ci(cache): prune to an 8 GB budget, and after brain-ci and CI

[gHashTag]

Refs #844. Follows #853.

What happened

#853's prune keeps the newest entry of every series on every live ref. Measured on 2026-10-05:

kept by #853's rules at its 01:13Z run	130 entries, 7.97 GB
repository cache at 03:54Z	165 entries, 11.11 GB
setup-zig's share of a 162-entry list taken after 03:45Z	96.7% (10.48 of 10.84 GB)
brain-ci's seven Zig jobs / CI's test job	8.59 GB / 1.85 GB of 10.84 GB
scheduled prune runs between merge (18:41Z) and 03:46Z	2 of 9 hourly slots
oldest last read in the cache	2026-10-04 22:42Z, about 5 h old

Past 10 GB GitHub evicts whatever was read least recently, fixed keys included. The chipdb saved on fix/ci-chipdb-cache on 2026-10-04 was gone by the morning, and the LED one-hot run on #852 (37260180318) rebuilt it: Cache not found, chipdb step 2 m 54 s, then saved again.

Change

1. Budget (cache-prune.js). After the existing rules, while the kept entries are over BUDGET_BYTES (8e9), drop setup-zig's per-run entries on refs other than main, least recently read first (last_accessed_at, falling back to created_at). Nothing else is ever dropped for the budget: no fixed key, nothing on main, and no chipdb, including one whose key ends in a run id (fix/trinet-node-core-reads saves chipdb-…-regymm-<run id>, which the run-id pattern alone would have treated as per-run).
   Why Zig entries and not the chipdb: a chipdb hit saves about 3 min (2 m 54 s above); a Zig cache hit saved 29.5 s on Health Check (17.5 s warm vs 47.0 s cold, ci(brain): check out before setup-zig so the Zig cache survives #890) and 1.7 s net on CI's Build & Test.
2. Trigger (actions-cache-prune.yml). Also run on workflow_run when brain-ci or CI completes, so the prune follows the two workflows that save the most rather than an hourly slot that fired 2 times in 9. The existing concurrency group (cancel-in-progress: false) keeps one run going and at most one pending.

The rules are tested on this pull request by actions-cache-prune-test.yml from #853.

Controls

• node --test: 22 of 22 (8 new).
• Mutants of the budget rule: 13 of 13 killed. They cover the budget pass removed, run not passing the budget, main unprotected, fixed keys unprotected, any per-run key spendable, most-recent-first order, created_at instead of the last read, dropped entries left in keep, bytes not decremented, < instead of <=, and a 10 GB or Infinity default.
• Dry run on the 162-entry list of 2026-10-05 (no pull request closed, no branch gone): drop 43 (3.06 GB), of which 10 (0.72 GB) for the budget (pull/884 5, pull/886 3, fix/codegen-corpus-sample 2). Keep 119 (7.78 GB), including all 5 chipdb entries and all 9 on main.
• speed prepush (run-syntax and workflow-path gates): ok.
• Correction: an earlier push of this branch also added a cache-prune-test.yml. It duplicated ci(cache): prune Actions cache entries nothing can restore #853's actions-cache-prune-test.yml, so I removed it with a force-push. The branch is one commit.

Not measured

• workflow_run only fires for a workflow file on the default branch, so the new trigger cannot run before merge. The first evidence will be prune runs whose event is workflow_run.
• Whether 2 GB of headroom holds between prunes. A brain-ci run saves 8 Zig entries (about 0.5 GB); a burst of pushes could still cross 10 GB before the next prune finishes.
• API calls per run are estimated, not counted: 2 list pages, one lookup per pull request and per branch in the cache (8 + 8 on the list above), plus the deletes.
• Pending prune runs replaced by the concurrency group will show as cancelled. I have not counted how many that would be.
• The budget applies to every ref, including other people's branches. Which branches' Zig caches may be spent is a policy choice for the owner.
• A related cause is not touched here. brain-ci runs twice for each commit on a fix/* branch with an open PR (push and pull_request): 45 of 146 commits between 2026-10-02 and 2026-10-05, about 0.5 GB of extra Zig entries each time. That is ci: each workflow once per PR commit, and no PR blind to a push path (S37) #875's DOUBLE_GLOB and remains the owner's call.

🤖 Generated with Claude Code

[github-actions]

X Brain Health Check

Score: 100.0/100
Status: 🟢 HEALTHY
Threshold: 80/100

X Brain is above merge threshold

[github-actions]

🧪 Brain Stress Test Results

Score: not measured (no stress test prints a Score: line)
Status: 🟢 PASS
Threshold: 270/300

X Stress test passed

[tri-claw]

Summary by t27-bees

This PR adds an 8 GB budget to the cache pruner and triggers it after the two heaviest workflows (brain-ci and CI) complete. The budget drops only setup-zig per-run entries on non-main refs, least-recently-read first, while protecting fixed keys, main, and all chipdb entries.

Worth a look

• .github/workflows/actions-cache-prune.yml:17–18 — The workflow_run trigger uses exact workflow names ('S³AI Brain CI — "Functional MRI" Gate' and CI). If either workflow is renamed, the trigger stops firing silently.
• .github/scripts/cache-prune.js:99–112 — The budget loop subtracts only spendable entries' sizes from kept (which starts as total kept bytes). If non-spendable entries alone exceed 8 GB, all spendable entries are dropped and the cache remains over budget. The description acknowledges this headroom concern.
• .github/scripts/cache-prune.js:101 — Spendable filter requires c.key.startsWith(ZIG_CACHE) ('setup-zig-cache-'). A chipdb key that somehow started with that prefix would become spendable; current naming makes this unlikely.
• .github/scripts/cache-prune.js:102 — Sort tiebreaker uses a.id - b.id (lower id = older). When last_accessed_at is equal, older entries are dropped first. Reasonable, but depends on GitHub's monotonically increasing cache IDs.
• .github/scripts/cache-prune.test.js:138–147 — The default-budget test assumes the PR entry (refs/pull/852/merge) is spendable and the main entry is not. If the ref detection logic (c.ref !== 'refs/heads/main') ever misclassifies a ref, the budget behavior would change.

---

_{Read: 3 files, +143 -11, the whole diff. Head 6ab73d0. Model: openai-compatible/nvidia/nemotron-3-ultra-550b-a55b. Commands: @t27-bees review | summary | help | pause | resume. Free for every repository.}