Docs: guidelines for configuring Go module/build cache in a security-conscious way #27886

Problem

There is no dedicated guidance on how to configure Go module and build caching in Agentic Workflows in a security-conscious way. The relevant information is currently spread across several reference pages (frontmatter.md, sandbox.md, cache-memory.md) with no Go-specific caching example.

The gap becomes visible when a workflow uses the cache: frontmatter field or a jobs.setup pre-build step to cache ~/go/pkg/mod and ~/.cache/go-build — there are real security trade-offs here that aren't covered today:

• Cache poisoning: a cached Go module tarball is not re-verified against the checksum database (GONOSUMCHECK, GONOSUMDB) on restore.
• GOMODCACHE vs GOCACHE scope: caching the module download cache and the build cache have different risk profiles; mixing both in one actions/cache entry is common but worth calling out.
• Integrity interplay: when a workflow uses tools.github.min-integrity, should the Go module cache be scoped to the same integrity level? The current docs don't address this.
• Writable paths in the sandbox: as noted in the smoke-copilot fixture, the default GOCACHE/GOMODCACHE locations may not be writable inside the AWF sandbox, requiring GOCACHE=/tmp/go-cache GOMODCACHE=/tmp/go-mod — but this isn't documented for end-users.

Requested documentation

A dedicated section or guide covering:

1. Recommended cache: frontmatter for Go — which paths to include, recommended key structure (go-${{ hashFiles('go.sum') }}), and restore-key fallback strategy.
2. actions/setup-go built-in cache option — whether cache: true on the runtime setup action is supported and safe in the AWF context.
3. Go cache paths in the AWF sandbox — clarify whether ~/go/pkg/mod and ~/.cache/go-build are writable, and when to redirect via GOCACHE/GOMODCACHE env vars.
4. Security considerations — checksum verification on restore, risks of sharing a module cache across branches/PRs of differing integrity, and recommended mitigations.
5. jobs.setup pre-build pattern for Go — a concrete example analogous to the Gradle example in sandbox.md (line 287).

Context

• Discovered while exploring the cache: field in .github/workflows/prompt-clustering-analysis.md.
• Current docs: reference/frontmatter.md (§ Cache Configuration), reference/sandbox.md (§ Caching section), reference/cache-memory.md, reference/supported-languages.md.

🤖 Created by Claude Code