ci(cache): gate every cache save to main and guard it

.github/workflows/_build.yml

@@ -75,8 +75,9 @@ jobs:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
-      - name: Cache venv
-        uses: actions/cache@v4
+      - name: Restore venv
+        id: venv-cache
+        uses: actions/cache/restore@v4
         with:
           path: .venv
           key: venv-${{ inputs.runs-on }}-py3.11-${{ hashFiles('uv.lock') }}
@@ -92,12 +93,21 @@ jobs:
       - name: Rust build cache
         uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: ${{ inputs.runs-on }}-${{ inputs.build-mode || 'dev' }}
           cache-on-failure: true
 
       - name: Sync
         run: uv sync --frozen --group dev --no-install-project --python 3.11 -v
 
+      # #1216: save only on main; PR runs restore main's entry.
+      - name: Save venv
+        if: ${{ github.ref == 'refs/heads/main' && steps.venv-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: .venv
+          key: ${{ steps.venv-cache.outputs.cache-primary-key }}
+
       # #447: pull the ConPTY sidecar SHA manifest staged by the caller
       # workflow's `build-sidecars` job so its release-only manifest renders
       # the per-arch SHAs into the wheel. No-op when the input is empty (CI / local

.github/workflows/auto-release.yml

@@ -539,8 +539,12 @@ jobs:
           toolchain: "1.95.0"
           targets: ${{ matrix.target }}
 
+      # Save only on main pushes (#1216). A cache written on a tag ref is
+      # scoped to that tag and no later release can restore it, while tag and
+      # dispatch runs still restore main's entry for the same key.
       - uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: release-binaries-${{ matrix.target }}
 
       - uses: actions/setup-python@v5

.github/workflows/ci-all-features.yml

@@ -79,8 +79,9 @@ jobs:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
-      - name: Cache venv
-        uses: actions/cache@v4
+      - name: Restore venv
+        id: venv-cache
+        uses: actions/cache/restore@v4
         with:
           path: .venv
           key: venv-${{ matrix.os }}-py3.11-${{ hashFiles('uv.lock') }}
@@ -104,12 +105,21 @@ jobs:
       - name: Rust build cache
         uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: ${{ matrix.label }}-all-features
           cache-on-failure: true
 
       - name: Sync venv (frozen, no project install)
         run: uv sync --frozen --group dev --no-install-project --python 3.11
 
+      # #1216: save only on main; PR runs restore main's entry.
+      - name: Save venv
+        if: ${{ github.ref == 'refs/heads/main' && steps.venv-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: .venv
+          key: ${{ steps.venv-cache.outputs.cache-primary-key }}
+
       # `ci.test` imports `running_process` at runtime, so the dev wheel has
       # to be installed even though this lane asserts nothing about Python.
       - name: Dev wheel build

.github/workflows/ci-linux.yml

@@ -91,6 +91,7 @@ jobs:
       - name: Rust build cache
         uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: ubuntu-24.04-reproducible
           cache-on-failure: true
 

.github/workflows/ci-output-shutdown.yml

@@ -55,6 +55,7 @@ jobs:
           tool: nextest
       - uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: output-shutdown-${{ matrix.label }}
       - name: Validate evidence guard
         run: uv run --no-project --module unittest discover -s tests -p test_output_shutdown_native.py

.github/workflows/ci-preflight-rust.yml

@@ -74,7 +74,12 @@ jobs:
       - name: Rust build cache (shared across warm + sub-workers)
         uses: Swatinem/rust-cache@v2
         with:
-          key: ${{ inputs.label }}-shared
+          # shared-key (not key): rust-cache otherwise mixes the job id into
+          # the cache key, so warm/lint/unit-test each got a private entry and
+          # the sub-workers never actually restored warm's target/ (#1216).
+          # Only warm saves, and only on main; PR runs restore main's entry.
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+          shared-key: ${{ inputs.label }}-preflight-rust
           cache-on-failure: true
 
