ci: persist PR caches and stabilize build time

.github/workflows/build.yml

@@ -403,6 +403,7 @@ jobs:
 
       - uses: gradle/actions/setup-gradle@v4
         with:
+          cache-read-only: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
           cache-cleanup: on-success
 
       - name: Resolve the pinned Android NDK

app/build.gradle

@@ -80,7 +80,7 @@ def sourceCommit = providers.environmentVariable('DROIDDECK_SOURCE_COMMIT').getO
 def prNumber = (providers.environmentVariable('DROIDDECK_PR_NUMBER').getOrNull() ?: '0').with { it.isInteger() ? it : '0' }
 def ciBuild = providers.environmentVariable('GITHUB_ACTIONS').getOrNull() == 'true'
 def releaseSigner = rootProject.file('keystore/release-signer.sha256').text.trim()
-def commitTime = (gitValue(['show', '-s', '--format=%ct', 'HEAD']) ?: '0').with { it.isLong() ? it : '0' }
+def commitTime = (gitValue(['show', '-s', '--format=%ct', '--end-of-options', sourceCommit]) ?: '0').with { it.isLong() ? it : '0' }
 def desktopKde = rootProject.file('tools/desktop-kde/release.env').readLines()
     .findAll { it.contains('=') && !it.startsWith('#') }
     .collectEntries { def kv = it.split('=', 2); [(kv[0].trim()): kv[1].trim()] }

tools/tests/test_ci_checks.py

@@ -15,6 +15,15 @@ ROOT = Path(__file__).resolve().parents[2]
 
 
 class CiChecksTest(unittest.TestCase):
+    def test_pr_cache_writes_and_source_timestamp_policy(self):
+        jobs = yaml.safe_load((ROOT / '.github/workflows/build.yml').read_text())['jobs']
+        cache = next(step for step in jobs['build']['steps']
+                     if step.get('uses') == 'gradle/actions/setup-gradle@v4')['with']
+        self.assertEqual(cache['cache-read-only'],
+                         "${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}")
+        gradle = (ROOT / 'app/build.gradle').read_text()
+        self.assertIn("gitValue(['show', '-s', '--format=%ct', '--end-of-options', sourceCommit])", gradle)
+
     def test_report_comment_lookup_ignores_human_marker(self):
         if not shutil.which('jq'):
             self.skipTest('jq required to execute comment selection')