ci: preserve Go build cache between Docker workflow runs

[AlexHardAtWork]

What

Part of #237.

Testing

Tested by multiple runs.

Checklist

• [-] Tests added/updated
• No breaking changes (or upgrade path documented above)
• Readable commit history (squashed and cleaned up as desired)
• AI code review considered and comments resolved

Summary by CodeRabbit

• Chores
  • Optimized Go build caching in Docker workflow for improved build performance and reduced build times.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 604df0c0-560e-45cc-b473-a8a8d174465b

📥 Commits

Reviewing files that changed from the base of the PR and between 2a82d72 and 9c2ce2a.

📒 Files selected for processing (2)

• .github/workflows/docker.yaml
• Dockerfile

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/workflows/docker.yaml
• Dockerfile

---

📝 Walkthrough

Walkthrough

The Dockerfile removes the explicit GOMODCACHE environment override and switches go mod download and go build stages to use BuildKit cache mounts at /go/pkg/mod and /root/.cache/go-build. The CI workflow gains a named Buildx step ID, adds an actions/cache step with image-aware scoping, incorporates buildkit-cache-dance to persist and restore those cache-mount contents between runs, and updates GHA cache configuration scoping.

Changes

BuildKit Go Module Cache Persistence

Layer / File(s)	Summary
Dockerfile BuildKit cache mount setup Dockerfile	Removes go env -w GOMODCACHE=..., adds BuildKit --mount=type=cache directives targeting /go/pkg/mod and /root/.cache/go-build in the go mod download step, and corrects the cross-compilation builder stages' cache mount path from /go/pkg to /go/pkg/mod.
CI workflow: Buildx ID and cache-dance wiring .github/workflows/docker.yaml	Assigns id: buildx to the "Set up Docker Buildx" step so its output name is referenceable; adds an actions/cache step keyed by image, go.sum, and github.sha; adds a buildkit-cache-dance step to inject/extract cache-mount contents; updates GHA cache scoping to reference the image name and PR vs trusted trust scope. Includes a minor trailing whitespace adjustment near the test-e2e job.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐇 Hoppity-hop, the cache is now stored,
BuildKit cache mounts have finally been explored!
/go/pkg/mod gets a warm cozy seat,
No more cold starts — each build is a treat.
The cache-dance is done, the bunny is pleased,
Faster Go builds, and the CI is eased! 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description is missing the 'Why' section and lacks detail in the 'Testing' section. The 'What' section only references an issue without explanation.	Expand the 'What' section with a brief explanation, add a 'Why' section explaining the motivation, and provide more specific testing details (e.g., which workflow runs, what was verified).

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding Go build cache preservation across Docker workflow runs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/preserve-go-build-cache

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/docker.yaml:
- Around line 101-110: The cache step in the Docker workflow can write cache
artifacts from untrusted PR runs, which could poison the cache consumed by
trusted builds. Modify the cache action configuration to restrict cache writes
to trusted events only by adding a mode parameter set to restore-only for PR
events and allowing full read-write mode only for trusted refs like push events
to main or release branches. Use conditional logic with github.event_name and
github.ref to control the cache mode accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5f5a603d-bb23-429e-80f6-396e61bde421

📥 Commits

Reviewing files that changed from the base of the PR and between 6663965 and 2a82d72.

📒 Files selected for processing (2)

• .github/workflows/docker.yaml
• Dockerfile