Merge branch 'upstream/openpilot/master' into sync-20260225

# Conflicts:
#	.github/workflows/auto_pr_review.yaml
#	.github/workflows/badges.yaml
#	.github/workflows/mici_raylib_ui_preview.yaml
#	.github/workflows/prebuilt.yaml
#	.github/workflows/raylib_ui_preview.yaml
#	.github/workflows/release.yaml
#	.github/workflows/repo-maintenance.yaml
#	.github/workflows/tests.yaml
#	.gitignore
#	Dockerfile.openpilot_base
#	SConstruct
#	docs/CARS.md
#	opendbc_repo
#	panda
#	release/build_release.sh
#	selfdrive/modeld/SConscript
#	selfdrive/modeld/modeld.py
#	selfdrive/pandad/panda_safety.cc
#	selfdrive/pandad/pandad.cc
#	selfdrive/pandad/pandad.py
#	selfdrive/test/process_replay/process_replay.py
#	selfdrive/ui/layouts/onboarding.py
#	selfdrive/ui/mici/layouts/home.py
#	selfdrive/ui/tests/diff/replay.py
#	selfdrive/ui/tests/test_ui/raylib_screenshots.py
#	tools/mac_setup.sh
#	uv.lock

.github/workflows/setup/action.yaml

@@ -26,31 +26,31 @@ runs:
           exit 1
         fi
 
-    # do this after checkout to ensure our custom LFS config is used to pull from GitLab
-    - shell: bash
-      run: git lfs pull
-
     # build cache
     - id: date
       shell: bash
       run: echo "CACHE_COMMIT_DATE=$(git log -1 --pretty='format:%cd' --date=format:'%Y-%m-%d-%H:%M')" >> $GITHUB_ENV
-    - shell: bash
-      run: echo "$CACHE_COMMIT_DATE"
     - id: scons-cache
       uses: ./.github/workflows/auto-cache
       with:
-        path: .ci_cache/scons_cache
-        key: scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}-${{ github.sha }}
+        path: /tmp/scons_cache
+        key: scons-${{ runner.os }}-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}-${{ github.sha }}
         restore-keys: |
-          scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}
-          scons-${{ runner.arch }}
-    # as suggested here: https://github.com/moby/moby/issues/32816#issuecomment-910030001
-    - id: normalize-file-permissions
-      shell: bash
-      name: Normalize file permissions to ensure a consistent docker build cache
-      run: |
-        find . -type f -executable -not -perm 755 -exec chmod 755 {} \;
-        find . -type f -not -executable -not -perm 644 -exec chmod 644 {} \;
-    # build our docker image
+          scons-${{ runner.os }}-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}
+          scons-${{ runner.os }}-${{ runner.arch }}
+    # venv cache
+    - id: venv-cache
+      uses: ./.github/workflows/auto-cache
+      with:
+        path: ${{ github.workspace }}/.venv
+        key: venv-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('uv.lock') }}
+        restore-keys: |
+          venv-${{ runner.os }}-${{ runner.arch }}
     - shell: bash
-      run: eval ${{ env.BUILD }}
+      name: Run setup
+      run: ./tools/op.sh setup
+    - shell: bash
+      name: Setup cache dirs
+      run: |
+        mkdir -p /tmp/comma_download_cache
+        echo "$GITHUB_WORKSPACE/.venv/bin" >> $GITHUB_PATH