ci: fix broken Go cache and drop redundant protoc install (#4926)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-17 19:51:11 +00:00
parent fa1d2a220c
commit 43aa003a1b
6 changed files with 167 additions and 205 deletions
@@ -0,0 +1,138 @@
+name: Tests
+
+# Shared by test.yml (push/PR) and deploy.yml (tags). These jobs used to be
+# copy-pasted between the two, which is how the go-test cache bug survived in
+# one copy after being noticed in the other.
+
+on:
+  workflow_call:
+    inputs:
+      release-certs:
+        description: Use the long-lived TTL certs from secrets instead of generating throwaway ones. Tag builds only.
+        type: boolean
+        default: false
+      skip-staticcheck:
+        description: Skip staticcheck. Tag builds set this so a lint failure cannot block a release, matching what deploy.yml gated on before these jobs were shared.
+        type: boolean
+        default: false
+    secrets:
+      TTL_KEY:
+        required: false
+      TTL_CERT:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  npm-test:
+    name: JavaScript Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        name: Install Node
+        with:
+          node-version: latest
+      - run: npm install --global corepack@latest
+      - run: corepack enable
+      - run: pnpm --version
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: latest
+          cache: "pnpm"
+          cache-dependency-path: "**/pnpm-lock.yaml"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline
+      - name: Run Typecheck
+        run: pnpm run typecheck
+      # Runs even when typecheck fails, so one job still reports both signals
+      - name: Run Tests
+        if: ${{ !cancelled() }}
+        run: pnpm run test -- --outputTruncateLength=500
+
+  go-test:
+    name: Go Tests
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout must come first so setup-go can key its module/build cache on go.sum
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.26.6"
+          check-latest: true
+      - name: Run Go Tests with Coverage
+        run: make test-ci
+
+  staticcheck:
+    name: Go Staticcheck
+    runs-on: ubuntu-latest
+    if: ${{ !inputs.skip-staticcheck }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.26.6"
+          check-latest: true
+          # This job shares a cache key with go-test (go version + go.sum hash) and
+          # setup-go only writes on a miss. Staticcheck is much faster, so it always
+          # won the race to populate, and its build cache has no -race artifacts in
+          # it, which made the restore worthless for go-test. Let go-test own the key.
+          cache: false
+      - name: Generate dependencies
+        run: make fake_assets shared_key.pem shared_cert.pem
+      - name: Stactic checker
+        uses: dominikh/staticcheck-action@9716614d4101e79b4340dd97b10e54d68234e431 # v1.4.1
+        with:
+          install-go: false
+
+  int-test:
+    name: Integration Tests
+    timeout-minutes: 60
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        name: Install Node
+        with:
+          node-version: latest
+      - run: npm install --global corepack@latest
+      - run: corepack enable
+      - run: pnpm --version
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: latest
+          cache: "pnpm"
+          cache-dependency-path: "**/pnpm-lock.yaml"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --prefer-offline
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Generate certs
+        if: ${{ !inputs.release-certs }}
+        run: make shared_key.pem shared_cert.pem
+      - name: Writing certs to file
+        if: ${{ inputs.release-certs }}
+        run: |
+          echo "${{ secrets.TTL_KEY }}" > shared_key.pem
+          echo "${{ secrets.TTL_CERT }}" > shared_cert.pem
+      - name: Build
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        with:
+          source: .
+          load: true
+          set: |
+            *.cache-from=type=gha
+            *.cache-to=type=gha,mode=max
+      - name: Run Playwright tests
+        run: docker compose up --exit-code-from playwright
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 30
@@ -8,90 +8,16 @@ permissions:
  contents: read

