ci: back Go compiles with the shared S3 build cache

Every pipeline run recompiled the tree from scratch.

- Bootstrap the go-cache-plugin GOCACHEPROG in the test and pre-commit steps,
  best-effort: a failed fetch leaves it unset and the compile runs as before.
- Run tests on the gobuilder image, which trusts the internal CA the S3
  endpoint presents.

.woodpecker/pre-commit.yaml

@@ -5,12 +5,26 @@ steps:
   - name: pre-commit
     image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
     commands:
+      # Best-effort S3 build cache for the go vet hook: if the plugin cannot be
+      # fetched, GOCACHEPROG stays unset. S3 errors degrade to cache misses.
+      - "curl -fsSLo /tmp/gocacheprog https://git.unkin.net/unkin/go-cache-plugin/releases/download/v0.1.0/go-cache-plugin-linux-amd64 && echo '0eb23d06a0dcf395559cb6447864579c220e60148fdcd6a6f841c2b17169b9b8  /tmp/gocacheprog' | sha256sum -c - && chmod +x /tmp/gocacheprog && export GOCACHEPROG=\"/tmp/gocacheprog --cache-dir=/tmp/gocache\" || echo 'go build cache unavailable, compiling without it'"
       - uvx pre-commit run --all-files
     environment:
       # golib lives on Gitea; skip the public proxy/sum db.
       GOPRIVATE: git.unkin.net
+      GOCACHE_S3_BUCKET: gocache
+      # Explicit region skips a GetBucketLocation probe RGW handles poorly.
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-artifactapi
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
     backend_options:
       kubernetes:
+        serviceAccountName: default
         resources:
           requests:
             memory: 512Mi

.woodpecker/test.yaml

@@ -3,9 +3,33 @@ when:
 
 steps:
   - name: test
-    image: golang:1.25
+    # gobuilder trusts the internal CA, which the S3 build cache endpoint needs.
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
     commands:
+      # Best-effort S3 build cache: if the plugin cannot be fetched, GOCACHEPROG
+      # stays unset and the compile runs as before. S3 errors degrade to misses.
+      - "curl -fsSLo /tmp/gocacheprog https://git.unkin.net/unkin/go-cache-plugin/releases/download/v0.1.0/go-cache-plugin-linux-amd64 && echo '0eb23d06a0dcf395559cb6447864579c220e60148fdcd6a6f841c2b17169b9b8  /tmp/gocacheprog' | sha256sum -c - && chmod +x /tmp/gocacheprog && export GOCACHEPROG=\"/tmp/gocacheprog --cache-dir=/tmp/gocache\" || echo 'go build cache unavailable, compiling without it'"
       - go test -race -count=1 ./pkg/... ./internal/...
     environment:
       # golib lives on Gitea; skip the public proxy/sum db.
       GOPRIVATE: git.unkin.net
+      GOCACHE_S3_BUCKET: gocache
+      # Explicit region skips a GetBucketLocation probe RGW handles poorly.
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: "https://s3.ceph.unkin.net"
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-artifactapi
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1
+          limits:
+            memory: 4Gi
+            cpu: 2