[aheritier]

Why

A main run took ~13–15 min and a PR run ~8–10 min. Per-step timings showed the time goes to compiling, not testing: every job recompiled the whole dependency tree because the Go build cache was effectively cold (see commit 2), and the image pipeline used 2× the runners it needed.

What (one commit each)

Runners are left as-is: on a public repo ubuntu-latest/windows-latest are already 4-core, and the org's larger runners are out of scope here.

1. Parallelize compile-only checks and image builds — check-plan-cross + test-wasm-providers move to a cross-compile-checks job; build-and-push-image no longer waits on tests (it pushes untagged digests only), the gate moves to the tag-publishing job.
2. Per-job warm Go cache — setup-go's built-in cache is keyed on go.sum alone, so one snapshot per OS was saved on 2026-08-31 and every job since logged Cache hit … not saving cache. New composite .github/actions/setup-go restores GOMODCACHE+GOCACHE keyed <os>-<job>-<go.sum>-<sha> with prefix fallback; saved on main only. Also drops the redundant go test ./e2e -run TestWasmProviderDependencies from CI (already covered by task test; cold it cost ~2 min to compile e2e).
3. One Build Cloud job per stage — Build Cloud compiles both platforms natively, so the per-platform matrices only doubled runners. Digests flow as job outputs, no artifacts; the two merge jobs collapse into publish-tags. cache-binary: false on buildx stops a ~40 MB cache write per PR branch.

Measured so far

PR run 34463832719 vs the last run on the previous layout (34458544304). Caches are not seeded yet (saves happen on main only), so every job here starts cold — this is the floor, not the target.

job	before	this PR	note
required checks green	8:15	~5:45
lint	3:08	4:10	cold module download until main seeds a cache
build-and-test	8:15	5:44	compile-only checks moved out
cross-compile-checks	(in build-and-test)	4:31	e2e trim; cold
windows-tests	7:52–9:49	10:36	Set up Go 2:19 → 0:23 (no stale 944 MB restore); Run tests 5:46 → 9:58 cold
license-check	1:01	1:19	cold
build-image	2 runners	1 runner, 1:07	both platforms in one Build Cloud job

After merge: the first main run seeds one cache per job; the next PR run is the real measurement (expected: build ~20 s, lint <1 min, cross-compile <1 min, Windows tests ~3–4 min). Windows cache size is the thing to check — if it lands well above 1 GB the restore eats into the gain.

Tradeoffs

• A failed test run leaves untagged digests on Hub (nothing user-visible moves; GC'd eventually).
• Each main run saves 5 caches (~0.5–1 GB each). The repo is at the 10 GB cap (503 caches, mostly per-PR buildx-dl-bin-*), so stale entries should be purged once this lands.
• Windows cache restore is slow (2+ min for ~1 GB); net gain expected but to be confirmed.

Follow-ups (repo settings, not in this PR)

• Add cross-compile-checks and windows-tests to the main ruleset's required checks (currently only build-and-test, license-check, lint).
• Purge stale caches: gh cache list --limit 500 --json id,key --jq '.[] | select(.key|test("^(buildx-dl-bin|setup-go-)")) | .id' | xargs -n1 gh cache delete

🤖 Generated with Claude Code