ci: stop exporting the docker-smoke layer cache on pull requests - #506

Problem

Docker Smoke (bare-container DB-less contract) went red on PR #492 — cancelled at its 13-minute bound before the smoke-test body ran. Same signature as the first attempt on #503.

Reading the job log (run 34225008423, job 102057139452) rather than guessing: the image built successfully (#20 exporting to docker image format … DONE 70.8s, image loaded). What then consumed the remaining ~12 minutes was the buildx cache export:

#22 exporting to GitHub Actions Cache
#22 preparing build cache for export 46.3s done
#22 sending cache export
#22 writing layer sha256:eadf4b3c… 38.8s done
#22 writing layer sha256:fc852874…
##[error]The operation was canceled.       ← 12:31:31, t+827s

So the PR was marked red by a step that asserts nothing about the code under review.

Measurement

Same job, same workflow, two contexts:

The existing # source: on timeout-minutes: 13 cited "run 33951959734 (2026-09-05), max 369s". Today's 827 s observation invalidates 369 s as an upper bound.

Root cause

cache-to: type=gha,mode=max ran on every event. GitHub Actions scopes a cache entry to the ref that created it:`` the default branch's entries are readable from every branch, but an entry a PR run writes is readable only by that same PR's later runs. This job runs once per head commit — so the PR-written entry is exported and then never read. Pure cost on the critical path.

mode=max also exports every intermediate build stage, including the ~421 MB layer visible in the log above.

Fix

Skip the export on pull_request only:

cache-from: type=gha
cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max' || '' }}

• cache-from stays unconditional — PRs keep reading main's warm cache, so the torch CPU-wheel layer is still not re-downloaded. The stated intent of the existing comment block is preserved.
• Pushes to main still populate the cache, in mode=max, at the measured 242 s steady state.
• The two sibling Docker Build jobs already use mode=min; this job was the odd one out.

The condition is deliberately written != 'pull_request' && <value> || '' rather than == 'pull_request' && '' || <value>: GitHub expressions return the operand rather than a boolean and the empty string is falsy, so the latter form falls through to <value> on every event and disables nothing. That pitfall is called out in a comment beside the line.

timeout-minutes: 13 is kept and re-sourced to the warm-path steady state it actually bounds, recording explicitly that the cold export is removed rather than budgeted for.

What is NOT changed

The BLOCKING contract this job asserts is untouched — it still builds the bare repo and runs tools/list with zero env vars and zero external services. No continue-on-error, no skip, no test disabled.

Verification

• actionlint v1.7.12 (the version pinned in ci.yml, checksum-verified release binary) — clean on ci.yml
• python scripts/check_ci_gate_complete.py — OK (no job names change)
• python scripts/check_craftsmanship.py --base origin/main — OK
• python scripts/check_doc_claims.py, check_version_surfaces.py — OK
• ruff check ., ruff format --check . — clean
• YAML parses

The real proof is this PR's own Docker Smoke run: it exercises the pull_request branch of the new condition.

🤖 Generated with Claude Code

https://claude.ai/code/session_01StMBvNd7eVJGtpnC2zNsx1

Generated by Claude Code