feat: improve cache-cleanup workflow (#533)

Closes #517.

.github/workflows/cache-cleanup.yaml

@@ -0,0 +1,47 @@
+---
+name: Renovate Cache Cleanup
+'on':
+  pull_request:
+    types: [closed]
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+jobs:
+  renovate-cache-cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      - name: Install `gh-actions-cache` CLI extension
+        run: gh extension install actions/gh-actions-cache
+
+      - id: cache-info
+        name: Get information for cache cleanup
+        env:
+          BRANCH: >-
+            ${{
+              github.event_name == 'pull_request' && github.event.pull_request.merged && 'refs/pull/${{ github.event.pull_request.number }}/merge'
+              || github.event_name != 'pull_request' && github.ref
+              || ''
+            }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          KEY: renovate-cache-
+        run: |
+          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
+          if [ -n "$BRANCH" ]; then
+            # Get cache keys that don't include the branch's SHA (if not a PR)
+            gh actions-cache list -R ${{ github.repository }} -B $BRANCH -L 100 --key $KEY --order asc --sort last-used | cut -f 1 > cache-keys.txt
+            [ -z "${{ github.event.pull_request }}" ] && grep -v ${{ github.sha }} cache-keys.txt > cache-keys.txt.tmp && mv cache-keys.txt.tmp cache-keys.txt
+            echo "cache-keys=$(cat cache-keys.txt)" >> $GITHUB_OUTPUT
+          fi
+
+      - env:
+          CACHE_KEYS: ${{ steps.cache-info.outputs.cache-keys }}
+        if: ${{ steps.cache-info.outputs.branch != '' }}
+        name: Delete stale cache entries from ${{ steps.cache-info.outputs.branch }}
+        run: |
+          set +e
+          for key in $CACHE_KEYS; do
+            gh actions-cache delete $key -R ${{ github.repository }} -B ${{ steps.cache-info.outputs.branch }} --confirm
+          done