Added CX-8 as its own car

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,47 @@
+name: Bug report
+description: For issues with running openpilot on your comma device
+labels: ["bug"]
+body:
+
+  - type: markdown
+    attributes:
+      value: >
+        Before creating a **bug report**, please check the following:
+          * If the issue likely only affects your car model or make, go back and open a **car bug report** instead.
+          * If the issue is related to the driving or driver monitoring models, you should open a [discussion](https://github.com/commaai/openpilot/discussions/categories/model-feedback) instead.
+          * Ensure you're running the latest openpilot release.
+          * Ensure you're using officially supported hardware. Issues running on PCs have a different issue template.
+          * Ensure there isn't an existing issue for your bug. If there is, leave a comment on the existing issue.
+          * Ensure you're running stock openpilot. We cannot look into bug reports from forks.
+
+        If you're unsure whether you've hit a bug, check out the #installation-help channel in the [community Discord server](https://discord.comma.ai).
+
+  - type: textarea
+    attributes:
+      label: Describe the bug
+      description: Also include a description of how to reproduce the bug
+    validations:
+      required: true
+
+  - type: input
+    id: route
+    attributes:
+      label: Provide a route where the issue occurs
+      description: Ensure the route is fully uploaded at https://useradmin.comma.ai. We cannot look into issues without routes, or at least a Dongle ID.
+      placeholder: 77611a1fac303767|2020-05-11--16-37-07
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: openpilot version
+      description: If you're not on release, provide the commit hash
+      placeholder: 0.8.10
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: Additional info
+

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Car bug report
+    url: https://github.com/commaai/opendbc/issues/new
+    about: For issues with a particular car make or model
+  - name: Join the Discord
+    url: https://discord.comma.ai
+    about: The community Discord is for both openpilot development and experience discussion
+  - name: Report driving behavior feedback
+    url: https://discord.com/channels/469524606043160576/1254834193066623017
+    about: Feedback for the driving and driver monitoring models goes in the #driving-feedback in Discord
+  - name: Community Wiki
+    url: https://github.com/commaai/openpilot/wiki
+    about: Check out our community wiki

.github/ISSUE_TEMPLATE/enhancement.md

@@ -0,0 +1,8 @@
+---
+name: Enhancement
+about: For openpilot enhancement suggestions
+title: ''
+labels: 'enhancement'
+assignees: ''
+---
+

.github/ISSUE_TEMPLATE/pc_bug_report.yml

@@ -0,0 +1,42 @@
+name: PC bug report
+description: For issues with running openpilot on PC
+labels: ["PC"]
+body:
+
+  - type: markdown
+    attributes:
+      value: >
+        Before creating a **bug report**, please check the following:
+          * Ensure you're running the latest openpilot release.
+          * Ensure there isn't an existing issue for your bug. If there is, leave a comment on the existing issue.
+          * Ensure you're running stock openpilot. We cannot look into bug reports from forks.
+
+        If you're unsure whether you've hit a bug, check out the #installation-help channel in the [community Discord server](https://discord.comma.ai).
+
+  - type: textarea
+    attributes:
+      label: Describe the bug
+      description: Also include a description of how to reproduce the bug
+    validations:
+      required: true
+
+  - type: input
+    id: os-version
+    attributes:
+      label: OS Version
+      placeholder: Ubuntu 24.04
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: openpilot version or commit
+      placeholder: bd36f2ec8d3559909678eff2690c10a520938367
+    validations:
+      required: false
+
+  - type: textarea
+    attributes:
+      label: Additional info
+

.github/labeler.yaml

@@ -0,0 +1,27 @@
+CI / testing:
+  - changed-files:
+    - any-glob-to-all-files: "{.github/**,**/test_*,**/test/**,Jenkinsfile}"
+
+car:
+  - changed-files:
+    - any-glob-to-all-files: '{selfdrive/car/**,opendbc_repo}'
+
+simulation:
+  - changed-files:
+    - any-glob-to-all-files: 'tools/sim/**'
+
+ui:
+  - changed-files:
+    - any-glob-to-all-files: '{selfdrive/assets/**,selfdrive/ui/**,system/ui/**}'
+
+tools:
+  - changed-files:
+    - any-glob-to-all-files: 'tools/**'
+
+multilanguage:
+  - changed-files:
+    - any-glob-to-all-files: 'selfdrive/ui/translations/**'
+
+autonomy:
+  - changed-files:
+    - any-glob-to-all-files: "{selfdrive/modeld/models/**,selfdrive/test/process_replay/model_replay_ref_commit}"

