ci: speed up SCA dependency checks with shared module cache

[XuPeng-SH]

Summary

• configure the Shanghai GOPROXY for all SCA steps only when the selected runner is the default or has a Shanghai label
• use pipe-separated GOPROXY fallback so DNS, connection, and 5xx failures can fall through
• restore the shared MatrixOne Go module cache with the restore-only cache action
• keep pull_request_target runs unable to save or overwrite shared caches

Cache lifecycle

The cache belongs to the calling matrixorigin/matrixone repository, not this reusable-workflow repository.

• trusted producer: ci: warm shared Go module cache for SCA matrixone#27128 runs on main push, schedule, or workflow_dispatch
• PR consumer: this reusable workflow restores only
• exact key: OS, architecture, Go version, and go.mod/go.sum hash
• dependency-changing PRs restore the latest same-platform/main cache through restore-keys and download only the delta
• after the dependency change merges, the trusted producer writes the new exact main cache

Producer and consumer use the same relative staging path and key algorithm. The relative path keeps both the actions/cache hidden version and archive entries portable across runner layouts. The consumer moves the restored module cache into RUNNER_TEMP before static checks so license-eye does not enumerate cached dependency sources.

Why

A recent MatrixOne SCA run spent about 85 minutes in make static-check, including 64m16s in license-eye dep check. That check repeats Go module downloads. The previous GOPROXY was scoped only to Prepare ENV and no cross-PR MatrixOne main cache existed.

With an existing module cache, license-eye dep check completes in about 0.6 seconds. No SCA validation is skipped.

Validation

• YAML syntax parsed successfully
• actionlint reports only the two unchanged findings already present on main
• producer/consumer path, key, and restore prefix match mechanically
• cache cleanup and relocation lifecycle simulated successfully
• git diff --check passed

Related producer: matrixorigin/matrixone#27128

[loveRhythm1990]

The job-wide GOPROXY change is directionally sound, but the cache additions currently have no writable producer in the MatrixOne repository context. Please address the blocking cache lifecycle issue before merging. I also left a scope comment for non-Shanghai SCA runner overrides.

[aptend]

Deep re-review completed on exact head f41f24e, including the prior inline discussions and the paired MatrixOne producer PR #27128.

The two earlier concerns are resolved: the cluster-local GOPROXY is now installed only for the default or Shanghai-labelled runner, and the pull_request_target consumer uses actions/cache/restore only, with no post-job save path. The producer and consumer use the same MatrixOne-owned GOMODCACHE path and the same OS/architecture/Go-version/dependency-hash key plus compatible restore prefix. Dependency-changing PRs can safely restore a trusted main-prefix cache and download only the delta without being able to overwrite shared cache state.

I also checked the setup ordering, fallback semantics, cache ownership/scope, key compatibility, workflow diff, and validation result. No blocking correctness, security, or lifecycle issue remains. The performance benefit depends on landing the trusted producer in matrixorigin/matrixone#27128, but that is an ordering dependency rather than a defect in this restore-only consumer.

[XuPeng-SH]

Deep re-review found and fixed one additional cross-runner cache portability issue in a157b07.

actions/cache includes the raw path in its hidden cache version and stores archive entries relative to the workspace. Using an absolute go env GOMODCACHE meant producer and consumer could have the same visible key but still miss (or restore to the wrong layout) when their runner HOME/workspace paths differed.

The cache now:

• uses the identical relative staging path .sca-go-module-cache on both sides;
• clears stale self-hosted-runner state before restore;
• moves the restored consumer cache into RUNNER_TEMP before make static-check, so license-eye does not enumerate cached dependency sources;
• remains restore-only in the pull_request_target consumer.

Local validation: producer/consumer path+key+prefix equality check passed, cache cleanup/relocation lifecycle simulation passed, diff check passed, and actionlint reports only the two unchanged baseline findings in ci.yaml.