improvement(ci): elect one dependency cache writer per integration matrix

Author: waleedlatif1

.github/CI.md

@@ -4,6 +4,8 @@ GitHub-hosted jobs restore their event-specific dependency caches first. Trusted
 
 The `changes` job runs Turborepo 2.9.14's `affectedTasks` query before installing application dependencies or provisioning services. `turbo.json` records package dependency propagation; `apps/sim/turbo.json` partitions the app into shared runtime, server, workspace UI, and acceptance tasks. `.github/ci-suites.json` turns those tasks into job matrices. The uploaded `ci-plan` artifact names changed files, selected tasks, attribution reasons, and any fallback.
 
+The integration matrix's `push/db` job owns dependency-cache uploads; the other integration jobs only restore. Exact hits skip uploads. This avoids concurrently compressing the same dependency trees across all shards merely to lose the shared-key reservation race.
+
 A PR compares its merge base with the checked-out merge commit. Main/staging pushes execute all checks; the parent `ci` workflow skips checks on `dev` pushes, while PRs targeting `dev` still run checks. A manual `checks` run executes all checks unless supplied a full base commit SHA to reproduce a scoped plan. Missing history, an empty diff, unknown files outside the workspace graph, root script/CI changes, or a planner error run every check. Missing selection outputs fail the aggregate gate. The gate also rejects an omitted dependency, any failed/cancelled job, and any skip that its explicit selection flag did not authorize.
 
 | Change | Expensive checks selected |

.github/actions/setup/action.yml

@@ -18,6 +18,10 @@ inputs:
     description: npm registry to write an .npmrc for, so `npm publish` reads NODE_AUTH_TOKEN. Empty writes none.
     required: false
     default: ''
+  save-dependency-cache:
+    description: Save GitHub dependency caches after installation. Parallel matrices can elect one writer.
+    required: false
+    default: 'true'
 
 # Writes stay scoped by event and fork status. Trusted GitHub PRs can read the
 # default branch's push caches; push jobs never read PR caches.
@@ -60,6 +64,7 @@ runs:
         path: ./node_modules
 
     - name: Restore Bun cache
+      id: bun-cache
       if: inputs.provider != '' && inputs.provider != 'blacksmith'
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
       with:
@@ -70,6 +75,7 @@ runs:
         path: ~/.bun/install/cache
 
     - name: Restore node_modules
+      id: node-modules-cache
       if: inputs.provider != '' && inputs.provider != 'blacksmith'
       uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
       with:
@@ -114,14 +120,14 @@ runs:
         exit 1
 
     - name: Save Bun cache
-      if: inputs.provider != '' && inputs.provider != 'blacksmith'
+      if: inputs.provider != '' && inputs.provider != 'blacksmith' && inputs.save-dependency-cache == 'true' && steps.bun-cache.outputs.cache-hit != 'true'
       uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
       with:
         key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ github.run_id }}
         path: ~/.bun/install/cache
 
     - name: Save node_modules
-      if: inputs.provider != '' && inputs.provider != 'blacksmith'
+      if: inputs.provider != '' && inputs.provider != 'blacksmith' && inputs.save-dependency-cache == 'true' && steps.node-modules-cache.outputs.cache-hit != 'true'
       uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
       with:
         key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}-${{ github.run_id }}

.github/workflows/checks.yml

@@ -136,6 +136,7 @@ jobs:
         uses: ./.github/actions/setup
         with:
           provider: github
+          save-dependency-cache: ${{ matrix.provision == 'push' && matrix.shard == 'db' }}
 
       - name: Provision a fresh database through the supported command
         working-directory: packages/db