       - name: cargo build --target ${{ inputs.target }}
@@ -100,7 +105,9 @@ jobs:
       - name: Rust build cache (restore warm)
         uses: Swatinem/rust-cache@v2
         with:
-          key: ${{ inputs.label }}-shared
+          # Restore-only: warm-build owns this shared-key entry (#1216).
+          save-if: false
+          shared-key: ${{ inputs.label }}-preflight-rust
           cache-on-failure: true
       - name: cargo clippy --target ${{ inputs.target }}
         run: cargo clippy --workspace --exclude running-process-py --all-targets --features ${{ inputs.features }} --target ${{ inputs.target }} -- -D warnings
@@ -130,7 +137,9 @@ jobs:
       - name: Rust build cache (restore warm)
         uses: Swatinem/rust-cache@v2
         with:
-          key: ${{ inputs.label }}-shared
+          # Restore-only: warm-build owns this shared-key entry (#1216).
+          save-if: false
+          shared-key: ${{ inputs.label }}-preflight-rust
           cache-on-failure: true
       # musl binaries are statically linked and run on the host-arch
       # glibc runner without QEMU. If a downstream lane introduces a

.github/workflows/ci-preflight.yml

@@ -78,8 +78,9 @@ jobs:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
-      - name: Cache venv
-        uses: actions/cache@v4
+      - name: Restore venv
+        id: venv-cache
+        uses: actions/cache/restore@v4
         with:
           path: .venv
           key: venv-${{ inputs.os }}-py3.11-${{ hashFiles('uv.lock') }}
@@ -100,6 +101,7 @@ jobs:
       - name: Rust build cache
         uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           # Keep cache path discovery scoped to this checkout's workspace
           # target root.  rust-cache's automatic discovery can otherwise
           # register a nested `target/tests/target` path and fail its post-job
@@ -113,6 +115,14 @@ jobs:
       - name: Sync venv (frozen, no project install)
         run: uv sync --frozen --group dev --no-install-project --python 3.11
 
+      # #1216: save only on main; PR runs restore main's entry.
+      - name: Save venv
+        if: ${{ github.ref == 'refs/heads/main' && steps.venv-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: .venv
+          key: ${{ steps.venv-cache.outputs.cache-primary-key }}
+
       # THE build. Workspace + all targets + downstream features, debug
       # profile, exactly once. Everything below reuses this target/.
       - name: cargo build (workspace + all-targets, debug, --features client)
@@ -191,10 +201,10 @@ jobs:
           toolchain: "nightly-2026-04-16"
           components: llvm-tools-preview, rustc-dev
 
-      - name: Cache Dylint 6.0.1 tools
+      - name: Restore Dylint 6.0.1 tools
         if: ${{ inputs.dylint }}
         id: dylint-tools
-        uses: actions/cache@v4
+        uses: actions/cache/restore@v4
         with:
           path: |
             ~/.cargo/bin/cargo-dylint
@@ -207,9 +217,20 @@ jobs:
           CARGO_BIN: cargo
         run: rustup run 1.95.0 "$CARGO_BIN" install cargo-dylint@6.0.1 dylint-link@6.0.1 --locked --force
 
-      - name: Cache Dylint target
+      # #1216: save only on main; PR runs restore main's entry.
+      - name: Save Dylint 6.0.1 tools
+        if: ${{ inputs.dylint && github.ref == 'refs/heads/main' && steps.dylint-tools.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: |
+            ~/.cargo/bin/cargo-dylint
+            ~/.cargo/bin/dylint-link
+          key: ${{ steps.dylint-tools.outputs.cache-primary-key }}
+
+      - name: Restore Dylint target
         if: ${{ inputs.dylint }}
-        uses: actions/cache@v4
+        id: dylint-target
+        uses: actions/cache/restore@v4
         with:
           path: ${{ runner.temp }}/running-process-dylint-target
           key: dylint-target-v6-${{ runner.os }}-${{ runner.arch }}-6.0.1-nightly-2026-04-16-${{ hashFiles('lints/running-process-env-literal/Cargo.lock', 'lints/running-process-platform-boundary/Cargo.lock', 'Cargo.lock') }}
@@ -237,6 +258,14 @@ jobs:
         run: |
           rustup run nightly-2026-04-16 "$CARGO_BIN" dylint --path lints --pattern running-process-platform-boundary --workspace
 
