Skip to content

feat(cgo): cache repository checkout to reduce GitHub API calls per run #48699

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 3 commits into from
Jul 28, 2026
+129 −32
Merged

feat(cgo): cache repository checkout to reduce GitHub API calls per run #48699

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cc84379
chore: plan checkout cache for cgo.yml jobs
Copilot Jul 28, 2026
da8a066
feat: cache checkout in cgo.yml to reduce GitHub API calls
Copilot Jul 28, 2026
7bd80a0
Merge branch 'main' into copilot/update-cgo-yml-cache-jobs
pelikhan Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
161 changes: 129 additions & 32 deletions .github/workflows/cgo.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,24 @@ on:
- 'install-gh-aw.sh'
workflow_dispatch:
jobs:
checkout-cache:

@github-actions github-actions Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/codebase-design] The checkout-cache job has no concurrency group, while all other jobs in this workflow do. If multiple commits are pushed in quick succession, multiple checkout-cache jobs will run in parallel and write duplicate cache entries for the same SHA — wasting compute and cache storage quota.

💡 Suggested fix 
checkout-cache:
  runs-on: ubuntu-latest
  concurrency:
    group: ci-${{ github.ref }}-checkout-cache
    cancel-in-progress: true
  timeout-minutes: 5

@copilot please address this.

runs-on: ubuntu-latest
timeout-minutes: 5
permissions:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Cache repository checkout
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .

@github-actions github-actions Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/codebase-design] Caching path: . includes the .git directory, which can be hundreds of MB for a repository with history. Since no downstream job that uses this cache needs git history or git commands, excluding .git would make the cache leaner and faster to save/restore.

💡 Suggested fix 
- name: Cache repository checkout
  uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9   # v6.1.0
  with:
    path: |
      .
      !.git
    key: checkout-${{ github.sha }}

Apply the same exclusion to all cache/restore steps. This can meaningfully reduce cache I/O for large repositories.

@copilot please address this.

@github-actions github-actions Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential issue: path: . caches the .git directory

Caching path: . includes the .git directory. For repos with non-trivial history, this can make the cache artifact unexpectedly large and slow to upload/restore, potentially negating the I/O savings from skipping actions/checkout.

Consider excluding .git:

path: |
  .
  !.git

actions/cache supports exclude patterns with ! prefixes. Since none of the downstream restore jobs rely on git history (they already skip jobs that need fetch-depth: 0), the .git directory in the cache is unused weight.

@copilot please address this.

@github-actions github-actions Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caching path: . stores the entire working tree (including .git history) instead of just checked-out source, needlessly inflating usage of the shared 10GB per-repo actions/cache quota.

💡 Details

A plain actions/checkout (with default shallow clone) is typically much smaller than the full working directory tree cached here. With ~16 jobs restoring this cache every run, and other jobs also depending on Go module/npm caches sharing the same repo-wide quota, this checkout cache risks evicting more valuable dependency caches as the repo grows.

Consider excluding .git from the cached path (e.g. git archive the tracked files instead) and monitor cache eviction/usage after rollout.

key: checkout-${{ github.sha }}

@pelikhan pelikhan Jul 28, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot default retention 1 day


verify-integration-build:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
Expand All @@ -48,8 +65,12 @@ jobs:
group: ci-${{ github.ref }}-verify-integration-build
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

@github-actions github-actions Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/codebase-design] fail-on-cache-miss: true with no fallback means all 16 downstream jobs fail hard if the cache is evicted (GitHub evicts after 7 days or at 10 GB). Authors see a cryptic "Cache not found" error with no self-healing path.

💡 Suggested fix

Add a checkout fallback step after the restore in each consumer job:

- name: Restore checkout
  id: restore-checkout
  uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9   # v6.1.0
  with:
    path: .
    key: checkout-${{ github.sha }}
- name: Checkout (cache-miss fallback)
  if: steps.restore-checkout.outputs.cache-hit != 'true'
  uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
  with:
    persist-credentials: false

This preserves the optimisation on warm cache while making the workflow resilient to cold starts.

@copilot please address this.


- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -118,6 +139,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
needs:
- checkout-cache
- verify-integration-build
permissions:
contents: read
Expand All @@ -141,8 +163,12 @@ jobs:
group: ci-${{ github.ref }}-test-${{ matrix.shard }}
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -285,13 +311,18 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
needs:
- checkout-cache
- test

@github-actions github-actions Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

canary-go gates on needs.test.result == 'success' but not on checkout-cache's result, so if the cache save failed upstream the job still runs and hard-fails at fail-on-cache-miss: true instead of skipping cleanly.

