CI: add Go module and npm caching to all workflows

[isaacschepp]

Summary

None of the 9 workflows use cache: true on actions/setup-go. Every run downloads all Go modules from scratch. Adding cache: true is a one-line change that saves 30-60 seconds per job.

Similarly, the validate-schemas job installs npm packages without caching. Add cache: 'npm' to actions/setup-node.

[isaacschepp]

Additional context from CI observation

The validate-schemas job on PR #581 shows this warning during Go cache restoration:

Cache hit for: setup-go-Linux-x64-ubuntu24-go-1.26.1-...
Cache Size: ~0 MB (7438 B)
Warning: Cache folder path is retrieved but doesn't exist on disk: /home/runner/go/pkg/mod

The Go module cache is effectively empty (7438 bytes). This means every CI run re-downloads all Go dependencies from scratch. The cache was likely saved from a run where go mod download hadn't executed yet.

Fix: Ensure the cache key includes go.sum and that go mod download runs before cache save. The actions/setup-go@v6 action handles caching automatically when cache: true is set (which it appears to be), but the cache population may need an explicit go mod download step before the first go test or go build.

[isaacschepp]

Implementation Plan

Current state

8 setup-go instances and 2 setup-node instances across 3 workflows — none have caching enabled. Every CI run downloads all Go modules and npm packages from scratch.

The fix

Add cache: true to all setup-go steps and cache: 'npm' with cache-dependency-path to all setup-node steps.

Changes per workflow

validate-spec.yml (3 Go + 1 Node):

validate-schemas job (line 19): add cache: true to setup-go. Add cache: 'npm' and cache-dependency-path: specification/package-lock.json to setup-node.

validate-examples job (line 41): add cache: true to setup-go.

test-conformance job (line 65): add cache: true to setup-go.

security.yml (2 Go + 1 Node):

govulncheck job (line 26): add cache: true to setup-go.

gosec job (line 53): add cache: true to setup-go.

npm-audit job (line 73): add cache: 'npm' and cache-dependency-path: website/package-lock.json to setup-node.

release.yml (1 Go):

release job (line 24): add cache: true to setup-go.

Example (validate-schemas job after fix)

- name: Set up Go
  uses: actions/setup-go@v6
  with:
    go-version: '1.26'
    cache: true

- name: Set up Node
  uses: actions/setup-node@v6
  with:
    node-version: '24'
    cache: 'npm'
    cache-dependency-path: specification/package-lock.json

How it works

Go caching (actions/setup-go docs):

• cache: true enables built-in caching of GOMODCACHE (~/go/pkg/mod) and GOCACHE (~/.cache/go-build)
• Cache key is automatically derived from go.sum hash
• First run populates the cache; subsequent runs restore it
• Expected savings: 10-30 seconds per job

npm caching (actions/setup-node docs):

• cache: 'npm' caches the global npm cache directory
• cache-dependency-path must point to the correct package-lock.json since this repo has two: website/ and specification/
• Expected savings: 5-15 seconds per job

Why cache-dependency-path is needed

The repo has npm packages in two directories:

• website/package-lock.json — VitePress site (used by npm-audit)
• specification/package-lock.json — Ajv schema validation (used by validate-schemas)

Without cache-dependency-path, setup-node looks for package-lock.json in the repo root (which doesn't exist) and the cache misses every time.

Total impact

Workflow	Jobs affected	Estimated savings per run
validate-spec	3 jobs (Go) + 1 job (Node)	~60-90 seconds
security	2 jobs (Go) + 1 job (Node)	~30-60 seconds
release	1 job (Go)	~10-30 seconds
Total	8 changes	~100-180 seconds per PR

Files to modify

File	Lines to change
.github/workflows/validate-spec.yml	Lines 19-21, 24-26, 41-43, 65-67
.github/workflows/security.yml	Lines 26-28, 53-55, 73-75
.github/workflows/release.yml	Lines 24-26

References

• actions/setup-go caching: https://github.com/actions/setup-go#caching-dependency-files
• actions/setup-node caching: https://github.com/actions/setup-node#caching-global-packages-data
• Go CI build time optimization: https://dev.to/siddhantkcode/how-we-slashed-ci-build-time-using-gos-cache-500f

[isaacschepp]

Cache still empty after PR #583

The cache: true flag is working (cache is being saved and restored) but the saved cache is only 7488 bytes — empty. The validate-schemas job doesn't run any Go commands, so GOMODCACHE is never populated. For jobs that do run Go, modules may not be flushed to GOMODCACHE before post-job cleanup runs.

Fix needed: Add an explicit go mod download step after setup-go in every job that uses Go. This ensures modules are in GOMODCACHE before the first build/test command and before cache save.

Will submit a follow-up PR.