[CELL-293] cache-publish now runs even when an earlier build step failed, so a partial /nix volume hydrates the next run instead of starting from zero — cache-bust available via the skip_nix_cache workflow input

- feat(infra): `Stream-publish /nix volume to GHCR cache image` in both `build.dev.yml` and `build.release.yml` now uses `if: !cancelled() && inputs.skip_nix_cache != true`. A flaky cache.nixos.org download or any other transient build failure no longer throws away the derivations that *did* land in the volume — retry runs hydrate the partial cache and finish faster
- feat(infra): add an inline `du -s /nix` guard before each publish — if the volume is under 1 GB, the step exits early. Protects the healthy cache from being overwritten by an empty-volume publish when the hydrate step itself failed
- feat(infra): expose `skip_nix_cache` as a `workflow_dispatch` input on `build.release.yml` (it already existed on `build.dev.yml`). Setting it to `true` skips both hydrate AND publish — operators can manually flush a poisoned cache by re-running with that flag, then re-running normally to publish a fresh one

Author: DimmKirr

.github/workflows/build.dev.yml

@@ -190,14 +190,28 @@ jobs:
       # `-C / nix`: archive entries land under `nix/...` natively
       # (BusyBox tar doesn't implement --transform).
       # `--exclude=nix/var/nix/daemon-socket`: Unix sockets can't tar.
+      # Publish even on prior-step failure — a partially-populated
+      # /nix volume still speeds up the next run's hydrate. Skip when:
+      #   - the job was cancelled (intentional, don't write garbage)
+      #   - skip_nix_cache=true (cache-bust mode, deliberately fresh)
+      #   - the volume is under 1 GB (hydrate-step failure → empty
+      #     volume, don't overwrite a healthy cache with nothing)
       - name: Stream-publish /nix volume to GHCR cache image
+        if: ${{ !cancelled() && inputs.skip_nix_cache != true }}
         timeout-minutes: 80
         run: |
           set -eo pipefail
           HASH=${{ hashFiles('nixhome/**') }}
           EXACT="${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:nix-cache-${{ matrix.arch }}-${HASH}"
           LATEST="${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:nix-cache-${{ matrix.arch }}-latest"
 
+          SIZE_KB=$(docker run --rm -v devcell-nix-store-${{ matrix.arch }}:/nix:ro alpine du -s /nix 2>/dev/null | awk '{print $1}')
+          if [ "${SIZE_KB:-0}" -lt 1000000 ]; then
+            echo "skipping publish: /nix is only ${SIZE_KB}KB — won't overwrite cache with empty volume"
+            exit 0
+          fi
+          echo "publishing /nix (${SIZE_KB}KB) — job status: ${{ job.status }}"
+
           docker run --rm -v devcell-nix-store-${{ matrix.arch }}:/nix:ro alpine \
             tar -cf - \
               --exclude='nix/var/nix/daemon-socket' \

.github/workflows/build.release.yml

@@ -9,6 +9,11 @@ on:
     types:
       - created
   workflow_dispatch:
+    inputs:
+      skip_nix_cache:
+        description: 'Skip nix cache (genesis mode — full rebuild, no pre-seeding, no post-build publish)'
+        type: boolean
+        default: false
 
 permissions:
   contents: write
@@ -85,6 +90,7 @@ jobs:
       # builds reuse the same nixhome closure as dev builds for any
       # given `hashFiles('nixhome/**')`, so the cache is interchangeable.
       - name: Stream-hydrate /nix volume from prior GHCR cache (if available)
+        if: inputs.skip_nix_cache != true
         run: |
           set -eo pipefail
           HASH=${{ hashFiles('nixhome/**') }}
@@ -126,14 +132,25 @@ jobs:
         run: docker push ${{ steps.build.outputs.tag }}
 
       # Publish the populated /nix volume back to the GHCR cache so
-      # subsequent dev + release builds can reuse it.
+      # subsequent dev + release builds can reuse it. Runs even on
+      # prior-step failure (partial volume is still useful), but skips
+      # under cancellation, cache-bust mode, or near-empty volume.
       - name: Stream-publish /nix volume to GHCR cache image
+        if: ${{ !cancelled() && inputs.skip_nix_cache != true }}
         timeout-minutes: 80
         run: |
           set -eo pipefail
           HASH=${{ hashFiles('nixhome/**') }}
           LATEST="${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:nix-cache-${{ matrix.arch }}-latest"
           EXACT="${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:nix-cache-${{ matrix.arch }}-${HASH}"
+
+          SIZE_KB=$(docker run --rm -v devcell-nix-store-${{ matrix.arch }}:/nix:ro alpine du -s /nix 2>/dev/null | awk '{print $1}')
+          if [ "${SIZE_KB:-0}" -lt 1000000 ]; then
+            echo "skipping publish: /nix is only ${SIZE_KB}KB — won't overwrite cache with empty volume"
+            exit 0
+          fi
+          echo "publishing /nix (${SIZE_KB}KB) — job status: ${{ job.status }}"
+
           docker run --rm -v devcell-nix-store-${{ matrix.arch }}:/nix:ro alpine \
             tar -cf - \
               --exclude='nix/var/nix/daemon-socket' \