[nrf52] Run clang-tidy against the native sdk-nrf toolchain (#17364)

.github/actions/cache-sdk-nrf/action.yml

@@ -0,0 +1,49 @@
+name: Cache sdk-nrf
+description: >
+  Resolve the pinned sdk-nrf version and cache the native sdk-nrf install
+  (west workspace, Zephyr SDK toolchain, python env) at ~/.esphome-sdk-nrf.
+  Every job that installs sdk-nrf natively (the nrf52 clang-tidy job and,
+  once the component tests build natively, their batches) shares one cache.
+  Callers must set env ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf and have
+  the Python venv already restored.
+inputs:
+  restore-only:
+    description: >
+      When "true", only restore -- never save the cache, even on dev. Use from
+      jobs that may not produce a complete install (e.g. a component batch
+      that fails mid-install), so a partial install is never written.
+    default: "false"
+runs:
+  using: composite
+  steps:
+    - name: Resolve sdk-nrf and toolchain versions for cache key
+      # Both versions are pinned in code, not in any file that feeds the
+      # other cache keys, so resolve them explicitly. Keying on them means
+      # the cache invalidates when either is bumped (actions/cache never
+      # overwrites a key).
+      id: version
+      shell: bash
+      run: |
+        . venv/bin/activate
+        version=$(python -c '
+        from esphome.components.nrf52 import RECOMMENDED_SDK_NRF_VERSION
+        from esphome.components.nrf52.framework import TOOLCHAIN_VERSION
+        print(f"{RECOMMENDED_SDK_NRF_VERSION}-{TOOLCHAIN_VERSION}")')
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+    # Mirror cache-esp-idf: only dev-branch runs write the shared cache (so it
+    # lives in the default-branch scope readable by all PRs); PRs are
+    # restore-only and never push multi-GB artifacts into their own scope.
+    - name: Cache sdk-nrf install (write on dev)
+      if: github.ref == 'refs/heads/dev' && inputs.restore-only != 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.esphome-sdk-nrf
+        # yamllint disable-line rule:line-length
+        key: ${{ runner.os }}-esphome-sdk-nrf-${{ steps.version.outputs.version }}-${{ hashFiles('esphome/components/nrf52/requirements.txt') }}
+    - name: Cache sdk-nrf install (restore-only off dev)
+      if: github.ref != 'refs/heads/dev' || inputs.restore-only == 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.esphome-sdk-nrf
+        # yamllint disable-line rule:line-length
+        key: ${{ runner.os }}-esphome-sdk-nrf-${{ steps.version.outputs.version }}-${{ hashFiles('esphome/components/nrf52/requirements.txt') }}

.github/workflows/ci.yml

@@ -475,6 +475,8 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       # esp32-arduino-tidy installs ESP-IDF natively; share the native IDF cache.
       ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
+      # nrf52-tidy installs sdk-nrf natively; pin it to a cacheable path.
+      ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf
     strategy:
       fail-fast: false
       max-parallel: 2
@@ -491,7 +493,7 @@ jobs:
           - id: clang-tidy
             name: Run script/clang-tidy for ZEPHYR
             options: --environment nrf52-tidy --grep USE_ZEPHYR --grep USE_NRF52
-            pio_cache_key: tidy-zephyr
+            cache_sdk_nrf: true
             ignore_errors: false
 
     steps:
@@ -527,6 +529,10 @@ jobs:
         with:
           framework: arduino
 
+      - name: Cache sdk-nrf install
+        if: matrix.cache_sdk_nrf
+        uses: ./.github/actions/cache-sdk-nrf
+
       - name: Register problem matchers
         run: |
           echo "::add-matcher::.github/workflows/matchers/gcc.json"
@@ -805,6 +811,9 @@ jobs:
       # esp32 component builds use the native ESP-IDF toolchain (default), so
       # share the tidy jobs' install location -- the restore below lands here.
       ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
+      # nrf52 component builds install sdk-nrf natively; pin it to the shared
+      # cacheable path so the restore below lands where the build looks.
+      ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf
     strategy:
       fail-fast: false
       max-parallel: ${{ (startsWith(github.base_ref, 'beta') || startsWith(github.base_ref, 'release')) && 8 || 4 }}
@@ -840,6 +849,14 @@ jobs:
         uses: ./.github/actions/cache-esp-idf
         with:
           restore-only: true
+      - name: Cache sdk-nrf install (restore-only)
+        # Only batches whose test platforms include nrf52 need the native
+        # sdk-nrf install; never save -- just reuse the shared install the
+        # dev nrf52 tidy job cached when present.
+        if: matrix.batch.needs_nrf
+        uses: ./.github/actions/cache-sdk-nrf
+        with:
+          restore-only: true
       - name: Validate and compile components with intelligent grouping
         run: |
           . venv/bin/activate