[chandarith-chea]

Why CI is red

Every Build and test run since 2026-11-13 13:48 UTC has failed on the Dockiva runner with errors like:

open /root/go/pkg/mod/golang.org/x/sync@v0.21.0/errgroup/errgroup.go: no such file or directory
wails/v3@v3.0.0-beta.19/pkg/application/application.go:24:12: pattern assets/*: no matching files found

• That run was the first to save the runner's Go module cache (setup-go-Linux-arm64-undefined-…). Earlier runs had no cache and downloaded modules each time.
• Go makes module cache directories read-only (0555). tar runs as root, so it creates each directory with that mode before its contents.
• Dockiva Engine (<= 0.6.10) refuses root's mkdir inside a read-only directory. Linux allows it. The restore step logged 16,827 Cannot mkdir: Permission denied / Cannot open lines and left a partial cache, which go trusts.

Repro on Dockiva 0.6.10:

docker run --rm ubuntu:24.04 sh -c 'mkdir -p /t/a && chmod 555 /t/a && mkdir /t/a/c'
# mkdir: cannot create directory '/t/a/c': Permission denied

Change

GOFLAGS=-modcacherw for the job, so the directories stay writable and the saved cache restores. The comment says to drop it once the engine is fixed.

The cache saved with read-only directories (id 10477291193) is deleted, because its key does not change with this PR.

Checks

• In a Dockiva container, a tar of a tree with writable directories restores in full; the same tree with 0555 directories loses the nested files, as in CI.
• With this repository's go.mod in a golang:1.26.3 container on Dockiva 0.6.10: go mod download under GOFLAGS=-modcacherw leaves 0 read-only directories out of 3,655; the archive (tar --posix -cf … -P) restores in a fresh container with 0 errors and all 14,603 files, and GOPROXY=off go mod verify reports all modules verified.
• This PR's own run starts from a cache miss, so it does not exercise the restore. The first run that does is the one after the next cache save.

The engine bug itself (root also cannot symlink, mkfifo or rmdir there) is not fixed here.