.github/pull_request_template.md

@@ -0,0 +1,68 @@
+<!-- Please copy and paste the relevant template -->
+
+<!--- ***** Template: Fingerprint *****
+
+**Car**
+Which car (make, model, year) this fingerprint is for
+
+**Route**
+A route with the fingerprint
+
+-->
+
+<!--- ***** Template: Car Bugfix *****
+
+**Description**
+
+A description of the bug and the fix. Also link the issue if it exists. 
+
+**Verification**
+
+Explain how you tested this bug fix. 
+
+**Route**
+
+Route: [a route with the bug fix]
+
+
+-->
+
+<!--- ***** Template: Bugfix *****
+
+**Description**
+
+A description of the bug and the fix. Also link the issue if it exists. 
+
+**Verification**
+
+Explain how you tested this bug fix. 
+
+
+-->
+
+<!--- ***** Template: Car Port *****
+
+**Checklist**
+
+- [ ] added entry to CAR in selfdrive/car/*/values.py and ran `selfdrive/car/docs.py` to generate new docs
+- [ ] test route added to [routes.py](https://github.com/commaai/openpilot/blob/master/selfdrive/car/tests/routes.py)
+- [ ] route with openpilot:
+- [ ] route with stock system:
+- [ ] car harness used (if comma doesn't sell it, put N/A):
+
+
+-->
+
+<!--- ***** Template: Refactor *****
+
+**Description**
+
+A description of the refactor, including the goals it accomplishes. 
+
+**Verification**
+
+Explain how you tested the refactor for regressions. 
+
+
+-->
+

.github/workflows/auto-cache/action.yaml

@@ -0,0 +1,58 @@
+name: 'automatically cache based on current runner'
+
+inputs:
+  path:
+    description: 'path to cache'
+    required: true
+  key:
+    description: 'key'
+    required: true
+  restore-keys:
+    description: 'restore-keys'
+    required: true
+  save:
+    description: 'whether to save the cache'
+    default: 'true'
+    required: false
+outputs:
+  cache-hit:
+    description: 'cache hit occurred'
+    value: ${{ (contains(runner.name, 'nsc') && steps.ns-cache.outputs.cache-hit) ||
+               (!contains(runner.name, 'nsc') && inputs.save != 'false' && steps.gha-cache.outputs.cache-hit) ||
+               (!contains(runner.name, 'nsc') && inputs.save == 'false' && steps.gha-cache-ro.outputs.cache-hit) }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: setup namespace cache
+      id: ns-cache
+      if: ${{ contains(runner.name, 'nsc') }}
+      uses: namespacelabs/nscloud-cache-action@v1
+      with:
+        path: ${{ inputs.path }}
+
+    - name: setup github cache
+      id: gha-cache
+      if: ${{ !contains(runner.name, 'nsc') && inputs.save != 'false' }}
+      uses: 'actions/cache@v4'
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}
+        restore-keys: ${{ inputs.restore-keys }}
+
+    - name: setup github cache
+      id: gha-cache-ro
+      if: ${{ !contains(runner.name, 'nsc') && inputs.save == 'false' }}
+      uses: 'actions/cache/restore@v4'
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}
+        restore-keys: ${{ inputs.restore-keys }}
+
+    # make the directory manually in case we didn't get a hit, so it doesn't fail on future steps
+    - id: scons-cache-setup
+      shell: bash
+      run: |
+        mkdir -p ${{ inputs.path }}
+        sudo chmod -R 777 ${{ inputs.path }}
+        sudo chown -R $USER ${{ inputs.path }}

