workflows: centralize and optimize setup-bazel configuration (#4227)

GitHub Actions workflows previously invoked `bazel-contrib/setup-bazel`
without caching or build optimizations, causing each run to download
Bazel, Python toolchains, PyPI wheels, and the pyrefly type checker
from scratch.

Extract a shared composite action that configures `setup-bazel` with
bazelisk, disk, and lockfile-aware repository caches. Disable the
default `pyrefly` output group and select the `install_only_stripped`
Python distribution to avoid unnecessary toolchain downloads and
type-checking overhead during operational workflow runs.
diff --git a/.github/actions/setup-bazel/action.yaml b/.github/actions/setup-bazel/action.yaml
new file mode 100644
index 0000000..5a6ed46
--- /dev/null
+++ b/.github/actions/setup-bazel/action.yaml
@@ -0,0 +1,26 @@
+name: "Setup Bazel"
+description: "Configure Bazel with caching for GitHub Actions workflows"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Setup Bazel
+      uses: bazel-contrib/setup-bazel@0.19.0
+      with:
+        bazelisk-cache: true
+        disk-cache: true
+        # Files hashed to compute the repository cache key. If only `true` is
+        # passed, only MODULE.bazel/WORKSPACE* are hashed, so lockfile-only
+        # updates would get a cache hit on the old key and skip saving newly
+        # downloaded wheels.
+        repository-cache: |
+          - MODULE.bazel
+          - dev/requirements.txt
+          - dev/uv.lock
+          - tools/publish/requirements_linux.txt
+        bazelrc: |
+          # .bazelrc enables --config=pyrefly by default; disable the pyrefly
+          # output group here so operational workflows don't download the
+          # pyrefly toolchain or type-check targets before running them.
+          build --output_groups=-pyrefly
+          build --//python/config_settings:py_pbs_distribution=install_only_stripped
diff --git a/.github/workflows/backport_create_releases.yaml b/.github/workflows/backport_create_releases.yaml
index 1597543..d676625 100644
--- a/.github/workflows/backport_create_releases.yaml
+++ b/.github/workflows/backport_create_releases.yaml
@@ -29,9 +29,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/backport_prepare.yaml b/.github/workflows/backport_prepare.yaml
index 3db53f6..d94f3bf 100644
--- a/.github/workflows/backport_prepare.yaml
+++ b/.github/workflows/backport_prepare.yaml
@@ -41,9 +41,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/on_pr_closed.yaml b/.github/workflows/on_pr_closed.yaml
index 764bfef..f6f4b2b 100644
--- a/.github/workflows/on_pr_closed.yaml
+++ b/.github/workflows/on_pr_closed.yaml
@@ -49,9 +49,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/publish_pypi.yaml b/.github/workflows/publish_pypi.yaml
index 44f0a1d..3450093 100644
--- a/.github/workflows/publish_pypi.yaml
+++ b/.github/workflows/publish_pypi.yaml
@@ -23,6 +23,8 @@
         uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag_name || github.ref_name }}
+      - name: Setup Bazel
+        uses: ./.github/actions/setup-bazel
       - env:
           # This special value tells pypi that the user identity is supplied within the token
           TWINE_USERNAME: __token__
diff --git a/.github/workflows/release_add_backports.yaml b/.github/workflows/release_add_backports.yaml
index 60d5593..b20fd95 100644
--- a/.github/workflows/release_add_backports.yaml
+++ b/.github/workflows/release_add_backports.yaml
@@ -35,9 +35,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Add Backports to Tracking Issue
         env:
diff --git a/.github/workflows/release_complete_prepare.yaml b/.github/workflows/release_complete_prepare.yaml
index 5664f68..ccfa98d 100644
--- a/.github/workflows/release_complete_prepare.yaml
+++ b/.github/workflows/release_complete_prepare.yaml
@@ -47,9 +47,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Mark Prepare Release Complete
         id: complete_prepare
diff --git a/.github/workflows/release_create_rc.yaml b/.github/workflows/release_create_rc.yaml
index e7857f6..1c6f917 100644
--- a/.github/workflows/release_create_rc.yaml
+++ b/.github/workflows/release_create_rc.yaml
@@ -38,9 +38,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_create_release_branch.yaml b/.github/workflows/release_create_release_branch.yaml
index ce6c9c1..dac263e 100644
--- a/.github/workflows/release_create_release_branch.yaml
+++ b/.github/workflows/release_create_release_branch.yaml
@@ -28,9 +28,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_prepare.yaml b/.github/workflows/release_prepare.yaml
index 544826b..c714243 100644
--- a/.github/workflows/release_prepare.yaml
+++ b/.github/workflows/release_prepare.yaml
@@ -29,9 +29,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_process_backports.yaml b/.github/workflows/release_process_backports.yaml
index 16b559a..483bffd 100644
--- a/.github/workflows/release_process_backports.yaml
+++ b/.github/workflows/release_process_backports.yaml
@@ -46,9 +46,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_promote.yaml b/.github/workflows/release_promote.yaml
index 07337e7..79b5095 100644
--- a/.github/workflows/release_promote.yaml
+++ b/.github/workflows/release_promote.yaml
@@ -34,9 +34,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_sync_changelog.yaml b/.github/workflows/release_sync_changelog.yaml
index 52ced65..1389d3d 100644
--- a/.github/workflows/release_sync_changelog.yaml
+++ b/.github/workflows/release_sync_changelog.yaml
@@ -29,9 +29,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |
diff --git a/.github/workflows/release_sync_changelog_complete.yaml b/.github/workflows/release_sync_changelog_complete.yaml
index 889d6c4..70049ea 100644
--- a/.github/workflows/release_sync_changelog_complete.yaml
+++ b/.github/workflows/release_sync_changelog_complete.yaml
@@ -29,9 +29,7 @@
           fetch-depth: 0
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          bazelisk-version: 1.20.0
+        uses: ./.github/actions/setup-bazel
 
       - name: Configure Git Identity
         run: |