ci(cache): save GitHub Actions caches only from main

[balajinvda]

Why

The repo is at 9.66 GB of its 10 GB Actions cache limit. GitHub scopes a
cache entry to the ref that wrote it, so a pull_request or merge_group run
writes an entry only that ref can ever restore — used once, then holding quota
until evicted.

dependency-docs-bazel alone held 5.59 GB across four entries, three of them
the same key written from three refs:

size	ref	usable by
1.4 GB	refs/heads/main	everything
1.4 GB	refs/pull/693/merge	only PR 693
1.4 GB	gh-readonly-queue/main/pr-649	only that queue entry, now gone

Those copies evict the Bazel build caches, which are the ones that actually make
CI fast.

What changed

Every actions/cache use is split into actions/cache/restore +
actions/cache/save, with the save gated to pushes on main. Runs on any ref
still restore from the default branch, so no reuse is lost. This is the same
read/write split the remote cache already uses in
tools/ci/bazel-cache-upload-mode.

Also added a restore-keys prefix to the dependency-docs cache; without one,
any lock bump meant a fully cold build.

Testing

Both workflows parse; every restore has a matching save with identical path
and key; each save is gated to a main push and carries its restore's own
conditions (precheck.skip, the byoo subtree guard). Verified with a script,
not by eye. The quota effect can only be confirmed after this runs on main.

Summary by CodeRabbit

• Chores
  • Improved build and dependency workflow caching for faster repeated checks.
  • Cache data is now saved only after successful pushes to the main branch, preventing pull requests and merge checks from creating unnecessary cache entries.
  • Added fallback cache restoration to improve reliability when an exact cache match is unavailable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d1ab3d35-8893-4281-916f-0f80863b8e06

📥 Commits

Reviewing files that changed from the base of the PR and between 3de9a59 and 3d1f6c5.

📒 Files selected for processing (2)

• .github/workflows/bazel.yml
• .github/workflows/license-dependencies.yml

---

📝 Walkthrough

Walkthrough

The workflows now restore Bazel-related caches for all events and save them only after successful pushes to main. The dependency documentation check remains between cache restoration and saving.

Changes

Cache lifecycle controls

Layer / File(s)	Summary
Bazel workflow cache lifecycle .github/workflows/bazel.yml	Build-container and Docker-host lanes restore caches on all events. Explicit save steps run only after successful pushes to main.
Dependency documentation cache lifecycle .github/workflows/license-dependencies.yml	The workflow restores Bazel caches with a fallback key, runs the documentation freshness check, and saves caches only on pushes to main.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/nvcf#656: Separates Bazel and dependency workflow cache restoration from restricted cache saving.

Suggested reviewers: mikeyrcamp

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title uses valid Conventional Commits syntax and accurately describes the CI workflow cache changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/cache-save-main-only

---

_{Comment @coderabbitai help to get the list of available commands.}