[eserscor]

Description

Split the 13 combined ccache cache actions into pinned actions/cache/restore and explicit actions/cache/save steps across:

• .github/workflows/linux_minimal_build.yml (9 jobs)
• .github/workflows/android.yml (2 jobs)
• .github/workflows/linux-wasm-ci-build-and-test-workflow.yml (1 reusable job, including the web cache keys)
• .github/workflows/reusable_linux_build.yml (1 reusable job)

Restores remain enabled on all previously supported runs. Publishing is restricted to successful jobs on the exact refs/heads/main ref when there was no exact cache hit. Save steps run last, after tests, artifacts, and cleanup, rather than immediately after compilation. Existing cache keys, paths, action pins, permissions, triggers, and build/test behavior are preserved. No additional token permissions are required.

Validation (Windows, actionlint 1.7.12; $checks is the session-local verification tools directory; verification scripts are not repository changes):

Exact command	Result
python "$checks\validate_ccache.py" --candidate origin/main	Failed as expected on the original combined action, reproducing the implicit-save regression.
python "$checks\validate_ccache.py"	Passed: YAML parsing, all 13 restore/save pairs, and 702 guard cases spanning main, PR, feature, release, lookalike-main, and tag refs; exact hits, partial hits/misses; successful, failed, and cancelled jobs. Also verified original keys/paths/pins, unchanged non-cache behavior, and final-step save placement.
python "$checks\validate_actionlint.py"	Passed: baseline comparison confirms all 15 raw actionlint diagnostics also exist on origin/main (14 custom-runner-label diagnostics and the WASM top-level description error); no new diagnostics.
git diff --check	Passed.

The following actionlint command also passed, excluding only the baseline-confirmed diagnostic messages. Shellcheck and pyflakes were not run:

& "$checks\actionlint-1.7.12\actionlint.exe" -shellcheck= -pyflakes= -ignore 'label "ort-github-linux-.*" is unknown' -ignore 'unexpected key "description" for "workflow" section' .github\workflows\android.yml .github\workflows\linux-wasm-ci-build-and-test-workflow.yml .github\workflows\linux_minimal_build.yml .github\workflows\reusable_linux_build.yml

Full compiler builds were not run for this workflow-only change. No CI runs were manually triggered and no live caches were deleted.

Motivation and Context

Temporarily stop PR and non-main runs from publishing additional legacy ccache archives while retaining their ability to restore existing caches. The combined cache action otherwise automatically publishes a cache miss after a successful PR job.

Existing cache entries remain until separately cleaned up or evicted. This does not disable local ccache writes, redesign keys, change sccache/vcpkg behavior, or modify the merged #33811 branch.

[Copilot]

🟢 Approval recommended

No active review issues remain for the cache-publishing changes.

No open issues 🎉

What changed in this PR

Restricts legacy ccache archive publishing to successful main runs while preserving cache restores for PRs and other branches. This leaves the separate macOS sccache work unchanged.

Changes:

• Splits 13 combined cache actions into pinned restore and explicit save steps.
• Allows saves only on refs/heads/main when the job succeeds and no exact cache hit exists.
• Places saves last while preserving existing cache keys, paths, and build/test behavior.

File	Description
.github/​workflows/​reusable_linux_build.yml	Separates restore and main-only save in the reusable Linux job.
.github/​workflows/​linux-wasm-ci-build-and-test-workflow.yml	Applies the save policy to the reusable WASM job, preserving web cache keys.
.github/​workflows/​linux_minimal_build.yml	Applies restore/save separation across nine build jobs.
.github/​workflows/​android.yml	Adds final, main-only cache saves to both Android jobs.

_{Review effort: Balanced}