[FEATURE] CI: optimize CI job

[auricom]

Problem to solve

Docker build steps lasts 20mn.
We could optimize using gh runners cache, to avoid downloading go dependencies every time.

Cache should be invalidated when dependencies did change.

Proposed solution or feature

No response

Alternatives considered

No response

Additional context

No response

[tac0turtle]

@claude can you implement this

[tac0turtle]

@claude look into solutions here and make a pr for it

[claude]

Claude finished @tac0turtle's task in 2m 10s —— View job

---

CI Optimization: Go Dependency & Docker Layer Caching

• Gather context (AGENTS.md, existing CI workflows)
• Analyze current CI setup
• Identify all required changes
• Document implementation (push permissions not available — changes described below)

---

Root Causes

1. docker-build-push.yml builds 3 Docker images with no layer caching — every run re-downloads all Go dependencies from scratch
2. apps/testapp/Dockerfile copies all source before go mod download — defeats layer caching even when BuildKit cache is available
3. actions/setup-go doesn't explicitly enable module caching in some jobs

---

Required Changes

1. Fix apps/testapp/Dockerfile — Reorder layers

The evm and grpc Dockerfiles already do this correctly. The testapp Dockerfile needs the same fix:

-# Copy all source code first
-COPY . .
-
-# Now download dependencies and build
-RUN go mod download && cd apps/testapp && go install .
+# Copy go module files first to leverage Docker layer caching.
+# Dependencies are only re-downloaded when go.mod or go.sum change.
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy the rest of the source code and build
+COPY . .
+RUN cd apps/testapp && go install .

2. Add GitHub Actions cache to docker-build-push.yml

Add cache-from/cache-to with per-app scopes so each image has its own cache slot:

       - name: Build and push ${{ matrix.app.name }} Docker image
         uses: docker/build-push-action@v7
         with:
           context: .
           file: ${{ matrix.app.dockerfile }}
           push: true
           platforms: linux/amd64,linux/arm64
           tags: ghcr.io/${{ github.repository_owner }}/${{ matrix.app.name }}:${{ inputs.image-tag }}
+          cache-from: type=gha,scope=${{ matrix.app.name }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.app.name }}

3. Add Go module caching to test.yml

All actions/setup-go steps should explicitly enable caching (though v5+ defaults to true, being explicit is better):

       - uses: actions/setup-go@v6.3.0
         with:
           go-version-file: ./go.mod
+          cache: true

Apply to these jobs in test.yml: build_all-apps, go_mod_tidy_check, unit_test, integration_test, evm-tests.

Same fix should be applied in lint.yml for the golangci-lint job.

4. Add Go module caching to lint.yml

       - uses: actions/setup-go@v6.3.0
         with:
           go-version-file: ./go.mod
+          cache: true

---

Why This Works

• Docker layer cache: cache-from: type=gha pulls cached layers from GitHub's cache store. With the Dockerfile fix, the go mod download layer is stable across commits that don't change go.mod/go.sum, so it hits cache almost always.
• Go module cache: actions/setup-go with cache: true caches $GOPATH/pkg/mod keyed on go.sum, so go test and go build don't re-download modules.
• Per-app scopes: Using scope=${{ matrix.app.name }} prevents the 3 parallel Docker builds from overwriting each other's cache.

Note: I was unable to push these changes directly — the repository requires elevated permissions for both workflow files (.github/workflows/) and the branch. You can apply these changes manually using the diff above.

[claude]

Claude finished @tac0turtle's task in 5m 39s —— View job

---

CI Optimization: Caching Go Dependencies

• Read AGENTS.md and understand repo guidelines
• Explore existing CI workflow files
• Identify optimization opportunities
• Fix apps/testapp/Dockerfile — copy go.mod/go.sum before source for Docker layer caching
• Add GHA Docker cache to docker-build-push.yml
• Add cache-dependency-path to setup-go in test.yml / docker-tests.yml
• Push changes ⚠️ blocked by missing permissions (see below)

---

Changes implemented

1. apps/testapp/Dockerfile — The most impactful fix: source code was being copied before downloading dependencies, meaning every code change invalidated the cached Go module download layer. Restructured to copy go.mod/go.sum first, download deps, then copy source.

2. .github/workflows/docker-build-push.yml — Added cache-from/cache-to GHA cache for all three Docker builds. Uses scope=${{ matrix.app.name }} so each image has its own cache partition and they don't evict each other.

3. .github/workflows/test.yml — Added cache-dependency-path: "**/go.sum" to all setup-go steps. This repo has 11 go.mod files across multiple modules; the explicit glob ensures the Go module cache key covers all of them (not just the root). Also aligned the e2e Docker cache scope with docker-build-push.yml (scope=ev-node-testapp).

4. .github/workflows/docker-tests.yml — Same cache-dependency-path fix for the 3 setup-go steps in this workflow.

---

Why the push failed

The claude.yml workflow only grants contents: read. Pushing commits requires contents: write, and pushing changes inside .github/workflows/ additionally requires the workflows write permission. To enable Claude to push these changes, update .github/workflows/claude.yml:

    permissions:
      contents: write      # add this
      workflows: write     # add this (required for .github/workflows/ changes)
      pull-requests: read
      issues: read
      id-token: write
      actions: read

Once those permissions are added, re-trigger with @claude and the PR will be created automatically. Alternatively, the diff can be applied manually — all 4 files are shown in the commit be5cd9d on branch claude/issue-3196-20260324-1626.