Prevent PureLock Go cache restore collisions

[Copilot]

PureLock failed before agent execution when setup-go attempted to extract a dependency cache over files already mounted by the cloud-hypervisor sandbox.

• Agent setup: Disable Go dependency-cache restoration only in the sandboxed agent job; retain caching for precomputation.
• Workflow artifact: Regenerate purelock.lock.yml from the updated workflow source.

- name: Setup Go
  uses: actions/setup-go@v7.0.0
  with:
    go-version-file: go.mod
    cache: false

• Fixes [aw] PureLock reported incomplete result #57936

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

No review comments were posted because this PR change is narrowly scoped and does not introduce a clear blocking issue in the changed lines.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

🧠 Matt Pocock Skills Reviewer was cancelled during the skills-based review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

⚠️ Security scanning failed for Ponytail Reviewer. Review the logs for details.

Lean already. Ship.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #57948

[Copilot]

🟢 Approval recommended

The targeted change matches the observed cache-extraction failure without weakening security controls.

Pull request overview

Prevents PureLock’s sandboxed agent job from restoring a Go cache over mounted files while retaining precomputation caching.

Changes:

• Disables setup-go caching only for the agent job.
• Regenerates the compiled workflow artifact.

File summaries

File	Description
.github/workflows/purelock.md	Disables conflicting agent cache restoration.
.github/workflows/purelock.lock.yml	Reflects the source workflow change.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Comment Memory

reviewed_at: 2026-09-02T13:38:27.957+00:00
review_event: COMMENT
top_themes:
  - overly broad workflow comment risks cargo-culting cache disablement
files_reviewed:
  - .github/workflows/purelock.lock.yml
  - .github/workflows/purelock.md
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 18.4 AIC · ⌖ 8.62 AIC · ⊞ 21.8K · ◷
_{Comment /review to run again}

[github-actions]

Blocking issues

This change looks narrowly scoped, but the comment explaining why cache: false is required is too broad: it attributes the failure to the sandbox mounting the runner's Go module cache, which only justifies disabling restore for this specific sandboxed agent path. If that explanation is wrong or later cargo-culted into other workflows, we'll silently throw away useful dependency caching in places that don't have this collision.

The workflow fix itself is probably fine, but the rationale needs to stay precise.

The diff only changes the post-precompute setup-go step in purelock, and that step runs under a very particular sandbox/runtime configuration. The new comment currently reads like a general setup-go rule rather than a PureLock-agent-specific constraint. That is maintainability debt in a workflow repo where people routinely copy/paste setup blocks.

Tighten the comment so it names the exact failing environment and why restore is unsafe there, for example that the cloud-hypervisor sandbox already exposes a populated module cache into the job filesystem, so setup-go's restore/extract phase collides with existing paths in this one job.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 18.4 AIC · ⌖ 8.62 AIC · ⊞ 21.8K
_{Comment /review to run again}

[gh-aw-bot]

@copilot Please resolve the merge conflicts on this branch by running make merge-main, then inspect the current PR state and run the pr-finisher skill before handing back to maintainers.

• Merge conflicts are currently blocking this PR.
• After the branch is conflict-free, please verify whether anything remains beyond maintainer review/CI follow-up.
• Current compact context shows no failed checks to prioritize beyond unblocking the branch.

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 29.3 AIC · ⌖ 8.78 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please resolve the merge conflicts on this branch by running make merge-main, then inspect the current PR state and run the pr-finisher skill before handing back to maintainers.

• Merge ...

Resolved the merge conflict with make merge-main, regenerated the workflow lockfile, and pushed merge commit c156748. Local formatting, lint, unit, full test, and recompile validation pass; remaining CI validation requires a maintainer re-trigger.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.88.2