ci(perf): stop macOS-on-PR, enable Go cache, least-privilege (#481)

macOS runners are the biggest CI cost multiplier (10x ubuntu-latest minutes)
and stem's build matrix built both darwin rows on every PR despite only
darwin/arm64 ever shipping in release.yml. Since stem is CGO_ENABLED=0, drop
both darwin rows from the PR build matrix and replace them with a cheap
cross-compile smoke check on ubuntu-latest. Also enable keyed Go module/build
caching (copied from seed's setup-go composite action), narrow ci.yml's
top-level permissions from broad pull-requests/checks/security-events writes
down to contents:read + a scoped grant on the one job that needs SARIF
upload, and pin release.yml's syft install to a checksummed release archive
instead of piping install.sh from the mutable main branch.

Related to #480

Author: krisarmstrong

.github/actions/setup-go/action.yml

@@ -1,5 +1,5 @@
 name: 'Setup Go'
-description: 'Set up Go with caching and module download'
+description: 'Set up Go with build/module caching and module download'
 inputs:
   go-version-file:
     description: 'Path to go.mod file'
@@ -12,8 +12,45 @@ runs:
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: ${{ inputs.go-version-file }}
+        # setup-go's built-in cache keys only on go.sum and caches the default
+        # GOCACHE; the race job overrides GOCACHE/GOMODCACHE to the workspace,
+        # so we manage the cache explicitly below to capture the *build*
+        # cache too (mirrors seed's setup-go composite action).
         cache: false
 
+    # Resolve the active build/module cache dirs. These honor any job-level
+    # GOCACHE/GOMODCACHE override (the race job points them at the workspace).
+    - name: Resolve Go cache paths
+      id: go-cache-paths
+      shell: bash
+      run: |
+        build="$(go env GOCACHE)"
+        mod="$(go env GOMODCACHE)"
+        # Jobs that override GOCACHE/GOMODCACHE to the workspace must not share
+        # a cache key with default-path jobs (actions/cache restores to the
+        # saved path, so a path mismatch leaves the job cold). Discriminate by
+        # path.
+        tag="$(printf '%s|%s' "$build" "$mod" | sha256sum | cut -c1-12)"
+        {
+          echo "build=$build"
+          echo "mod=$mod"
+          echo "tag=$tag"
+        } >> "$GITHUB_OUTPUT"
+
+    # Persist the build + module caches across runs (official actions/cache Go
+    # pattern: key on go.sum, fall back by prefix). `tag` discriminates the
+    # cache by path so workspace-GOCACHE jobs don't collide with default-path
+    # jobs on a shared key.
+    - name: Cache Go build and module caches
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: |
+          ${{ steps.go-cache-paths.outputs.build }}
+          ${{ steps.go-cache-paths.outputs.mod }}
+        key: ${{ runner.os }}-go-${{ steps.go-cache-paths.outputs.tag }}-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          ${{ runner.os }}-go-${{ steps.go-cache-paths.outputs.tag }}-
+
     - name: Download Go modules
       shell: bash
       run: go mod download

.github/workflows/ci.yml

@@ -17,12 +17,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Least-privilege default: every job gets read-only contents unless it
+# specifically needs more (granted at the job level below). None of these
+# jobs comment on or annotate PRs via the GitHub API, so pull-requests/checks
+# write were unused broad grants — only the `security` job's SARIF upload
+# needs security-events:write (+ actions:read, required for private repos
+# per github/codeql-action/upload-sarif's docs; niac hit this exact gap).
 permissions:
-  actions: read
   contents: read
-  pull-requests: write
-  checks: write
-  security-events: write
 
 jobs:
   # ============================================================================
@@ -441,6 +443,10 @@ jobs:
     name: Security Scanning
     runs-on: ubuntu-latest
     # Always runs — security checks are non-negotiable on every PR.
+    permissions:
+      contents: read
+      security-events: write # upload-sarif (gosec + Trivy)
+      actions: read # required alongside security-events:write on private repos
 
