fix: image publishes write the Docker cache only on a default-branch push

.github/workflows/container-publish.yml

@@ -114,7 +114,9 @@ jobs:
           labels: |
             ${{ steps.software.outputs.version != '' && format('org.opencontainers.image.version={0}', steps.software.outputs.version) || '' }}
           cache-from: type=gha,scope=${{ inputs.image-name }}
-          cache-to: type=gha,mode=max,scope=${{ inputs.image-name }}
+          # Only a default-branch push writes the cache: a tag's or pull request's cache can be
+          # restored by no later run, so it would only fill the repository's 10 GB.
+          cache-to: ${{ (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) && format('type=gha,mode=max,scope={0}', inputs.image-name) || '' }}
           secrets: |
             github_token=${{ secrets.packages-token || github.token }}
             github_actor=${{ github.actor }}

.github/workflows/crac-train.yml

@@ -207,7 +207,9 @@ jobs:
           load: true
           tags: ${{ matrix.service }}-crac-train:local
           cache-from: type=gha,scope=${{ matrix.service }}-crac-train
-          cache-to: type=gha,mode=max,scope=${{ matrix.service }}-crac-train
+          # Only a default-branch push writes the cache: a tag's or pull request's cache can be
+          # restored by no later run, so it would only fill the repository's 10 GB.
+          cache-to: ${{ (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) && format('type=gha,mode=max,scope={0}', format('{0}-crac-train', matrix.service)) || '' }}
           secrets: |
             github_token=${{ secrets.packages-token || secrets.GITHUB_TOKEN }}
             github_actor=${{ github.actor }}

tests/test_caches_save_only_on_default_branch.py

@@ -65,6 +65,20 @@ def test_cache_to_is_empty_off_a_default_branch_push(self):
         self.assertIn("type=gha", step["with"]["cache-from"])
 
 
+class ImagePublishWritesItsCacheOnlyOnADefaultBranchPush(unittest.TestCase):
+    # A tag-triggered publish runs on the tag's ref, which no later run can restore from, so a
+    # cache it writes only fills the repository.
+    def test_container_publish_writes_the_cache_only_on_a_default_branch_push(self):
+        (step,) = steps_using(load(".github/workflows/container-publish.yml"), "docker/build-push-action")
+        self.assertIn(ON_DEFAULT_BRANCH_PUSH, step["with"]["cache-to"])
+        self.assertIn("type=gha", step["with"]["cache-from"])
+
+    def test_crac_training_writes_the_cache_only_on_a_default_branch_push(self):
+        (step,) = steps_using(load(".github/workflows/crac-train.yml"), "docker/build-push-action")
+        self.assertIn(ON_DEFAULT_BRANCH_PUSH, step["with"]["cache-to"])
+        self.assertIn("type=gha", step["with"]["cache-from"])
+
+
 class MutationReportNeverSavesAMiseCache(unittest.TestCase):
     def test_mise_runs_with_cache_save_off(self):
         (step,) = steps_using(load(".github/workflows/mutation-report.yml"), "jdx/mise-action")