Enable reachable Gitea npm cache

.gitea/workflows/cms-content-validation.yml

@@ -20,6 +20,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Verify Decap configuration and content boundaries

.gitea/workflows/deploy-blog.yml

@@ -33,6 +33,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site

.gitea/workflows/deploy.yml

@@ -33,6 +33,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build selected site

.gitea/workflows/production-blog.yml

@@ -34,6 +34,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production blog

.gitea/workflows/production-candidate.yml

@@ -34,6 +34,8 @@ jobs:
         uses: https://github.com/actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
       - name: Install locked dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
       - name: Validate and build production site

docs/decap-cms-pilot.md

@@ -81,14 +81,12 @@ the pilot:
 - The existing branch preview workflows remain in place. Local output checks
   now prove preview robots rules and page metadata stay no-index and that the
   admin response has a no-index header rule.
-- Validation, preview, and production workflows use clean `npm ci` installs with
-  `--prefer-offline --no-audit --no-fund`. Do not enable `setup-node`'s npm cache
-  until the Actions runner cache service is reachable from job containers. The
-  September 4 pilot test timed out against the runner's auto-detected private
-  address during both cache restore and cleanup. Give `act_runner` a fixed
-  `cache.host` and `cache.port` reachable from its job containers, publish that
-  port (or attach runner and jobs to a shared network), restart the runner, and
-  then restore the lockfile-keyed `cache: npm` configuration.
+- Validation, preview, and production workflows cache npm's download store by
+  `package-lock.json` while retaining clean `npm ci` installs with
+  `--prefer-offline --no-audit --no-fund`. The runner advertises its cache on a
+  fixed host and port reachable from job containers, avoiding the timeout caused
+  by its former auto-detected private address. Warm jobs reuse dependency
+  tarballs without caching `node_modules`.
 
 The pilot dependencies are active: the public client ID, exact-origin CORS
 policy, `cms-pilot` branch, and both protection rules have been verified.

scripts/verify-decap.mjs

@@ -227,6 +227,7 @@ for (const path of [
   '.gitea/workflows/production-blog.yml',
 ]) {
   const text = await readFile(path, 'utf8');
+  assert(/cache:\s*npm/.test(text) && /cache-dependency-path:\s*package-lock\.json/.test(text), `${path} must cache npm downloads by package-lock.json.`);
   assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install with quiet, cache-friendly npm options.`);
 }