Isolate CI snapshot creation from branch cache publishers

The optional snapshot producer executes checkout code without publishing branch caches; its artifacts are available only to consumers in the same workflow run.

Author: zozo123

.github/workflows/ci-image-build.yml

@@ -399,12 +399,42 @@ jobs:
         if: >
           inputs.upload-mount-cache-artifact == 'true' &&
           steps.stashed-image.outputs.reusable != 'true'
-      # Every job that prepares the CI image would otherwise `docker image load` the image stash,
-      # unpacking and checksumming each layer again; a copy of the image store restores with one
-      # extraction. Run after the authoritative image and mount-cache publications: snapshot
-      # creation prunes the build cache and must not affect the artifacts those steps publish.
-      # Snapshots are handoffs within this run, not branch caches. An arbitrary checkout ref
-      # must not publish raw daemon state for a later run on the default branch.
+      - name: "Check disk space after build"
+        run: df -H
+
+  # Run checkout code in a separate job with no branch-cache publications. This optional
+  # producer hands the snapshot only to consumers of the same workflow run.
+  snapshot-ci-images:
+    name: "Snapshot CI ${{ inputs.platform }} image ${{ matrix.python-version }}"
+    needs: build-ci-images
+    if: >
+      github.event_name == 'pull_request' &&
+      inputs.upload-image-artifact == 'true' && inputs.image-stash-ref == ''
+    continue-on-error: true
+    timeout-minutes: 20
+    runs-on: ${{ fromJSON(inputs.runners) }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ${{ fromJSON(inputs.python-versions) }}
+    env:
+      PYTHON_MAJOR_MINOR_VERSION: ${{ matrix.python-version }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Checkout sources"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ inputs.checkout-ref }}
+          persist-credentials: false
+      - name: "Prepare authoritative CI image"
+        uses: ./.github/actions/prepare_breeze_and_image
+        with:
+          platform: ${{ inputs.platform }}
+          python: ${{ matrix.python-version }}
+          use-uv: ${{ inputs.use-uv }}
+          make-mnt-writeable-and-cleanup: 'true'
       - name: "Snapshot CI image ${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
         id: snapshot-export
         continue-on-error: true
@@ -414,10 +444,6 @@ jobs:
           ./scripts/ci/docker_data_root_snapshot.sh create
           "/mnt/ci-image-snapshot-${PLATFORM//\//_}-${PYTHON_MAJOR_MINOR_VERSION}.tar.zst"
         shell: bash
-        if: >
-          github.event_name == 'pull_request' &&
-          inputs.upload-image-artifact == 'true' && inputs.image-stash-ref == '' &&
-          steps.stashed-image.outputs.reusable != 'true'
       - name: "Upload CI image snapshot ${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
         continue-on-error: true
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -429,9 +455,4 @@ jobs:
           if-no-files-found: 'error'
           compression-level: '0'
           retention-days: '2'
-        if: >
-          github.event_name == 'pull_request' && steps.snapshot-export.outcome == 'success' &&
-          inputs.upload-image-artifact == 'true' && inputs.image-stash-ref == '' &&
-          steps.stashed-image.outputs.reusable != 'true'
-      - name: "Check disk space after build"
-        run: df -H
+        if: steps.snapshot-export.outcome == 'success'