pr ci flow

Author: ngalaiko

.github/workflows/build.yaml

@@ -1,13 +1,18 @@
 name: build
 
 on:
+  pull_request:
   push:
     branches: [master]
   workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check:
     name: Flake check + format
@@ -19,12 +24,13 @@ jobs:
       - run: nix fmt . && git diff --exit-code
 
   build:
-    name: Build + push ${{ matrix.system }}
+    name: Build ${{ matrix.system }}
     needs: check
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
+      actions: write # cache purge
     strategy:
       fail-fast: false
       matrix:
@@ -39,21 +45,25 @@ jobs:
         with:
           primary-key: nix-${{ matrix.system }}-${{ hashFiles('flake.lock', 'flake.nix', 'modules/**', 'packages/**') }}
           restore-prefixes-first-match: nix-${{ matrix.system }}-
+          # PR saves count against the repo quota and would evict master's caches.
+          save: ${{ github.event_name != 'pull_request' }}
           gc-max-store-size-linux: 6G
           purge: true
           purge-prefixes: nix-${{ matrix.system }}-
           purge-created: 0
           purge-primary-key: never
-      - name: Build + push ${{ matrix.system }}
+      - name: Build ${{ matrix.system }}
+        # out-link roots the image closure so the pre-save GC keeps it.
+        run: nix build .#packages.${{ matrix.system }}.exedev --out-link /tmp/image
+      - name: Push ${{ matrix.system }}
+        if: github.event_name != 'pull_request'
         env:
           GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # out-link roots the image closure so the pre-save GC keeps it.
-          nix build .#packages.${{ matrix.system }}.exedev --out-link /tmp/image
-          nix run .#push-image -- ${{ matrix.system }}
+        run: nix run .#push-image -- ${{ matrix.system }}
 
   manifest:
     name: Publish multi-arch manifest
+    if: github.event_name != 'pull_request'
     needs: build
     runs-on: ubuntu-24.04
     permissions: