Please address the comments from this code review:

## Overall Comments
- The updated cache save/restore conditions are getting quite complex and are duplicated four times; consider introducing a single reusable expression (e.g., a `should_save_cache` output or job-level `env`) to centralize the logic and make it easier to reason about and change safely.
- The `contains(github.event.pull_request.labels.*.name, 'ci-save-cache')` checks are not guarded by an event-type predicate; to avoid issues when `github.event.pull_request` is undefined (e.g., on `push` events) and to make intent clearer, wrap the label check in an explicit `github.event_name == 'pull_request' && ...` clause.

## Individual Comments

### Comment 1
<location> `.github/actions/cache-go-dependencies/action.yaml:22-23` </location>
<code_context>
-    # All other events (PRs, etc.) restore only.
+    # Save caches on pushes to the default branch, or on PRs with the
+    # ci-save-cache label (for testing cache-affecting changes on branches).
     - name: Cache Go Dependencies (save)
-      if: inputs.save == 'true' && (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)
+      if: inputs.save == 'true' && (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch || contains(github.event.pull_request.labels.*.name, 'ci-save-cache'))
       uses: actions/cache@v5
       with:
</code_context>

<issue_to_address>
**issue (bug_risk):** Referencing `github.event.pull_request` on non-PR events can break the workflow expression.

On push events, `github.event.pull_request` is undefined, and accessing its properties can cause the workflow condition to error. To avoid failures on pushes, wrap the label check in an event guard, e.g.:

```yaml
if: inputs.save == 'true' && (
  (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) ||
  (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-save-cache'))
)
```

This preserves the intended behavior without touching `github.event.pull_request` when it doesn’t exist.
</issue_to_address>

### Comment 2
<location> `.github/actions/cache-go-dependencies/action.yaml:30-31` </location>
<code_context>
         restore-keys: go-mod-v1-

     - name: Cache Go Dependencies (restore)
-      if: ${{ !(inputs.save == 'true' && (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)) }}
+      if: ${{ !(inputs.save == 'true' && (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch || contains(github.event.pull_request.labels.*.name, 'ci-save-cache'))) }}
       uses: actions/cache/restore@v5
       with:
</code_context>

<issue_to_address>
**suggestion (bug_risk):** The restore condition has the same `pull_request` access risk and is hard to reason about with the negation.

To avoid undefined access and keep the logic easier to validate, consider reusing the guarded save condition and inverting it for restore, e.g.: 

```yaml
if: ${{ !(inputs.save == 'true' && (
  (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) ||
  (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-save-cache'))
)) }}
```

This keeps restore as the exact inverse of the guarded save condition while only evaluating `github.event.pull_request` for PR events.

Suggested implementation:

```
    - name: Cache Go Dependencies (save)
      if: inputs.save == 'true' && ((github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) || (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-save-cache')))
      uses: actions/cache@v5

```

```
    - name: Cache Go Dependencies (restore)
      if: ${{ !(inputs.save == 'true' && ((github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) || (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-save-cache')))) }}
      uses: actions/cache/restore@v5

```
</issue_to_address>