CI Nits and Improvements

[jcjones]

All of these are courtesy of @endbr64.

Concurrency

All the run-on-each-PRs deserve a concurrency key to reduce resource usage on subsequent pushes:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

Cold Compilation

govulncheck gets cold-compiled on each run.

boulder/.github/workflows/boulder-ci.yml

Lines 118 to 139 in c5f1008

	govulncheck:
	runs-on: ubuntu-24.04
	strategy:
	fail-fast: false
	steps:
	# Checks out your repository under $GITHUB_WORKSPACE, so your job can access it
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- name: Setup Go
	uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
	with:
	# When Go produces a security release, we want govulncheck to run
	# against the most recently released Go version.
	check-latest: true
	go-version: "stable"
	cache: false
	- name: Run govulncheck
	run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

You might want to pull in actions/cache in some fashion:

# Gather the Go version for the cache key.
      - name: Record Go version
        id: go-version
        run: echo "version=$(go env GOVERSION)" >> "$GITHUB_OUTPUT"

      # Without this, every run downloads and compiles govulncheck's whole
      # dependency tree from scratch.
      - name: Cache govulncheck build
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: govulncheck-${{ runner.os }}-${{ steps.go-version.outputs.version }}-${{ env.GOVULNCHECK_VERSION }}
          restore-keys: |
            govulncheck-${{ runner.os }}-

      - name: Run govulncheck
        run: go run "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}" ./...

Is Zizmor required to pass?

zizmor.yml isn't included in this block, despite the comment. Presumably it's because it's either allowed to soft-fail or handled by the branch protection rules:

boulder/.github/workflows/boulder-ci.yml

Lines 169 to 187 in c5f1008

	# This is a utility build job to detect if the status of any of the
	# above jobs have failed and fail if so. It is needed so there can be
	# one static job name that can be used to determine success of the job
	# in GitHub branch protection.
	# It does not block on the result of govulncheck so that a new vulnerability
	# disclosure does not prevent any other PRs from being merged.
	boulder_ci_test_matrix_status:
	permissions:
	contents: none
	if: ${{ always() }}
	runs-on: ubuntu-24.04
	name: Boulder CI Test Matrix
	needs:
	- b
	- vendorcheck
	steps:
	- name: Check boulder ci test matrix status
	if: ${{ needs.b.result != 'success' || needs.vendorcheck.result != 'success' }}
	run: exit 1

Zizmor is not being updated by Dependabot

Speaking of zizmor, using the env block to load it is opaque to Dependabot, so you're out of date (https://github.com/zizmorcore/zizmor/releases/tag/v1.30.0 is the current release). You might want to switch to using zizmorcore/zizmor-action:

boulder/.github/workflows/zizmor.yml

Lines 16 to 20 in c5f1008

	zizmor:
	runs-on: ubuntu-24.04
	env:
	ZIZMOR_IMAGE: ghcr.io/zizmorcore/zizmor:1.25.2@sha256:14ea7f5cc7c67933394a35b5a38a277397818d232602635edb2010b313afb110