ci: install only the uv binary for v4 ingest; rename commit-metadata workflow

.github/workflows/bench.yml

@@ -136,17 +136,24 @@ jobs:
       # `continue-on-error` so an OIDC / uv / connect hiccup never breaks the v3
       # pipeline. post-ingest.py mints the RDS IAM token internally (boto3) from
       # the assumed GitHubBenchmarkIngestRole; sslmode=verify-full validates the cert.
+      #
+      # ORDER MATTERS: "Install uv" runs BEFORE "Configure AWS credentials".
+      # configure-aws-credentials persists the assumed ingest-role (rds-db:connect
+      # only) as the job's ambient AWS creds; the uv setup compiles via sccache
+      # (S3-backed), so running it after the role switch fails with S3 AccessDenied.
+      # Installing uv first keeps sccache on the original S3-capable creds; the role
+      # is assumed immediately before the ingest, which needs only rds-db:connect.
+      - name: Install uv for v4 ingest
+        if: vars.GH_BENCH_INGEST_ROLE_ARN != ''
+        continue-on-error: true
+        uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63  # 0.18.6
       - name: Configure AWS credentials for v4 ingest (OIDC)
         if: vars.GH_BENCH_INGEST_ROLE_ARN != ''
         continue-on-error: true
         uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b  # v6
         with:
           role-to-assume: ${{ vars.GH_BENCH_INGEST_ROLE_ARN }}
           aws-region: ${{ vars.RDS_BENCH_REGION }}
-      - name: Install uv for v4 ingest
-        if: vars.GH_BENCH_INGEST_ROLE_ARN != ''
-        continue-on-error: true
-        uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63  # 0.18.6
       - name: Ingest results to v4 Postgres (best-effort)
         if: vars.GH_BENCH_INGEST_ROLE_ARN != ''
         continue-on-error: true

.github/workflows/v3-commit-metadata.yml → .github/workflows/commit-metadata.yml

@@ -1,7 +1,9 @@
-# Posts a v3 ingest envelope with no records on every push to develop, so the
-# `commits` dim stays populated even when no benchmark ran.
+# Uploads commit metadata (an empty ingest envelope -- no benchmark records) on
+# every push to develop, to both the v3 server and the v4 Postgres, so the
+# `commits` dim stays populated even when no benchmark ran. Needed by both
+# backends, hence not named for either.
 
-name: v3 commit metadata
+name: Commit metadata
 
 on:
   push:
@@ -39,17 +41,24 @@ jobs:
       # a v4 failure never fails the job (promoted to required at cutover, PR-5.1).
       # Gated on the ingest-role ARN var (the assume-role input that MUST exist) so
       # it no-ops until v4 infra is wired.
+      #
+      # ORDER MATTERS: "Install uv" runs BEFORE "Configure AWS credentials".
+      # configure-aws-credentials persists the assumed ingest-role (rds-db:connect
+      # only) as the job's ambient AWS creds; the uv setup compiles via sccache
+      # (S3-backed), so running it after the role switch fails with S3 AccessDenied.
+      # Installing uv first keeps sccache on the original S3-capable creds; the role
+      # is assumed immediately before the ingest, which needs only rds-db:connect.
+      - name: Install uv for v4 ingest
+        if: vars.GH_BENCH_INGEST_ROLE_ARN != ''
+        continue-on-error: true
+        uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63  # 0.18.6
       - name: Configure AWS credentials for v4 ingest (OIDC)
         if: vars.GH_BENCH_INGEST_ROLE_ARN != ''
         continue-on-error: true
         uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b  # v6
         with:
           role-to-assume: ${{ vars.GH_BENCH_INGEST_ROLE_ARN }}
           aws-region: ${{ vars.RDS_BENCH_REGION }}
-      - name: Install uv for v4 ingest
-        if: vars.GH_BENCH_INGEST_ROLE_ARN != ''
-        continue-on-error: true
-        uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63  # 0.18.6
       - name: Ingest commit metadata to v4 Postgres (best-effort)
         if: vars.GH_BENCH_INGEST_ROLE_ARN != ''
         continue-on-error: true

.github/workflows/sql-benchmarks.yml

@@ -689,17 +689,24 @@ jobs:
       # input that MUST exist for OIDC to succeed; it no-ops until v4 infra is wired), and
       # every step is continue-on-error. post-ingest.py mints the RDS IAM token (boto3) from
       # the assumed GitHubBenchmarkIngestRole; sslmode=verify-full validates the cert.
+      #
+      # ORDER MATTERS: "Install uv" runs BEFORE "Configure AWS credentials".
+      # configure-aws-credentials persists the assumed ingest-role (rds-db:connect
+      # only) as the job's ambient AWS creds; the uv setup compiles via sccache
+      # (S3-backed), so running it after the role switch fails with S3 AccessDenied.
+      # Installing uv first keeps sccache on the original S3-capable creds; the role
+      # is assumed immediately before the ingest, which needs only rds-db:connect.
+      - name: Install uv for v4 ingest
+        if: inputs.mode == 'develop' && vars.GH_BENCH_INGEST_ROLE_ARN != ''
+        continue-on-error: true
+        uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63  # 0.18.6
       - name: Configure AWS credentials for v4 ingest (OIDC)
         if: inputs.mode == 'develop' && vars.GH_BENCH_INGEST_ROLE_ARN != ''
         continue-on-error: true
         uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b  # v6
         with:
           role-to-assume: ${{ vars.GH_BENCH_INGEST_ROLE_ARN }}
           aws-region: ${{ vars.RDS_BENCH_REGION }}
-      - name: Install uv for v4 ingest
-        if: inputs.mode == 'develop' && vars.GH_BENCH_INGEST_ROLE_ARN != ''
-        continue-on-error: true
-        uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63  # 0.18.6
       - name: Ingest results to v4 Postgres (best-effort)
         if: inputs.mode == 'develop' && vars.GH_BENCH_INGEST_ROLE_ARN != ''
         continue-on-error: true