Cache uv and Go binaries in CI workflows

[alexkroman]

Summary

Optimize CI performance by caching the uv package manager and Go-built gate binaries (actionlint, gitleaks) across workflow runs, reducing redundant downloads and compilation.

Key Changes

• Replace manual uv installation with astral-sh/setup-uv action across three jobs (ci, test-e2e, docs-snapshot):

  • Uses the official setup action (v8.2.0) with caching enabled
  • Caches the uv download cache (~/.cache/uv) keyed on uv.lock, avoiding re-downloads of locked dependencies including Rust-backed sdists (pydantic-core, jiter, cryptography)
  • Simplifies the install step from python -m pip install uv to a declarative action

• Add caching for Go gate binaries in the ci job:

  • New actions/cache step caches ~/go/bin keyed on scripts/gate_tool_pins.sh
  • Conditional go install only runs on cache miss, skipping from-source compilation when binaries are cached
  • Uses environment variable to safely pass cache-hit output to the script (avoiding template-injection risk)

• Separate uv sync --frozen into its own step in the docs-snapshot job for clarity

Implementation Details

• All cache keys are deterministic and tied to their respective lock/pin files, ensuring cache invalidation when dependencies change
• The Go binary caching uses a conditional check (if [ "$CACHE_HIT" != "true" ]) to skip compilation entirely on cache hits
• Cache-hit output is mapped to an environment variable rather than expanded directly in the script, following security best practices (zizmor template-injection rule)

https://claude.ai/code/session_01Wboq6L5ujSodPxqbewP3tx