fix(save): LRU prune survives an early break; failed saves are loud (#3)

[emooreatx]

Closes #3

Cause (measured)

save/action.yml piped find | sort -n into a while loop that breaks once target/ is under max-size-mb. On a large target/ the break leaves sort still writing, so sort gets SIGPIPE. Under pipefail the pipeline fails, set -e kills the step before tar/oras push, and the caller's continue-on-error: true reported success. Measured on CIRISPersist (details on CIRISAI/CIRISPersist#1022): no Linux blob has been published since at least v53.1.3.

Reproduced locally with a 3000-file fixture (12356 KB, 8192 KB budget), running the original snippet under bash -e -o pipefail:

SIGPIPE	before (pipe into while)	after (this PR)
ignored, as on the runner	sort: write failed: 'standard output': Broken pipe, exit 2, tar never reached	exit 0, pruned target/ 12356KB→8192KB, reaches tar
default	exit 141, tar never reached	exit 0, same

Fix

• scripts/prune.sh (cc_prune_lru): the sorted list goes to a temp file and the loop reads from it, so the break has no writer to kill. LRU semantics are unchanged: oldest mtime goes first, and pruning stops at the budget. The log line now shows real before→after numbers (the old one printed a value from the pre-subshell).
• A failed save is loud. The inputs now reach the push script through env (no ${{ }} spliced into the script). Each stage sets STAGE. An EXIT trap turns any failure into:
  • default (fail-open): ::warning::CIRISCache: save NOT published for <ref> — <stage> failed (exit N), then exit 0
  • strict: "true" (new input): ::error::, and the step fails
• New outputs published, reason and key. A failure after the push (the alias tail) keeps published=true. nothing to cache is now a warning too.
• _cc_timeout: killing a watchdog that has already exited no longer trips set -e and hides the 124 behind a plain 1.
• selftest saves with strict: "true" and asserts published. The README documents the outputs, strict, and why callers should check published and not the step outcome.

Tests

• tests/prune_test.sh runs the prune on a fixture over budget, under bash -e -o pipefail, with SIGPIPE both default and ignored. It asserts exit 0 and that the step reaches tar with no broken pipe. It also asserts that the kept set is exactly the newest files within budget with minimal deletion, and that the loop broke early with more than 64 KiB of the list unread. It also checks that the action sources the function and calls it.
• tests/save_step_test.sh runs the push step's script verbatim with a stub oras. Cases: a good save through the prune, login fails, prune fails, push fails, push fails with strict, nothing to cache, retag fails, and a failure after the push. It asserts the exit code, the annotation, and published/reason.
• .github/workflows/test.yml runs both on every PR.

Mutation results (all run locally):

• Putting back the pipe-into-while form makes prune_test fail in both SIGPIPE modes (141, and 2 with the runner's Broken pipe line). KILLED.
• Deleting newest-first, never breaking, and over-subtracting the size: all KILLED.
• On the step: removing the trap, ignoring strict, dropping the prune stage, exiting rc under fail-open, removing the post-publish guard, and silencing nothing-to-cache: all KILLED. The post-publish guard was only killed after I added the post-publish case.
• Writing published=true before the push: SURVIVED. This mutant is equivalent if GITHUB_OUTPUT is last-write-wins, which is BELIEVED.

Claim status

claim	status
the original snippet fails with the runner's exact line (exit 2) when SIGPIPE is ignored, and with 141 by default	TESTED (local repro)
the new prune exits 0 in both modes and keeps the newest files within budget	TESTED
each failure path emits its annotation and sets published/reason as described	TESTED (stub oras, script extracted from action.yml)
bash -n and shellcheck are clean on the scripts and tests; actionlint is clean on the workflows	TESTED. The extracted step has one pre-existing info-level SC2185 (find --version, intended).
composite outputs: still carry published=false when the inner step fails under strict	BELIEVED
GITHUB_OUTPUT is last-write-wins, so the trap's published=false overrides nothing written earlier	BELIEVED (the step only writes published=true after the push)
$GITHUB_ACTION_PATH/../scripts/prune.sh resolves on all three runner OSes (cygpath on Windows)	Exercised by selftest on this PR, which now sets max-size-mb: "1024" (within budget, so the script is sourced but nothing is pruned). macOS has no GNU find, so the prune is skipped there by design.
the fix unblocks CIRISPersist's Linux publish	BELIEVED until a persist save runs on a ref that includes this change (v1 has not moved)

Not done here: moving v1, or tagging.

🤖 Generated with Claude Code

https://claude.ai/code/session_016kQb87339uTdFWivk3j2hF

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.