[chore] CI workflow improvements: module cache, go vet, staticcheck, dedupe jobs, e2e timeout

[lugassawan]

Type

• CI / workflow (.github/workflows/, actions)

Files to change

• .github/workflows/ci.yml
• Makefile (if timeout targets are added)

Description

Several improvements to the CI workflow that reduce build times, catch more issues, and eliminate redundancy:

C1 — No Go module cache
setup-go@v6 supports cache: true which caches the Go module download cache between runs. Currently none of the four jobs (test, lint, coverage, build) enable this, causing fresh module downloads on every run. Add cache: true (or cache-dependency-path: go.sum) to each actions/setup-go step.

C2 — go vet and staticcheck not in CI
make lint runs golangci-lint but go vet is not explicitly invoked, and staticcheck (a well-regarded Go static analyser) is not included. Add a dedicated vet step (go vet ./...) to the lint job or as a separate fast job. Optionally add staticcheck via golangci-lint's staticcheck linter config.

C4 — test and coverage jobs both run make test; e2e has no timeout
The test job runs make test and the coverage job also runs make test-coverage (which includes make test internally), duplicating unit-test execution. Consider having coverage depend on test completing first, or consolidating. Additionally, e2e tests have no timeout-minutes guard — a hung worktree operation can block the runner indefinitely.

Acceptance

• All actions/setup-go steps have cache: true.
• go vet ./... runs as part of CI and failures block merge.
• test and coverage jobs do not duplicate unit-test execution.
• E2e job (or coverage job running e2e) has a timeout-minutes setting.
• CI total wall-clock time decreases or stays the same.

Bundles

Original candidates folded into this issue:

• C1 (.github/workflows/ci.yml): Go module cache not enabled on any job.
• C2 (.github/workflows/ci.yml): go vet and staticcheck absent from CI.
• C4 (.github/workflows/ci.yml): test/coverage job duplication; no e2e timeout guard.