ci: prune actions cache bloat and guard PR cache writes

[mfethe1]

Summary

Actions cache storage had grown to 1,417 entries / 13.28 GB (13.16 GB of it scoped to product/main), risking GitHub's ~10 GB per-repo cache quota forcing blind eviction. Root causes: per-push exact-key saves (rust caches, sccache shards, relay artifacts) accumulate superseded versions that are never deleted, and two cache saves ran on PR events too.

Changes

• scripts/prune_actions_caches.py (new): groups entries by (ref, normalized-key) — hashes/date suffixes stripped — keeps the most recently accessed entry per group, deletes duplicates and anything unused for 7 days. --dry-run mode, exit 1 on delete failures.
• .github/workflows/cache-prune.yml (new): runs the prune daily (cron 23 4 * * *) plus manual dispatch with a dry_run input; actions: write only, no checkout credentials persisted; reports remaining entry count afterwards.
• .github/workflows/_ci-clients.yml: hermit + pub cache save steps now also require github.event_name != 'pull_request' (restore unaffected). These were the last two unguarded saves; every other save path was already push-gated or cache-hit-gated.

Evidence

• Local dry-run: would delete 161 entries freeing 4.13 GB, 0 failures.
• One-time prune executed pre-PR: 161 deleted, 1417 → 1256 entries (verified via GET /actions/caches total_count).
• YAML validated for all touched workflows (actionlint: only pre-existing shellcheck notes in untouched files).

Notes

• The split restore/save pattern was already fully in place on product/main; this PR adds the missing eviction policy and the last PR guards.
• Rejected: adding save-if to release.yml's rust-cache (tag-triggered, never a PR — no-op at best, harmful churn if triggered otherwise).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 15609511-b934-455c-8548-f1040a6009fb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mfethe1]

🧪 Jev PR-Triage Pilot

PR #65: ci: prune actions cache bloat and guard PR cache writes — verdict: REVIEW

question	answer	confidence
sensitive_path	P(yes)=0.28	—
test_coverage	P(yes)=0.12	—
size_concern	P(yes)=0.30	—
risk	0.75/2	0.60
route	needs_review	0.63
block_reason	none	0.80

Block reason (if any): none
Pilot: Jev (System One) typed triage. Verdict thresholds in code; escalate on low confidence.

[mfethe1]

🧪 Jev PR-Triage (v3)

PR #65: ci: prune actions cache bloat and guard PR cache writes — verdict: REVIEW

dimension	metric	value
Correctness	problem resolved	P(yes)=0.76
Correctness	rework needed	0.31/2
Quality	code quality	1.93/2
Quality	test coverage	P(yes)=0.08
Architecture	integration compatibility	1.91/2
Architecture	future proof	1.63/2
Governance	sensitive path	P(yes)=0.93
Governance	size concern	P(yes)=0.38
Synthesis	merge risk	0.65/2
Synthesis	route	needs_review (0.66)
Diff	security exposure	P(yes)=0.18
Diff	performance impact	0.51/2

🔍 Reviewer focus

• File: scripts/prune_actions_caches.py
• Concern: correctness_edge_cases

Block reason (if any): none
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

[mfethe1]

🧪 Jev PR-Triage (v3) — ADVISORY, NON-GATING

PR #65: ci: prune actions cache bloat and guard PR cache writes — verdict: REVIEW

This verdict does not gate this PR and no human review requirement is waived or added by it. Jev is uncalibrated: the ground-truth corpus is 7 resolved PRs (1 bad), below the threshold to publish any AUC, so a BLOCK here carries no demonstrated predictive value. It is a reading suggestion — start at the focus file — not a judgment.

dimension	metric	value
Correctness	problem resolved	P(yes)=0.78
Correctness	rework needed	0.26/2
Quality	code quality †	1.05/2
Quality	test coverage	P(yes)=0.09
Architecture	integration compatibility †	1.01/2
Architecture	future proof †	1.50/2
Governance	sensitive path	P(yes)=0.94
Governance	size concern	P(yes)=0.37
Synthesis	merge risk	0.64/2
Synthesis	route	needs_review (0.66)
Diff	security exposure	P(yes)=0.18
Diff	performance impact	0.53/2

🔍 Reviewer focus

• File: scripts/prune_actions_caches.py
• Concern: correctness_edge_cases

Block reason (if any): none
† PROBATIONAL — measured as an anti-signal on the (contaminated) pilot corpus; excluded from the verdict, shown for audit only.
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.