[build] reduce github cache churn and aggressively prune CodeQL caches

[titusfortner]

🔗 Related Issues

💥 What does this PR do?

• Browser pin updates no longer kick off the GitHub Cache populate job. That job runs with --pin_browsers=false, so a browser pin gives it nothing new to cache — it accounted for 17 of the last 24 populate runs.
• CodeQL caches created by pull requests now get pruned. Only trunk runs triggered a prune before (~3/day) while CodeQL itself ran ~10/day, almost entirely from PRs.
• Both free headroom in the 10 GiB per-repo Actions cache budget, which is currently full and evicting continuously.

🔧 Implementation Notes

• Stopping the CodeQL caches at the source would mean moving off default setup, since the dependency-caching toggle only exists on advanced setup's init action. Owning a workflow across 9 languages isn't worth the ~1 GiB, so pruning more often is the cheaper trade.

🤖 AI assistance

• AI assisted (complete below)
  • Tool(s): Claude Code
  • What was generated: workflow trigger edits and comments; cache usage analysis
  • I reviewed all AI output and can explain the change

💡 Additional Considerations

• Deliberately not fixed here: the repository cache key hashes only MODULE.bazel, so other lockfile changes never produce a fresh cache. It's a warm-start miss rather than a correctness bug, and widening the key would raise regenerations ~41% at ~8.9 GiB each — worse eviction pressure, not better.

🔄 Types of changes

• Cleanup (formatting, renaming)

[qodo-code-review]

PR Summary by Qodo

Trim gh-cache trigger paths and prune CodeQL caches from PR runs

⚙️ Configuration changes ✨ Enhancement 🕐 Less than 10 minutes

AI Description

• Remove no-op browser pin files from the gh-cache workflow path trigger.
• Ensure prune-caches runs after CodeQL on PRs by dropping the trunk-only filter.
• Add inline documentation explaining cache-budget and trigger rationale.

Diagram

graph TD
A["Push to trunk"] --> B["gh-cache.yml"] --> C["Bazel cache populate"] --> D[("Actions cache")]
E["CodeQL run (PR/trunk)"] --> F["prune-caches.yml"] --> G["Delete CodeQL caches"] --> D
H["Key files (MODULE/locks)"] --> B
subgraph Legend
  direction LR
  _evt["Event"] ~~~ _wf["Workflow"] ~~~ _cache[("Cache")]
end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Disable CodeQL dependency caching (advanced setup)

• ➕ Prevents CodeQL caches from being created at all
• ➕ Reduces cache budget pressure without needing pruning
• ➖ Requires owning and maintaining an advanced CodeQL workflow across many languages
• ➖ Higher operational cost and potential for misconfiguration/regressions

2. Scheduled pruning only (cron-based cleanup)

• ➕ Decouples pruning cadence from CodeQL completion frequency
• ➕ Can be tuned to run during low-traffic windows
• ➖ Allows PR caches to accumulate between runs, increasing eviction pressure
• ➖ Harder to keep cache size bounded during bursts of PR activity

Recommendation: Keep the PR’s approach: removing no-op gh-cache triggers avoids wasteful runs, and dropping the trunk branch filter on the workflow_run trigger is the simplest way to ensure PR-originated CodeQL caches are pruned promptly without taking on the maintenance burden of advanced CodeQL setup.

Files changed (2) +5 / -3

Other (2) +5 / -3

gh-cache.ymlStop triggering cache population on browser pin file edits +3/-2

Stop triggering cache population on browser pin file edits

• Removes common/repositories.bzl and common/browsers.bzl from the push paths filter. Adds comments explaining that browser pin changes are irrelevant because the populate job runs with --pin_browsers=false and those files don’t affect the repository cache key.

.github/workflows/gh-cache.yml

prune-caches.ymlPrune CodeQL caches for PR runs by removing trunk-only filter +2/-1

Prune CodeQL caches for PR runs by removing trunk-only filter

• Drops branches: [trunk] from the workflow_run trigger so the prune workflow runs after CodeQL completes on pull requests as well as trunk. Adds a clarifying comment about shared cache budget impact.

.github/workflows/prune-caches.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can enable the Remediation agent and Qodo fixes findings in a dedicated fix PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