fix(ci): stop every CI run from building with an empty Go cache (#1972)

Every job in the Go workflow shared one Go cache key. The guardrail job
compiles nothing and finishes first, so it saved a ~9 KB entry under that
key. The test and lint jobs then got an exact hit on it, and actions/cache
does not save on an exact hit, so their builds were never stored and every
run compiled from scratch.

Make the cache opt-in through a cache-key input on the Setup action, and
give each test and lint job its own value. Jobs that pass none, including
guardrail, nightly and apidiff, run without a cache, which is what they
effectively had.

Co-authored-by: Jan Wojtas <56300703+wojtas000@users.noreply.github.com>

.github/actions/setup/action.yml

@@ -1,6 +1,16 @@
 name: Setup
 description: Setup the environment
 
+inputs:
+  cache-key:
+    description: >-
+      Restores and saves the Go build and module cache under a key that
+      includes this value. When empty, the job gets no cache. Jobs that write
+      different build output need different values: actions/cache skips saving
+      on an exact key hit, so jobs that share a key all reuse whichever entry
+      was saved first.
+    default: ''
+
 outputs:
   go-version:
     description: 'Go version'
@@ -17,6 +27,7 @@ runs:
         cache: false # wrapper for actions/cache that doesn't support all functionality
 
     - name: Load Go cache
+      if: inputs.cache-key != ''
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: |
@@ -28,5 +39,8 @@ runs:
         # that read stdlib facts then work from stale data: staticcheck stops
         # seeing the runtime.Goexit behind t.Fatal and reports SA5011 nil
         # dereferences throughout the tests.
-        key: ${{ runner.os }}-go-${{ steps.setup-go.outputs.go-version }}-build-${{ hashFiles('**/go.mod', '**/go.sum') }}
-        restore-keys: ${{ runner.os }}-go-${{ steps.setup-go.outputs.go-version }}-build-
+        #
+        # The fixed "-build-" after cache-key keeps one job's restore prefix
+        # from matching another job whose cache-key starts with the same text.
+        key: ${{ runner.os }}-go-${{ steps.setup-go.outputs.go-version }}-${{ inputs.cache-key }}-build-${{ hashFiles('**/go.mod', '**/go.sum') }}
+        restore-keys: ${{ runner.os }}-go-${{ steps.setup-go.outputs.go-version }}-${{ inputs.cache-key }}-build-

.github/workflows/go.yml

@@ -51,6 +51,8 @@ jobs:
     
     - name: Setup
       uses: ./.github/actions/setup
+      with:
+        cache-key: ${{ github.job }}-${{ matrix.module }}
 
     - name: Initialize workspace
       run: go work init && go work use -r .
@@ -79,6 +81,8 @@ jobs:
     
     - name: Setup
       uses: ./.github/actions/setup
+      with:
+        cache-key: ${{ github.job }}-${{ matrix.module }}
 
     - name: Initialize workspace
       run: go work init && go work use -r .