.github/workflows/compile-openpilot/action.yaml

@@ -0,0 +1,21 @@
+name: 'compile openpilot'
+
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      name: Build openpilot with all flags
+      run: |
+        ${{ env.RUN }} "scons -j$(nproc)"
+        ${{ env.RUN }} "release/check-dirty.sh"
+    - shell: bash
+      name: Cleanup scons cache and rebuild
+      run: |
+          ${{ env.RUN }} "rm -rf /tmp/scons_cache/* && \
+                          scons -j$(nproc) --cache-populate"
+    - name: Save scons cache
+      uses: actions/cache/save@v4
+      if: github.ref == 'refs/heads/master'
+      with:
+        path: .ci_cache/scons_cache
+        key: scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}-${{ github.sha }}

.github/workflows/compile_bluescreens.yaml

@@ -0,0 +1,211 @@
+name: Compile Bluescreens
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_ref:
+        description: "Branch to build and publish back to"
+        type: string
+        default: "bluescreensonly2"
+        required: true
+      jobs:
+        description: "Optional parallel job count passed to ./build"
+        type: string
+        default: "12"
+        required: false
+      enable_scons_cache:
+        description: "Enable SCons cache for faster incremental builds"
+        type: boolean
+        default: true
+        required: false
+      build_all:
+        description: "Build everything"
+        type: boolean
+        default: true
+        required: false
+      build_ui:
+        description: "Build UI (selfdrive/ui)"
+        type: boolean
+        default: true
+        required: false
+      build_params:
+        description: "Build params Python extension"
+        type: boolean
+        default: false
+        required: false
+      build_cereal:
+        description: "Build cereal messaging bridge"
+        type: boolean
+        default: false
+        required: false
+      build_panda:
+        description: "Build panda firmware outputs"
+        type: boolean
+        default: true
+        required: false
+      build_modeld:
+        description: "Build modeld Python extension"
+        type: boolean
+        default: false
+        required: false
+      build_controls:
+        description: "Build controls solvers + locationd generated models"
+        type: boolean
+        default: false
+        required: false
+
+concurrency:
+  group: compile-bluescreens-${{ inputs.target_ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+env:
+  GIT_EMAIL: "168790843+firestar5683@users.noreply.github.com"
+  GIT_NAME: "StarPilot Build Bot"
+  TARGET_REF: ${{ inputs.target_ref }}
+
+jobs:
+  build_and_push:
+    runs-on: [self-hosted, truenas, starpilot-build]
+    timeout-minutes: 720
+    steps:
+      - name: Validate target branch
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${TARGET_REF}" ]]; then
+            echo "target_ref is required." >&2
+            exit 1
+          fi
+
+          if [[ "${TARGET_REF}" == refs/heads/* ]]; then
+            echo "BUILD_BRANCH=${TARGET_REF#refs/heads/}" >> "$GITHUB_ENV"
+          else
+            echo "BUILD_BRANCH=${TARGET_REF}" >> "$GITHUB_ENV"
+          fi
+
+      - name: Checkout target branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.BUILD_BRANCH }}
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Configure git identity
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "$GIT_NAME"
+          git config user.email "$GIT_EMAIL"
+          git config http.postBuffer 104857600
+
+      - name: Ensure branch exists on origin
+        shell: bash
+        run: |
+          set -euo pipefail
+          git ls-remote --exit-code --heads origin "refs/heads/${BUILD_BRANCH}" >/dev/null
+
+      - name: Link persistent sysroot
+        shell: bash
+        run: |
+          set -euo pipefail
+          ls -ld /runner /runner/sysroots /runner/sysroots/default || true
