Restrict continue-on-error to capped restores

Review follow-ups:
- The contract test allowed continue-on-error on any step, so a test
  or build step tolerating failure would slip past it. Allow it only
  on rust-cache / actions/cache/restore steps that also carry a
  timeout, and require every such restore in ci.yml to be capped.
- Cap the macOS vexctl actions/cache/restore the same way. If that
  restore times out on main, skip the save step, which would
  otherwise run with an empty key and fail the job.
- Correct the comment: the hang was in yarn-classic-matrix, and an
  uncapped restore runs to that job's own timeout.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LZ8V19imL1WHdq6hZdoums

Author: claude

.github/workflows/ci.yml

@@ -118,10 +118,12 @@ jobs:
         # version). rust-cache also hashes the toolchain, Cargo manifests
         # and Rust environment. Check/coverage/release keep separate caches.
         # A cache restore is an optimisation, so cap it and carry on cold.
-        # Healthy restores take under 30 s. On 2026-10-26 one hung for 14+
-        # min and held merge-queue head #1719 (and 12 entries behind it)
-        # until it was cancelled; uncapped it would have run to the 40-min
-        # job timeout. Later `Cache cargo` steps carry the same two keys.
+        # Healthy restores take under 30 s on every runner OS. On 2026-10-26
+        # one hung for 14+ min in yarn-classic-matrix and held merge-queue
+        # head #1719 (and 12 entries behind it) until it was cancelled;
+        # uncapped it runs to the job's own timeout. Every cache restore in
+        # this file carries the same two keys (enforced by
+        # scripts/tests/test_merge_queue_fail_fast.py).
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         timeout-minutes: 5
         continue-on-error: true
@@ -442,6 +444,9 @@ jobs:
         id: vexctl-cache
         if: needs.release-readiness.outputs.reuse != 'true' && runner.os == 'macOS'
         uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        # Capped like `Cache cargo`: a miss only means compiling vexctl.
+        timeout-minutes: 5
+        continue-on-error: true
         with:
           path: ${{ runner.temp }}/vexctl-bin
           key: vexctl-${{ env.VEXCTL_VERSION }}-go${{ steps.go.outputs.go-version }}-${{ runner.os }}-${{ runner.arch }}
@@ -515,6 +520,7 @@ jobs:
           && runner.os == 'macOS'
           && github.ref == 'refs/heads/main'
           && steps.vexctl-cache.outputs.cache-hit != 'true'
+          && steps.vexctl-cache.outcome == 'success'
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: ${{ runner.temp }}/vexctl-bin

scripts/tests/test_merge_queue_fail_fast.py

@@ -115,9 +115,24 @@ class CiWorkflowContract(unittest.TestCase):
     def test_no_job_tolerates_failure(self):
         # A job-level continue-on-error would let ci-ok pass despite a failed
         # job, and this script would then cancel a run that could still land.
-        # Step-level ones (8+ spaces, e.g. the capped `Cache cargo` restores)
-        # leave the job's conclusion to its other steps, so they are fine.
+        # A step-level one hides that step's failure the same way, so only
+        # the capped cache restores may carry it: a miss there just means
+        # building cold.
         self.assertIsNone(re.search(r"^    continue-on-error:", self.text, re.M))
+        steps = re.split(r"(?m)^      - ", self.text)
+        tolerant = [s for s in steps if re.search(r"(?m)^\s*continue-on-error:", s)]
+        self.assertTrue(tolerant)
+        for step in tolerant:
+            self.assertRegex(step, r"(?m)^        uses: (Swatinem/rust-cache|actions/cache/restore)@", step[:80])
+            self.assertRegex(step, r"(?m)^        timeout-minutes: \d+$", step[:80])
+            self.assertRegex(step, r"(?m)^        continue-on-error: true$", step[:80])
+
+    def test_every_cache_restore_is_capped(self):
+        # An uncapped restore that hangs holds the queue head until the job
+        # times out (#1730).
+        for step in re.split(r"(?m)^      - ", self.text):
+            if re.search(r"(?m)^        uses: (Swatinem/rust-cache|actions/cache/restore)@", step):
+                self.assertRegex(step, r"(?m)^        timeout-minutes: \d+$", step[:80])
 
     def test_gate_runs_on_a_cancelled_run(self):
         gate = self.text[self.text.index("\n  ci-ok:"):]