💡 Details

This pattern repeats for every job using if: always()/conditional needs.*.result checks combined with needs: [checkout-cache, ...] (e.g. notify-failure at the bottom of the file). Since checkout-cache's own result isn't checked in the if: condition, a checkout-cache failure surfaces as an opaque "cache miss" error in every downstream job rather than a clear "upstream checkout-cache failed" signal, making CI failures harder to triage.

Consider adding && needs.checkout-cache.result == 'success' to these conditional jobs, or fail-on-cache-miss: false plus an explicit early exit step when the cache is missing.

if: always() && needs.test.result == 'success' # Skip coverage check for cancelled/failed test runs
permissions:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: List unit tests in codebase
run: |
Expand Down Expand Up @@ -372,6 +403,7 @@ jobs:
run: make test-impacted-go BASE_REF=origin/main CI_COVERAGE_SOURCE_BRANCH=main

build:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
Expand All @@ -380,8 +412,12 @@ jobs:
group: ci-${{ github.ref }}-build
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true
- name: Set up Node.js
id: setup-node
uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
Expand Down Expand Up @@ -460,6 +496,7 @@ jobs:
GH_TOKEN: ${{ github.token }}

build-wasm:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
Expand All @@ -468,8 +505,12 @@ jobs:
group: ci-${{ github.ref }}-build-wasm
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -555,13 +596,18 @@ jobs:
run: node scripts/test-wasm-golden.mjs

validate-yaml:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Check for ANSI escape sequences in YAML files
run: |
Expand Down Expand Up @@ -1008,6 +1054,7 @@ jobs:
bench:
# Only run benchmarks on main branch for performance tracking
if: github.ref == 'refs/heads/main'
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
Expand All @@ -1017,8 +1064,12 @@ jobs:
group: ci-${{ github.ref }}-bench
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -1171,15 +1222,20 @@ jobs:

check-validator-sizes:
name: Check validator file sizes
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 10
# Non-blocking: report violations but don't fail the build until existing files are cleaned up
continue-on-error: true
permissions:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Check validator file sizes
id: check
Expand Down Expand Up @@ -1313,6 +1369,7 @@ jobs:
run: make lint-action-sh

lint-error-messages:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
Expand All @@ -1321,8 +1378,12 @@ jobs:
group: ci-${{ github.ref }}-lint-error-messages
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
Expand All @@ -1335,6 +1396,7 @@ jobs:
run: make lint-errors

actions-build:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
Expand All @@ -1343,8 +1405,12 @@ jobs:
group: ci-${{ github.ref }}-actions-build
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -1397,6 +1463,7 @@ jobs:
fuzz:
# Only run fuzz tests on main branch (10s is insufficient for PRs)
if: github.ref == 'refs/heads/main'
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
Expand Down Expand Up @@ -1441,8 +1508,12 @@ jobs:
FuzzParseInputDefinition:./pkg/workflow/
FuzzParseInputDefinitions:./pkg/workflow/
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -1564,6 +1635,7 @@ jobs:
retention-days: 7

security:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
Expand All @@ -1572,8 +1644,12 @@ jobs:
group: ci-${{ github.ref }}-security
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -1623,6 +1699,7 @@ jobs:
security-scan:
# Only run security scans on main branch to reduce PR overhead
if: github.ref == 'refs/heads/main'
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 10 # Prevent jobs from hanging indefinitely
permissions:
Expand All @@ -1644,8 +1721,12 @@ jobs:
cancel-in-progress: true
name: "Security Scan: ${{ matrix.tool.name }}"
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -1693,6 +1774,7 @@ jobs:
run: ./gh-aw compile poem-bot ${{ matrix.tool.flag }} --verbose

mcp-server-compile-test:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
Expand All @@ -1701,8 +1783,12 @@ jobs:
group: ci-${{ github.ref }}-mcp-server-compile-test
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -2250,6 +2336,7 @@ jobs:

alpine-container-test:
name: Alpine Container Test
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
Expand All @@ -2258,8 +2345,12 @@ jobs:
group: ci-${{ github.ref }}-alpine-container
cancel-in-progress: true
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Set up Go
id: setup-go
Expand Down Expand Up @@ -2386,13 +2477,18 @@ jobs:
rm -rf test-workspace

safe-outputs-conformance:
needs: [checkout-cache]
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Restore checkout
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .
key: checkout-${{ github.sha }}
fail-on-cache-miss: true

- name: Run Safe Outputs Conformance Checker
id: conformance
Expand Down Expand Up @@ -2443,6 +2539,7 @@ jobs:
timeout-minutes: 5
if: always() && github.ref == 'refs/heads/main'
needs:
- checkout-cache
- verify-integration-build
- test
- canary-go
Expand Down
Loading