+          ls -ld /runner/sysroots/default/usr /runner/sysroots/default/usr/local /runner/sysroots/default/usr/local/lib || true
+          rm -rf .comma_sysroot
+          ln -s /runner/sysroots/default .comma_sysroot
+          ls -ld .comma_sysroot .comma_sysroot/usr .comma_sysroot/usr/local .comma_sysroot/usr/local/lib
+
+      - name: Run Bluescreens build
+        shell: bash
+        env:
+          SP_ENABLE_SCONS_CACHE: ${{ inputs.enable_scons_cache && '1' || '0' }}
+        run: |
+          set -euo pipefail
+
+          RUNNER_HOST_ROOT="/mnt/Apparition/My_App_Data/starpilot-runner"
+          if [[ "${GITHUB_WORKSPACE}" != /runner/_work/* ]]; then
+            echo "Unexpected GITHUB_WORKSPACE: ${GITHUB_WORKSPACE}" >&2
+            exit 1
+          fi
+
+          WORKSPACE_REL="${GITHUB_WORKSPACE#/runner}"
+          export COMMA_HOST_ROOT_DIR="${RUNNER_HOST_ROOT}${WORKSPACE_REL}"
+          export COMMA_HOST_SYSROOT_DIR="${RUNNER_HOST_ROOT}/sysroots/default"
+          export COMMA_HOST_CACHE_DIR="${RUNNER_HOST_ROOT}/cache/work"
+          export COMMA_HOST_VENV_DIR="${RUNNER_HOST_ROOT}/cache/venv-linux-arm64"
+          export COMMA_SYSROOT_DIR="/runner/sysroots/default"
+
+          echo "GITHUB_WORKSPACE=${GITHUB_WORKSPACE}"
+          echo "COMMA_HOST_ROOT_DIR=${COMMA_HOST_ROOT_DIR}"
+          echo "COMMA_HOST_SYSROOT_DIR=${COMMA_HOST_SYSROOT_DIR}"
+          echo "COMMA_HOST_CACHE_DIR=${COMMA_HOST_CACHE_DIR}"
+          echo "COMMA_HOST_VENV_DIR=${COMMA_HOST_VENV_DIR}"
+
+          JOBS="${{ inputs.jobs }}"
+
+          if [[ "${{ inputs.build_all }}" == "true" ]]; then
+            if [[ -n "${JOBS}" ]]; then
+              ./build "${JOBS}"
+            else
+              ./build
+            fi
+            exit 0
+          fi
+
+          TARGETS=()
+          [[ "${{ inputs.build_ui }}" == "true" ]] && TARGETS+=("selfdrive/ui/ui")
+          [[ "${{ inputs.build_params }}" == "true" ]] && TARGETS+=("common/params_pyx.so")
+          [[ "${{ inputs.build_cereal }}" == "true" ]] && TARGETS+=("cereal/messaging/bridge")
+          if [[ "${{ inputs.build_panda }}" == "true" ]]; then
+            TARGETS+=(
+              "panda/board/obj/panda.bin.signed"
+              "panda/board/obj/panda_h7.bin.signed"
+              "panda/board/obj/panda_remote.bin.signed"
+              "panda/board/obj/panda_h7_remote.bin.signed"
+              "panda/board/obj/panda_jungle_h7.bin.signed"
+              "panda/board/obj/body_h7.bin.signed"
+            )
+          fi
+          [[ "${{ inputs.build_modeld }}" == "true" ]] && TARGETS+=("selfdrive/modeld/models/commonmodel_pyx.so")
+          if [[ "${{ inputs.build_controls }}" == "true" ]]; then
+            TARGETS+=(
+              "selfdrive/controls/lib/lateral_mpc_lib/c_generated_code/libacados_ocp_solver_lat.so"
+              "selfdrive/controls/lib/longitudinal_mpc_lib/c_generated_code/libacados_ocp_solver_long.so"
+              "selfdrive/locationd/models/generated/car.cpp"
+              "selfdrive/locationd/models/generated/pose.cpp"
+            )
+          fi
+
+          if [[ ${#TARGETS[@]} -eq 0 ]]; then
+            echo "No partial targets selected; defaulting to UI + panda"
+            TARGETS=("selfdrive/ui/ui" "panda/board/obj/panda.bin.signed")
+          fi
+
+          echo "Running partial build for targets: ${TARGETS[*]}"
+          if [[ -n "${JOBS}" ]]; then
+            ./build "${JOBS}" "${TARGETS[@]}"
+          else
+            ./build "$(nproc)" "${TARGETS[@]}"
+          fi
+
+      - name: Commit build output
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "$(git status --porcelain --untracked-files=no)" ]]; then
+            echo "No build output changes detected."
+            exit 0
+          fi
+
+          git add -u
+          git commit -m "build"
+
+      - name: Push build commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          git push origin "HEAD:refs/heads/${BUILD_BRANCH}"