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -639,6 +645,14 @@ jobs:
     # isn't bound until after the strategy expands). All matrix rows run
     # on every PR; per-arch arches are fast enough that the savings weren't
     # worth a workaround.
+    #
+    # macOS runners are 10x the minute multiplier of ubuntu-latest and are
+    # NOT built here on PRs — darwin/amd64 (Intel) is dropped fleet-wide,
+    # and darwin/arm64's real release binary is produced by goreleaser in
+    # release.yml (unchanged). Since stem is CGO_ENABLED=0 (pure Go), the
+    # darwin/arm64 build cross-compiles trivially on ubuntu; the dedicated
+    # darwin-compile-check job below verifies it still compiles without
+    # paying for a macOS runner on every PR.
     if: |
       always() &&
       needs.frontend.result == 'success' &&
@@ -659,18 +673,6 @@ jobs:
             goos: linux
             goarch: arm64
             required: false
-          - os: darwin
-            arch: amd64
-            runner: macos-latest
-            goos: darwin
-            goarch: amd64
-            required: false
-          - os: darwin
-            arch: arm64
-            runner: macos-latest
-            goos: darwin
-            goarch: arm64
-            required: false
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
@@ -747,6 +749,44 @@ jobs:
           path: bin/stem-${{ matrix.os }}-${{ matrix.arch }}
           retention-days: 7
 
+  # ============================================================================
+  # Darwin compile check — verifies the release target still cross-compiles
+  # ============================================================================
+  # macOS runners cost 10x the ubuntu-latest minute multiplier, so darwin
+  # binaries are no longer built on PRs at all (see the `build` job comment
+  # above). stem is CGO_ENABLED=0 (pure Go), so GOOS=darwin GOARCH=arm64
+  # cross-compiles cleanly on ubuntu-latest — this job is a cheap compile-only
+  # smoke check that the darwin/arm64 target hasn't broken, without paying for
+  # a macOS runner. The actual signed darwin/arm64 release binary is still
+  # produced by goreleaser in release.yml, unchanged. darwin/amd64 (Intel) is
+  # dropped fleet-wide and is not checked here.
+  darwin-compile-check:
+    name: Darwin compile check (arm64)
+    runs-on: ubuntu-latest
+    needs: [changes, backend, frontend]
+    if: |
+      always() &&
+      needs.frontend.result == 'success' &&
+      (needs.backend.result == 'success' || needs.backend.result == 'skipped')
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Go
+        uses: ./.github/actions/setup-go
+
+      - name: Download frontend build
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: frontend-dist
+          path: internal/api/ui/
+
+      - name: Cross-compile for darwin/arm64 (no macOS runner needed)
+        env:
+          GOOS: darwin
+          GOARCH: arm64
+          CGO_ENABLED: '0'
+        run: go build -trimpath -o /dev/null ./cmd/stem/
+
   # ============================================================================
   # Lighthouse Performance Audit
   # ============================================================================
@@ -933,6 +973,7 @@ jobs:
       - i18n
       - docs
       - build
+      - darwin-compile-check
     if: always()
     steps:
       - name: Verify upstream results

.github/workflows/release.yml

@@ -136,8 +136,21 @@ jobs:
           path: internal/api/ui/
 
       - name: Install Syft (SBOM) inside container
+        env:
+          # Pinned version + checksum (from syft's published checksums.txt),
+          # matching the gitleaks-CLI pattern in ci.yml's security job —
+          # `curl ... install.sh | sh` from the mutable `main` branch is a
+          # supply-chain risk (a compromised main would run arbitrary code
+          # in the release container). Rotate together on upgrade.
+          SYFT_VERSION: "1.46.0"
+          SYFT_SHA256: "d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca"
         run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+          set -euo pipefail
+          curl -sSfL -o syft.tar.gz \
+            "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.tar.gz"
+          echo "${SYFT_SHA256}  syft.tar.gz" | sha256sum -c -
+          tar -xzf syft.tar.gz -C /usr/local/bin syft
+          chmod +x /usr/local/bin/syft
 
       - name: Install Cosign inside container
         run: |