[AlexanderLanin]

Policy application repeatedly downloads Bazel and repository dependencies because
follow-up commands and pre-commit hooks run with fresh temporary home directories.
Reuse those downloads while retaining the isolated command environment.

Before apply, one job warms a shared repository download cache and Bazelisk cache
using reference_integration. The cache action uses that repository's lockfile for
its normal reset and save decisions. The existing apply job restores the caches
without saving its additions, so dependencies from every target do not accumulate
in the persisted cache. A failed warm-up remains visible but does not prevent
apply from using an older cache or downloading missing dependencies itself.

Import the selected cache configuration into each temporary home, including for
Bazel 8, and keep each repository's unpacked dependencies available across policies
and hook retries within the apply job. The workflow chooses its reference
repository; no new tool configuration setting is needed. Regression coverage
checks that follow-up commands and hooks share the selected cache settings while
filtering personal Bazel settings and token environment variables. Pre-commit
hooks still receive global Git URL rewrites for authenticated dependency downloads;
those URLs can contain credentials.

Change trigger: the policy apply job takes over an hour and therefore longer than the max app token lifetime

[Copilot]

🟡 Changes recommended

The README overstates hook credential isolation because global Git URL rewrites, including token-bearing URLs, are still copied into the temporary home.

1 open issue

• Clarify that pre-commit hooks inherit Git URL rewrite credentials · New

What changed in this PR

This PR reduces repeated Bazel downloads during policy application while preserving temporary command homes and selectively sharing cache configuration.

Changes:

• Adds a reference-repository cache warm-up job and restore-only caching for apply.
• Shares selected Bazel and Bazelisk cache settings with follow-up commands and pre-commit hooks.
• Documents cache behavior and adds regression coverage for cache sharing and environment isolation.

File	Description
repo_policy_sync/​tests/​test_cache.py	Tests cache sharing, environment filtering, and temporary-home cleanup.
repo_policy_sync/​src/​github.py	Configures shared caches for pre-commit hooks.
repo_policy_sync/​src/​engine.py	Configures shared caches for follow-up commands.
repo_policy_sync/​src/​cache.py	Adds selective cache configuration for temporary homes.
repo_policy_sync/​README.md	Documents cache setup, persistence, and warm-up failure behavior.
.github/​workflows/​repo-policy-sync.yml	Adds cache warm-up and restore steps with job-local dependency reuse.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block approval of the cache-sharing changes.

No open issues 🎉

1 resolved since last review

• Clarify that pre-commit hooks inherit Git URL rewrite credentials

_{Review effort: Balanced}