[ExtraToast]

Why

Each repository holds 10 GB of Actions cache, and GitHub evicts the least recently used past that. A pull request can restore only its own caches or the default branch's. When every pull request saves its own, the default branch's get evicted and later pull requests start cold.

On 2026-10-21 the estate held 944 pull-request caches, about 61 GB, and several repositories sat at their 10 GB limit. Those caches were deleted by hand; without this change they come back within days. identity#150 fixed the same thing for identity's own workflow, and its first run afterwards restored main's cache and saved none of its own.

What

where	before	after
actions/setup-java-gradle	gradle-cache-read-only defaulted to 'false', overriding setup-gradle's own default, so every pull request wrote Gradle caches	empty by default, which means read-only unless this is a push to the default branch. An explicit value still wins
actions/setup-node	setup-node cached on every run	only a default-branch push enables setup-node's cache. Other runs locate the package-manager cache and restore the default branch's latest node-cache-<os>-<arch>-<pm>- entry with actions/cache/restore, saving nothing
docker-image-ci.yml	cache-to: type=gha on every build	cache-to is empty unless this is a default-branch push. cache-from is unchanged
mutation-report.yml	mise saved a cache from every pull request	cache_save: false. The workflow runs only on pull requests

The inputs used exist in the pinned versions: mise-action v5.2.0 cache_save, setup-node v6 package-manager-cache, setup-gradle v6 cache-read-only.

Tests

tests/test_caches_save_only_on_default_branch.py holds the rule per producer, 6 tests. They failed before the change: 4 failures, 2 errors. The full suite passes, 250 tests, and actionlint passes.

Rollout

Consumers pin this repository by tag, so the change reaches them through the release this PR cuts and the Renovate bump after it. Workflows that repositories carry themselves, such as grimoire's and estate-dashboard's mise caches, are not covered here.