.github/workflows/compile_starpilot.yaml

@@ -0,0 +1,115 @@
+name: Compile StarPilot
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_ref:
+        description: "Branch to build and publish back to"
+        type: string
+        default: "master"
+        required: true
+      jobs:
+        description: "Optional parallel job count passed to ./build"
+        type: string
+        default: "12"
+        required: false
+
+concurrency:
+  group: compile-starpilot-${{ inputs.target_ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+env:
+  GIT_EMAIL: "168790843+firestar5683@users.noreply.github.com"
+  GIT_NAME: "StarPilot Build Bot"
+  TARGET_REF: ${{ inputs.target_ref }}
+
+jobs:
+  build_and_push:
+    runs-on: [self-hosted, truenas, starpilot-build]
+    timeout-minutes: 720
+    steps:
+      - name: Validate target branch
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${TARGET_REF}" ]]; then
+            echo "target_ref is required." >&2
+            exit 1
+          fi
+
+          if [[ "${TARGET_REF}" == refs/heads/* ]]; then
+            echo "BUILD_BRANCH=${TARGET_REF#refs/heads/}" >> "$GITHUB_ENV"
+          else
+            echo "BUILD_BRANCH=${TARGET_REF}" >> "$GITHUB_ENV"
+          fi
+
+      - name: Checkout target branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.BUILD_BRANCH }}
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Configure git identity
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "$GIT_NAME"
+          git config user.email "$GIT_EMAIL"
+          git config http.postBuffer 104857600
+
+      - name: Ensure branch exists on origin
+        shell: bash
+        run: |
+          set -euo pipefail
+          git ls-remote --exit-code --heads origin "refs/heads/${BUILD_BRANCH}" >/dev/null
+
+      - name: Link persistent sysroot
+        shell: bash
+        run: |
+          set -euo pipefail
+          ls -ld /runner /runner/sysroots /runner/sysroots/default || true
+          ls -ld /runner/sysroots/default/usr /runner/sysroots/default/usr/local /runner/sysroots/default/usr/local/lib || true
+          rm -rf .comma_sysroot
+          ln -s /runner/sysroots/default .comma_sysroot
+          ls -ld .comma_sysroot .comma_sysroot/usr .comma_sysroot/usr/local .comma_sysroot/usr/local/lib
+
+      - name: Run StarPilot device build
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          export COMMA_HOST_ROOT_DIR="/mnt/Apparition/My_App_Data/starpilot-runner/_work/${GITHUB_REPOSITORY#*/}/${GITHUB_REPOSITORY#*/}"
+          export COMMA_HOST_SYSROOT_DIR="/mnt/Apparition/My_App_Data/starpilot-runner/sysroots/default"
+          export COMMA_HOST_CACHE_DIR="/mnt/Apparition/My_App_Data/starpilot-runner/cache/work"
+          export COMMA_HOST_VENV_DIR="/mnt/Apparition/My_App_Data/starpilot-runner/cache/venv-linux-arm64"
+          export COMMA_SYSROOT_DIR="/runner/sysroots/default"
+
+          if [[ -n "${{ inputs.jobs }}" ]]; then
+            ./build "${{ inputs.jobs }}"
+          else
+            ./build
+          fi
+
+      - name: Commit build output
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "$(git status --porcelain --untracked-files=no)" ]]; then
+            echo "No build output changes detected."
+            exit 0
+          fi
+
+          git add -u
+          git commit -m "build"
+
+      - name: Push build commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          git push origin "HEAD:refs/heads/${BUILD_BRANCH}"

