ci(sync): pin only the cli and mcp browser closures in Cachix

[khwstolle]

Problem

In Sync run 38060368920, cache-arm failed when pinning playwright-dotnet-browsers-aarch64-linux:

402 Payment Required
{"error":"Pin storage limit exceeded. Upgrade your plan or remove existing pins."}

Cachix also reports 80% storage use. The cache pins 15 closures (5 tools × 3 systems). They resolve to 10 distinct browser sets of about 0.45 GiB each, 4.06 GiB of pinned cache paths in total:

System	Distinct sets	Shared by
x86_64-linux	3	cli + mcp; dotnet + python; node
aarch64-darwin	3	cli + mcp; dotnet + python; node
aarch64-linux	4	cli and mcp diverged after the partial cache-arm run

Each new Playwright release adds about 0.45 GiB per system and per distinct set until the old pin revision is replaced.

Change

• sync.yml: all three push-browsers calls pin only cli mcp. These two tools normally share one browser set per system, so the cache holds about 1.3 GiB, and about 2.7 GiB while a release replaces the old set.
• README.md, docs/maintenance.md: document which closures the cache holds and why.

node, dotnet and python still build without runtime downloads (rule 1 in AGENTS.md): their browsers come from cdn.playwright.dev through fetchzip at build time. The first build of these packages is slower for users.

Manual step after merge

Remove the old pins in the Cachix dashboard, because CI no longer updates them and they keep their storage:

• playwright-{node,dotnet,python}-browsers-{x86_64-linux,aarch64-linux,aarch64-darwin} (9 pins)

Validation

• Sizes were read from the FileSize fields of the narinfo files of each pinned closure on playwright.cachix.org.
• prettier --check passes on the changed files.
• push-browsers.ts already accepts a tool list. Only the arguments change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kkw5FTWMTfd2shZr7sDG5V

---

Generated by Claude Code

[Copilot]

🟡 Changes recommended

The maintenance documentation incorrectly attributes storage growth to each tool rather than each distinct browser set.

1 open finding

• Clarify storage growth is per distinct browser set, not tool · New

What changed in this PR

Limits Cachix pinning to CLI and MCP browser closures to reduce storage usage.

Changes:

• Updates all sync jobs to pin only CLI and MCP closures.
• Documents the revised caching policy and build-time browser fetching.

File	Description
.github/​workflows/​sync.yml	Restricts browser pinning to CLI and MCP.
README.md	Summarizes the cache scope.
docs/​maintenance.md	Explains CI caching and storage usage.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The workflow arguments and documentation consistently implement the stated cache-reduction strategy.

0 open findings

1 resolved since last review

• Clarify storage growth is per distinct browser set, not tool

🧠 Review effort: Balanced