 
     strategy:
       fail-fast: false
@@ -59,6 +65,10 @@ jobs:
             runner: ubuntu-24.04-arm
 
     steps:
+      - name: Get cache validity period
+        id: cache_timestamp
+        run: echo "period=$(($(date +%V) / 4))" >> "$GITHUB_OUTPUT"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
@@ -70,8 +80,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           file: ./ci/linux-debian.Dockerfile
-          cache-from: type=gha,scope=${{ runner.arch }}
-          cache-to: type=gha,scope=${{ runner.arch }},mode=min
+          cache-from: type=gha,scope=${{ runner.arch }}-${{ steps.cache_timestamp.outputs.period }}
+          cache-to: type=gha,scope=${{ runner.arch }}-${{ steps.cache_timestamp.outputs.period }},mode=min
 
   x86_64-debian:
     name: "x86_64: Linux (Debian stable)"
@@ -117,6 +127,7 @@ jobs:
         uses: ./.github/actions/run-in-docker-action
         with:
           dockerfile: ./ci/linux-debian.Dockerfile
+          scope: ${{ runner.arch }}-${{ needs.docker_cache.outputs.cache_scope }}
           command: ./ci/ci.sh
 
       - &PRINT_LOGS
@@ -636,6 +647,7 @@ jobs:
         uses: ./.github/actions/run-in-docker-action
         with:
           dockerfile: ./ci/linux-debian.Dockerfile
+          scope: ${{ runner.arch }}-${{ needs.docker_cache.outputs.cache_scope }}
           command: |
             g++ -Werror include/*.h
             clang -Werror -x c++-header include/*.h

ci/linux-debian.Dockerfile

@@ -67,6 +67,9 @@ RUN \
     wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
     # Add repository for this Debian release
     . /etc/os-release && echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME} main" >> /etc/apt/sources.list && \
+    # Temporarily work around Sequoia PGP policy deadline for legacy repositories.
+    # See https://github.com/llvm/llvm-project/issues/153385.
+    sed -i 's/\(sha1\.second_preimage_resistance =\).*/\1 9999-01-01/' /usr/share/apt/default-sequoia.config && \
     apt-get update && \
     # Determine the version number of the LLVM development branch
     LLVM_VERSION=$(apt-cache search --names-only '^clang-[0-9]+$' | sort -V | tail -1 | cut -f1 -d" " | cut -f2 -d"-" ) && \