.github/workflows/publish_truenas_runner.yaml

@@ -0,0 +1,35 @@
+name: Publish TrueNAS Runner Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: "Container tag to publish to GHCR"
+        type: string
+        default: "latest"
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push runner image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: tools/truenas_github_runner/Dockerfile
+          push: true
+          tags: ghcr.io/${{ github.repository_owner }}/starpilot-truenas-runner:${{ inputs.image_tag }}

.github/workflows/setup-with-retry/action.yaml

@@ -0,0 +1,52 @@
+name: 'openpilot env setup, with retry on failure'
+
+inputs:
+  docker_hub_pat:
+    description: 'Auth token for Docker Hub, required for BuildJet jobs'
+    required: false
+    default: ''
+  sleep_time:
+    description: 'Time to sleep between retries'
+    required: false
+    default: 30
+
+outputs:
+  duration:
+    description: 'Duration of the setup process in seconds'
+    value: ${{ steps.get_duration.outputs.duration }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: start_time
+      shell: bash
+      run: echo "START_TIME=$(date +%s)" >> $GITHUB_ENV
+    - id: setup1
+      uses: ./.github/workflows/setup
+      continue-on-error: true
+      with:
+        is_retried: true
+    - if: steps.setup1.outcome == 'failure'
+      shell: bash
+      run: sleep ${{ inputs.sleep_time }}
+    - id: setup2
+      if: steps.setup1.outcome == 'failure'
+      uses: ./.github/workflows/setup
+      continue-on-error: true
+      with:
+        is_retried: true
+    - if: steps.setup2.outcome == 'failure'
+      shell: bash
+      run: sleep ${{ inputs.sleep_time }}
+    - id: setup3
+      if: steps.setup2.outcome == 'failure'
+      uses: ./.github/workflows/setup
+      with:
+        is_retried: true
+    - id: get_duration
+      shell: bash
+      run: |
+        END_TIME=$(date +%s)
+        DURATION=$((END_TIME - START_TIME))
+        echo "Total duration: $DURATION seconds"
+        echo "duration=$DURATION" >> $GITHUB_OUTPUT

.github/workflows/setup/action.yaml

@@ -0,0 +1,56 @@
+name: 'openpilot env setup'
+
+inputs:
+  is_retried:
+    description: 'A mock param that asserts that we use the setup-with-retry instead of this action directly'
+    required: false
+    default: 'false'
+
+runs:
+  using: "composite"
+  steps:
+    # assert that this action is retried using the setup-with-retry
+    - shell: bash
+      if: ${{ inputs.is_retried == 'false' }}
+      run: |
+        echo "You should not run this action directly. Use setup-with-retry instead"
+        exit 1
+
+    - shell: bash
+      name: No retries!
+      run: |
+        if [ "${{ github.run_attempt }}" -gt 1 ]; then
+          echo -e "\033[0;31m##################################################"
+          echo -e "\033[0;31m    Retries not allowed! Fix the flaky test!      "
+          echo -e "\033[0;31m##################################################\033[0m"
+          exit 1
+        fi
+
+    # do this after checkout to ensure our custom LFS config is used to pull from GitLab
+    - shell: bash
+      run: git lfs pull
+
+    # build cache
+    - id: date
+      shell: bash
+      run: echo "CACHE_COMMIT_DATE=$(git log -1 --pretty='format:%cd' --date=format:'%Y-%m-%d-%H:%M')" >> $GITHUB_ENV
+    - shell: bash
+      run: echo "$CACHE_COMMIT_DATE"
+    - id: scons-cache
+      uses: ./.github/workflows/auto-cache
+      with:
+        path: .ci_cache/scons_cache
+        key: scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}-${{ github.sha }}
+        restore-keys: |
+          scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}
+          scons-${{ runner.arch }}
+    # as suggested here: https://github.com/moby/moby/issues/32816#issuecomment-910030001
+    - id: normalize-file-permissions
+      shell: bash
+      name: Normalize file permissions to ensure a consistent docker build cache
+      run: |
+        find . -type f -executable -not -perm 755 -exec chmod 755 {} \;
+        find . -type f -not -executable -not -perm 644 -exec chmod 644 {} \;
+    # build our docker image
+    - shell: bash
+      run: eval ${{ env.BUILD }}