ci: reduce Actions cache usage and fix cleanup (#4123)

Reduce GitHub Actions cache pressure by keeping main as the authoritative Docker BuildKit cache producer and making cache cleanup reliable for pull requests and deleted branches.

Cache cleanup:
- Run closed pull request cleanup through pull_request_target so the workflow receives the actions: write permission required to remove caches created by fork-owned PRs.
- Keep the privileged cleanup safe by avoiding checkout or execution of pull request code.
- Replace the previous cache listing and extension loop with gh cache delete --all scoped to the exact pull request merge ref.
- Stop suppressing cache deletion failures so permission and API errors are reported instead of producing misleading successful runs.
- Add cleanup for caches associated with deleted branches, including temporary dependency-update branches.
- Use --succeed-on-no-caches so already-clean refs remain valid cleanup runs.

Docker cache behavior:
- Make pull request Docker builds restore-only.
- Allow PR builds to reuse the shared GitHub Actions BuildKit cache without exporting their own full mode=max cache.
- Keep main as the only producer of the complete reusable BuildKit cache.
- Make main cache-export backend or quota failures non-blocking so a successful Docker image build is not failed only because the cache could not be published.

Measured impact:
- Removed 178 legacy PR-scoped BuildKit caches.
- Reclaimed 9.531 GiB of Actions cache storage.
- Reduced repository cache usage from 10.088 GiB to 0.557 GiB, about 94.5% lower.
- Preserved the default-branch BuildKit cache and existing mise, ccache, map, and other non-BuildKit caches.
- Confirmed the PR Docker build completed without creating a cache under refs/pull/4123/merge.

Validation:
- Passed actionlint for clean-cache.yaml and reusable-build-docker.yml.
- Passed git diff --check.
- Passed GitHub Actions yamllint, fast checks, Lua checks, cppcheck, SonarCloud, Docker image build, and Docker quickstart smoke.
- Completed the one-time legacy cache cleanup with no deletion failures.
- Event-driven cleanup jobs were validated statically and will execute from the default branch after merge.

This prevents closed PRs and deleted branches from accumulating stale Actions caches while avoiding a separate full Docker cache for every pull request.

Author: dudantas

.github/workflows/clean-cache.yaml

@@ -1,30 +1,46 @@
 ---
-name: Cleanup caches by a branch
+name: Cleanup Actions caches
+
 on:
-  pull_request:
+  pull_request_target:
     types:
       - closed
+  delete:
+
+permissions:
+  contents: read
 
 jobs:
-  cleanup:
+  cleanup-pull-request:
+    if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
     steps:
-      - name: Cleanup
-        run: |
-          gh extension install actions/gh-actions-cache
-
-          echo "Fetching list of cache key"
-          cacheKeysForPR=$(gh actions-cache list -R "$REPO" -B "$BRANCH" -L 100 | cut -f 1 )
+      - name: Delete pull request caches
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CACHE_REF: refs/pull/${{ github.event.pull_request.number }}/merge
+        run: >-
+          gh cache delete --all
+          --ref "$CACHE_REF"
+          --repo "$GITHUB_REPOSITORY"
+          --succeed-on-no-caches
 
-          ## Setting this to not fail the workflow while deleting cache keys.
-          set +e
-          echo "Deleting caches..."
-          for cacheKey in $cacheKeysForPR
-          do
-              gh actions-cache delete "$cacheKey" -R "$REPO" -B "$BRANCH" --confirm
-          done
-          echo "Done"
+  cleanup-branch:
+    if: github.event_name == 'delete' && github.event.ref_type == 'branch'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Delete branch caches
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge
+          CACHE_REF: refs/heads/${{ github.event.ref }}
+        run: >-
+          gh cache delete --all
+          --ref "$CACHE_REF"
+          --repo "$GITHUB_REPOSITORY"
+          --succeed-on-no-caches

.github/workflows/reusable-build-docker.yml

@@ -92,7 +92,7 @@ jobs:
             ghcr.io/${{ steps.repo_lower.outputs.value }}:latest
             ghcr.io/${{ steps.repo_lower.outputs.value }}:${{ steps.gitversion.outputs.semVer }}
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max,ignore-error=true
 
       - name: Build and export (PR)
         if: github.event_name != 'push' || github.ref != 'refs/heads/main'
@@ -111,7 +111,6 @@ jobs:
           tags: |
             ghcr.io/${{ steps.repo_lower.outputs.value }}:pr
           cache-from: type=gha
-          cache-to: type=gha,mode=max
 
       - name: Validate Docker image (PR)
         if: github.event_name != 'push' || github.ref != 'refs/heads/main'