feat(setup-go): release-cache — a release-scoped Go cache for goreleaser jobs

README.md

@@ -28,7 +28,7 @@ Why `.github` and not a dedicated `github-actions` repo: `.github` is *the* GitH
 | `setup-python-uv` | Install uv + a pinned Python version + (default-on) `uv sync`. |
 | `setup-node-pnpm` | corepack + setup-node@v4 with pnpm cache + (default-on) `pnpm install --frozen-lockfile`. Accepts a `pnpm-filter` input for workspace filtering. |
 | `setup-dotnet` | setup-dotnet@v5 with NuGet cache keyed on `**/*.csproj` + (default-off) `dotnet tool restore`. |
-| `setup-go` | setup-go@v6 reading version from `go.mod`. Optional `private-modules: true` mints a short-lived read-only `pinpredict-argocd` App token and configures git + `GOPRIVATE` so `go`/`golangci-lint`/`goreleaser` fetch a private pinpredict module (e.g. `github.com/pinpredict/ppkit`) without vendoring — the non-Docker analogue of `docker-release.yml`'s `private-modules` secret. Default false. |
+| `setup-go` | setup-go@v6 reading version from `go.mod`. Optional `private-modules: true` mints a short-lived read-only `pinpredict-argocd` App token and configures git + `GOPRIVATE` so `go`/`golangci-lint`/`goreleaser` fetch a private pinpredict module (e.g. `github.com/pinpredict/ppkit`) without vendoring — the non-Docker analogue of `docker-release.yml`'s `private-modules` secret. Default false. Optional `release-cache: true` (goreleaser jobs only) swaps the built-in cache for a release-scoped module+build cache with a `restore-keys` fallback, saved **after** goreleaser so it covers every cross-compiled GOOS/GOARCH target — the built-in cache is exact-match on `go.sum` and is usually saved by a CI test job whose build cache warms none of the release targets. Default false. |
 
 #### Language setup composites — usage
 

actions/setup-go/action.yml

@@ -16,11 +16,30 @@ description: |
   This is the non-Docker analogue of docker-release.yml's `private-modules`
   BuildKit secret. Default false — a no-op for every existing caller.
 
+  Optional `release-cache: true` swaps setup-go's built-in cache for a
+  release-scoped one (see the input description) — set it on goreleaser
+  jobs, leave it off everywhere else.
+
 inputs:
   go-version-file:
     description: "Path to go.mod (or any file with a `go` directive)."
     required: false
     default: "go.mod"
+  release-cache:
+    description: >-
+      When true, replace setup-go's built-in cache with a release-scoped
+      module + build cache. The built-in cache is wrong for goreleaser jobs
+      twice over: its key is exact-match on go.sum (any dependency bump means
+      a fully cold build), and its snapshot is saved by whichever job first
+      claims the key — usually a CI test job, whose GOCACHE holds only
+      host-platform test builds and warms none of the cross-compile targets.
+      The `go-release-` cache is namespaced away from CI, falls back on a
+      restore-keys prefix when go.sum changed, and — because the post step
+      saves it after goreleaser has built every GOOS/GOARCH target — the next
+      release restores a build cache that covers the full target matrix.
+      Default false (built-in cache, exactly as before).
+    required: false
+    default: "false"
   private-modules:
     description: >-
       When true, mint a read-only pinpredict-argocd App token from
@@ -51,6 +70,23 @@ runs:
       uses: actions/setup-go@v6
       with:
         go-version-file: ${{ inputs.go-version-file }}
+        # Under release-cache the explicit cache step below takes over.
+        cache: ${{ inputs.release-cache == 'true' && 'false' || 'true' }}
+
+    # Release-scoped Go cache (release-cache: true). go.mod is in the key so a
+    # toolchain bump also rolls the cache; restore-keys keeps a dependency
+    # bump warm instead of cold. Saved by the post step at job end — after
+    # goreleaser — so the snapshot carries every cross-compiled target.
+    - name: Restore release Go cache
+      if: ${{ inputs.release-cache == 'true' }}
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/go/pkg/mod
+          ~/.cache/go-build
+        key: go-release-${{ runner.os }}-${{ hashFiles('go.mod', 'go.sum') }}
+        restore-keys: |
+          go-release-${{ runner.os }}-
 
     # Opt-in (private-modules: true): mint a short-lived, read-only token for
     # the org-wide pinpredict-argocd App so `go mod download` / golangci /