 jobs:
-  npm-test:
-    name: JavaScript Tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        name: Install Node
-        with:
-          node-version: latest
-      - run: npm install --global corepack@latest
-      - run: corepack enable
-      - run: pnpm --version
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: latest
-          cache: "pnpm"
-          cache-dependency-path: "**/pnpm-lock.yaml"
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --prefer-offline
-      - name: Run Tests
-        run: pnpm run test -- --outputTruncateLength=500
-  go-test:
-    name: Go Tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: 1.26.6
-          check-latest: true
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Protoc
-        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
-      - name: Install gRPC and Go
-        run: |
-          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
-          go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
-      - name: Run Go Tests with Coverage
-        run: make test
-  int-test:
-    name: Integration Tests
-    timeout-minutes: 60
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        name: Install Node
-        with:
-          node-version: latest
-      - run: npm install --global corepack@latest
-      - run: corepack enable
-      - run: pnpm --version
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: latest
-          cache: "pnpm"
-          cache-dependency-path: "**/pnpm-lock.yaml"
-      - name: Install dependencies
-        run: pnpm install
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - name: Writing certs to file
-        run: |
-          echo "${{ secrets.TTL_KEY }}" > shared_key.pem
-          echo "${{ secrets.TTL_CERT }}" > shared_cert.pem
-      - name: Build
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
-        with:
-          source: .
-          load: true
-          set: |
-            *.cache-from=type=gha
-            *.cache-to=type=gha,mode=max
-      - name: Run Playwright tests
-        run: docker compose up --exit-code-from playwright
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: always()
-        with:
-          name: playwright-report
-          path: playwright-report/
-          retention-days: 30
+  test:
+    uses: ./.github/workflows/_tests.yml
+    with:
+      release-certs: true
+      skip-staticcheck: true
+    secrets:
+      TTL_KEY: ${{ secrets.TTL_KEY }}
+      TTL_CERT: ${{ secrets.TTL_CERT }}
  buildx:
-    needs: [go-test, npm-test, int-test]
+    needs: [test]
    name: Release
    runs-on: ubuntu-latest
    permissions:
@@ -11,6 +11,10 @@ permissions:
  contents: read
  packages: write

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
  buildx:
    name: Push branches and PRs
@@ -42,7 +42,7 @@ jobs:
      - name: Setup Pages
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
      - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile --prefer-offline
      - name: Build with VitePress
        run: |
          pnpm docs:build
@@ -10,124 +10,10 @@ name: Test
 permissions:
  contents: read

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
-  typecheck:
-    name: Typecheck
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        name: Install Node
-        with:
-          node-version: latest
-      - run: npm install --global corepack@latest
-      - run: corepack enable
-      - run: pnpm --version
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: latest
-          cache: "pnpm"
-          cache-dependency-path: "**/pnpm-lock.yaml"
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --prefer-offline
-      - name: Run Typecheck
-        run: pnpm run typecheck
-  npm-test:
-    name: JavaScript Tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        name: Install Node
-        with:
-          node-version: latest
-      - run: npm install --global corepack@latest
-      - run: corepack enable
-      - run: pnpm --version
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: latest
-          cache: "pnpm"
-          cache-dependency-path: "**/pnpm-lock.yaml"
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --prefer-offline
-      - name: Run Tests
-        run: pnpm run test -- --outputTruncateLength=500
-  go-test:
-    name: Go Tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: "1.26.6"
-          check-latest: true
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Protoc
-        uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Install gRPC and Go
-        run: |
-          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
-          go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
-      - name: Run Go Tests with Coverage
-        run: make test
-  staticcheck:
-    runs-on: ubuntu-latest
-    name: Go Staticcheck
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: "1.26.6"
-          check-latest: true
-      - name: Generate dependencies
-        run: make fake_assets shared_key.pem shared_cert.pem
-      - name: Stactic checker
-        uses: dominikh/staticcheck-action@9716614d4101e79b4340dd97b10e54d68234e431 # v1.4.1
-        with:
-          install-go: false
-  int-test:
-    name: Integration Tests
-    timeout-minutes: 60
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        name: Install Node
-        with:
-          node-version: latest
-      - run: npm install --global corepack@latest
-      - run: corepack enable
-      - run: pnpm --version
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: latest
-          cache: "pnpm"
-          cache-dependency-path: "**/pnpm-lock.yaml"
-      - name: Install dependencies
-        run: pnpm install
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - name: Generate certs
-        run: make shared_key.pem shared_cert.pem
-      - name: Build
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
-        with:
-          source: .
-          load: true
-          set: |
-            *.cache-from=type=gha
-            *.cache-to=type=gha,mode=max
-      - name: Run Playwright tests
-        run: docker compose up --exit-code-from playwright
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: always()
-        with:
-          name: playwright-report
-          path: playwright-report/
-          retention-days: 30
+  test:
+    uses: ./.github/workflows/_tests.yml
@@ -17,9 +17,17 @@ fake_assets:
 	@mkdir -p dist
 	@echo "assets build was skipped" > dist/index.html

+GO_TEST := go test -cover -race -count 1 -timeout 40s ./...
+
 .PHONY: test
 test: fake_assets generate
-	go test -cover -race -count 1 -timeout 40s ./...
+	$(GO_TEST)
+
+# Same as test, but skips `go generate`. All generated code is committed, so CI
+# does not need protoc installed just to reproduce identical output.
+.PHONY: test-ci
+test-ci: fake_assets shared_key.pem shared_cert.pem
+	$(GO_TEST)

 .PHONY: test-update
 test-update: fake_assets generate