Summary

• Cut private GitHub Actions billable minutes (~50% target org-wide) by applying deploy cost controls.
• Docker GHA layer cache (docker/build-push-action + cache-from/to: type=gha,scope=<image>) so warm builds skip cold layer rebuilds.
• concurrency.cancel-in-progress: true so rapid main pushes only finish the latest SHA.
• Narrow paths: — drop over-broad packages/** fan-out; list only packages each service actually COPYs/imports.
• Deploy is main-only (no PR deploy where applicable); PR lint stays in review.yml.

Why

Org private Actions usage was ~1,987 / 2,000 free minutes (Jul). Top burners: sajubom deploy-web, contents/place/legalize ACA deploys.

Test plan

• Merge and push a no-op under the service path → deploy runs once
• Second quick push while first is building → first run cancelled
• Second deploy warm-build should be materially faster (cache hit in Buildx log)
• Unrelated package path (e.g. design-tokens when only api/core changed) does not trigger wrong service