fix: cache Go module dir to prevent re-downloads

[aryeko]

Summary

• Add ~/go/pkg/mod to the CI tools cache path
• This persists downloaded Go modules across CI runs
• Prevents unnecessary re-downloads of tool dependencies on every action run

Problem

The current cache configuration only cached ~/go/bin (tool binaries) but not ~/go/pkg/mod (Go module cache). This meant that even when binaries were cached, go install had to re-download all tool dependencies from scratch on every run because the module cache wasn't persisted.

Solution

Include ~/go/pkg/mod in the cache path alongside ~/go/bin and ~/.cache/golangci-lint. This ensures that:

1. Tool binaries are cached (already working)
2. Downloaded Go modules are cached (new)
3. Tools can be installed near-instantly when cache hits

Test plan

• Run CI and verify cache hits on subsequent runs
• Verify "Install tools" step completes faster

Made with Cursor

Summary by CodeRabbit

• Chores
  • CI workflows updated to newer workflow tool versions for consistency across quality, test, code scanning, and release runs.
  • Simplified caching to a broad dependency-sum pattern ("**/*.sum") and removed the dedicated tools-binaries cache step (commented placeholder kept).
  • Quality, test, and release pipelines retain existing install/lint/vuln/test-coverage steps with aligned checkout/setup behavior.

[coderabbitai]

Warning

Rate limit exceeded

@aryeko has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 1 minutes and 57 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📝 Walkthrough

Walkthrough

Upgrade GitHub Actions versions across workflows and simplify caching: checkout/setup-go bumped (v4→v6, v5→v6), CI cache patterns generalized to "**/*.sum", and a dedicated "Cache Tools Binaries" step removed (placeholder commented); job steps otherwise unchanged.

Changes

Cohort / File(s)	Summary
CI workflow .github/workflows/ci.yml	Bumped actions/checkout and actions/setup-go versions (v5→v6) in quality and test jobs; replaced explicit per-run cache entries with a simplified **/*.sum dependency-path; removed the dedicated "Cache Tools Binaries" step and left a commented placeholder for a combined cache.
CodeQL workflow .github/workflows/codeql.yml	Upgraded CodeQL and checkout actions (actions/checkout v4→v6, github/codeql-action/* v3→v4). Steps/flow unchanged.
Release workflow .github/workflows/release.yml	Updated actions/checkout@v5 → actions/checkout@v6 while preserving fetch-depth: 0; no other logic changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 I nudged the workflows, hopped from v5 to v6,

Searched for caches and trimmed a few tricks.
Sums now blanket paths, tidy and neat,
CI carrots stacked, ready to eat,
Hooray — small hops make the pipeline quick! 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description covers the summary, problem, and solution clearly, but does not follow the repository's template structure with Type, Changes list, Breaking Changes, Validation commands, and Checklist sections.	Restructure the description to match the template: add Type checkbox, convert narrative to Changes bullet list, include Breaking Changes section, add Validation commands, and complete the Checklist with actual status.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change—caching Go modules to prevent re-downloads—which aligns with the PR's primary objective of optimizing CI by persisting the Go module cache directory.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/improve-ci-cache

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/ci.yml (1)

33-44: ⚠️ Potential issue | 🟠 Major

Remove ~/go/pkg/mod from the tools cache to avoid conflicts with setup-go's module caching.

The actions/setup-go@v5 action at lines 13-19 already caches ~/go/pkg/mod with cache-dependency-path: | **/go.sum go.work.sum. Adding the same path to the tools cache creates redundant caching with incompatible cache keys:

• setup-go invalidates on changes to **/go.sum or go.work.sum (all modules in workspace)
• tools cache invalidates only on changes to tools/tools.go or go.sum (root only)

The tools cache's narrower key means it won't invalidate when submodule or workspace dependencies change, risking stale modules being restored over the fresher setup-go cache. The actions/setup-go action already handles module caching comprehensively; the tools cache should only manage ~/go/bin and ~/.cache/golangci-lint.

Recommended fix

       - name: Cache Tools Binaries
         uses: actions/cache@v4
         with:
           path: |
             ~/go/bin
-            ~/go/pkg/mod
             ~/.cache/golangci-lint
           # Key depends ONLY on tools/tools.go and the root go.sum (where tools versions are pinned)
           # This prevents tool rebuilds when app dependencies change

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @.github/workflows/ci.yml:
- Around line 30-41: The cache key currently hashes both 'tools/tools.go' and
'go.sum' (key: ${{ runner.os }}-tools-${{ hashFiles('tools/tools.go', 'go.sum')
}}), which contradicts the "tools-only" claim; either remove 'go.sum' from the
hashFiles so the key is tools-only (e.g., hash only 'tools/tools.go') or update
the surrounding comment to state that app dependency changes (from go.sum) will
invalidate the cache; update the 'key' entry and/or the comment accordingly to
make the behavior and documentation consistent.

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/ci.yml (1)

42-45: ⚠️ Potential issue | 🟡 Minor

Stale comment references non-existent cache.

The comment "With the cache above, this will be a near-instant no-op if binaries exist" references a cache step that is now commented out. Update or remove this comment to reflect the current state.

📝 Suggested fix

       - name: Install tools
-        # Use make tools to install versions pinned in go.mod/tools.go
-        # With the cache above, this will be a near-instant no-op if binaries exist
+        # Use make tools to install versions pinned in go.mod/tools.go
         run: make tools