+      # #1216: save only on main; PR runs restore main's entry.
+      - name: Save Dylint target
+        if: ${{ inputs.dylint && github.ref == 'refs/heads/main' && steps.dylint-target.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: ${{ runner.temp }}/running-process-dylint-target
+          key: ${{ steps.dylint-target.outputs.cache-primary-key }}
+
 
       - name: Terminal graphics capability matrix
         timeout-minutes: 10

.github/workflows/coverage.yml

@@ -51,8 +51,9 @@ jobs:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
-      - name: Cache venv
-        uses: actions/cache@v4
+      - name: Restore venv
+        id: venv-cache
+        uses: actions/cache/restore@v4
         with:
           path: .venv
           key: venv-ubuntu-24.04-py3.11-${{ hashFiles('uv.lock') }}
@@ -68,12 +69,21 @@ jobs:
       - name: Rust build cache
         uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: ubuntu-24.04-coverage
           cache-on-failure: true
 
       - name: Sync
         run: uv sync --frozen --group dev --no-install-project --python 3.11 -v
 
+      # #1216: save only on main; PR runs restore main's entry.
+      - name: Save venv
+        if: ${{ github.ref == 'refs/heads/main' && steps.venv-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: .venv
+          key: ${{ steps.venv-cache.outputs.cache-primary-key }}
+
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@cargo-llvm-cov
 

.github/workflows/independent-spawn.yml

@@ -51,6 +51,7 @@ jobs:
           toolchain: '1.95.0'
       - uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: independent-fixture-${{ matrix.target }}
       - name: Install build orchestrator
         run: uv tool install soldr
@@ -115,6 +116,8 @@ jobs:
         with:
           toolchain: '1.95.0'
       - uses: Swatinem/rust-cache@v2
+        with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       # The repository cargo_command wrapper uses Soldr when installed and
       # the established CI bootstrap otherwise, avoiding a circular toolchain.
       - name: Exercise Task Scheduler and native target control

.github/workflows/linux-x86-build.yml

@@ -57,6 +57,7 @@ jobs:
       - name: Rust build cache
         uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: ubuntu-24.04-reproducible
           cache-on-failure: true
 

.github/workflows/security-audit.yml

@@ -42,6 +42,7 @@ jobs:
       - name: Rust build cache
         uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           key: ubuntu-24.04-security-audit
           cache-on-failure: true
 

.github/workflows/security-fuzz.yml

@@ -76,12 +76,14 @@ jobs:
       - name: Rust build cache
         uses: Swatinem/rust-cache@v2
         with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
           workspaces: crates/running-process/fuzz -> target
           key: ubuntu-latest-security-fuzz
           cache-on-failure: true
 
       - name: Restore fuzz corpus
-        uses: actions/cache@v4
+        id: fuzz-corpus
+        uses: actions/cache/restore@v4
         with:
           path: crates/running-process/fuzz/corpus/${{ matrix.target }}
           key: fuzz-corpus-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('Cargo.lock', 'crates/running-process/fuzz/Cargo.toml', 'crates/running-process/fuzz/Cargo.lock') }}
@@ -133,6 +135,15 @@ jobs:
           # anything this workflow states.
           cargo +nightly fuzz run             --target x86_64-unknown-linux-gnu             "${{ matrix.target }}"             -- -max_total_time="${FUZZ_SECONDS}" -timeout=30
 
+      # #1216: grow the corpus only from main (scheduled) runs; PR runs
+      # restore main's corpus but never write a PR-scoped entry.
+      - name: Save fuzz corpus
+        if: ${{ github.ref == 'refs/heads/main' && steps.fuzz-corpus.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v4
+        with:
+          path: crates/running-process/fuzz/corpus/${{ matrix.target }}
+          key: ${{ steps.fuzz-corpus.outputs.cache-primary-key }}
+
       - name: Write release evidence manifest
         if: ${{ success() && steps.fuzz-config.outputs.release_evidence == 'true' }}
         shell: bash