[WIP] Optimize CI workflow for concurrency and permissions

[Claude]

• Add concurrency group with cancel-in-progress to workflow level
• Remove pull-requests: write permission from build-dotnet job
• Add explicit cache-dependency-path to Go setup action
• Verify YAML syntax and formatting
• Test workflow changes

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[ci-coach] ci: optimize CI workflow — concurrency, least-privilege permissions, Go cache</issue_title>
<issue_description>### Summary

Three targeted optimizations to the CI Build workflow that reduce wasted runner minutes, tighten security permissions, and improve dependency cache reliability. No test logic is changed.

---

Optimizations

1. Add concurrency group with cancel-in-progress: true

Type: Conditional Execution
Impact: Eliminates duplicate runs — saves the full workflow runtime (~2–5 min) for every superseded commit
Risk: Low

Changes:

• Added a concurrency block at the workflow level keyed on github.workflow + github.ref
• When a new commit is pushed to a PR branch, any still-running CI for the previous commit is automatically cancelled

Rationale: Without this, pushing 3 quick commits to a PR fires 3 full CI runs simultaneously. Only the last one matters. This is the single highest-ROI CI optimization for active PR branches.

Detailed Analysis

Before: Each push to a PR branch queues an independent run. If a developer pushes a fix-up commit 30 seconds later, both runs consume full runner minutes even though only the latest result is relevant.

After: GitHub automatically cancels the older in-progress run, freeing up concurrency and reducing billed minutes proportional to how often this happens (common on active PRs with dependabot or rapid iteration).

---

2. Remove pull-requests: write from build-dotnet

Type: Security / Least Privilege
Impact: Reduces blast radius if the workflow is compromised
Risk: None — no step in the job writes to pull requests

Changes:

• Removed pull-requests: write from build-dotnet permissions block
• The job now only holds contents: read, consistent with all other jobs

Rationale: The only steps are checkout, NuGet cache, setup-dotnet, dotnet build, and dotnet format. None require PR write access. The commented-out dotnet test step doesn't either. Principle of least privilege.

---

3. Add explicit cache-dependency-path to Go setup

Type: Cache Optimization
Impact: Ensures Go module cache is keyed on go.sum (more precise, fewer unnecessary cache misses)
Risk: None

Changes:

• Added cache-dependency-path: src/Garage.FeatureFlags/go.sum to actions/setup-go

Rationale: actions/setup-go v6 auto-caches Go modules but uses a heuristic to locate go.sum relative to the repo root. Providing the path explicitly avoids any ambiguity and guarantees correct cache keying — matching the pattern already used by actions/setup-node (which has cache-dependency-path: src/Garage.Web/package-lock.json).

---

Expected Impact

Metric	Before	After
Duplicate PR runs	All run to completion	Superseded runs cancelled
build-dotnet permissions	contents: read + pull-requests: write	contents: read only
Go cache key	Auto-detected (heuristic)	Explicit go.sum path

• Time Savings: ~2–5 min per superseded commit push (variable, depends on PR activity)
• Cost Reduction: Proportional to PR commit frequency; most savings on active branches
• Risk Level: Low — all changes are additive or permission-reducing

Testing Recommendations

• Review workflow YAML syntax (no logic changes)
• Push two commits rapidly to a test PR branch and confirm the first run is cancelled
• Verify Go build cache is hit on the second run after merging

Generated by CI Optimization Coach

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/ci-coach.md@442992eda2ccb11ee75a39c019ec6d38ae5a84a2

• expires on Mar 3, 2026, 11:12 AM UTC

---

[!NOTE]
This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available in the agent-artifacts artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 22542139587 -n agent-artifacts -D /tmp/agent-artifac...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes askpt/openfeature-aspire-sample#414