perf(ci): cache Caddy binary in e2e job

[faultless-casey]

Replaces the apt-get keyring ceremony + install (~40-60s) with a direct tarball download from GitHub Releases, cached by pinned version (2.9.1). On a cache hit the Install Caddy step is skipped entirely, reducing it to ~5s. On a cache miss it still runs faster than the old apt-get path. To upgrade Caddy, bump the version in both the cache key and the curl URL.

🤖 Generated with Claude Code

Note

Cache Caddy binary in e2e CI job to speed up workflow runs

• Replaces apt-based Caddy installation in ci-e2e.yml with a direct download of Caddy v2.9.1 from GitHub Releases, keyed to the runner OS, arch, and version.
• On cache hit, the download step is skipped; on miss, the binary is extracted to RUNNER_TEMP and copied to /usr/local/bin.
• Risk: the step fails for unsupported runner architectures.

^{Macroscope summarized b62a1ff.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI/E2E workflow now installs Caddy v2.9.1 by resolving the runner architecture (amd64/arm64, failing on unsupported values), then using actions/cache keyed by OS+arch+version to store the downloaded Linux binary. The workflow downloads and extracts the GitHub release tarball only on cache miss, copies the caddy executable to /usr/local/bin, sets execute permissions, and removes the previous apt/Cloudsmith repository/key and package installation steps.

Changes

Cohort / File(s)	Summary
CI Workflow Configuration .github/workflows/ci-e2e.yml	Modified Caddy installation to resolve runner architecture (amd64/arm64), use actions/cache keyed by OS+arch+version for the Caddy v2.9.1 binary, download/extract the GitHub release tarball only when the cache is missed, and install the caddy executable to /usr/local/bin with execute permissions. Removed apt/Cloudsmith repository/key setup and package installation logic.

Estimated code review effort

🎯 Medium | ⏱️ ~30 minutes

Poem

🐰 A cache we lay for Caddy's grace,
Arch resolved, a single place.
GitHub tarball, saved on miss—
CI gains speed, deployment bliss.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: caching the Caddy binary in the e2e CI job for performance improvement.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description clearly explains the change: replacing apt-get Caddy installation with a cached GitHub Release download, detailing the performance improvement and upgrade instructions.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch casey/cache-caddy-results

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Confidence Score: 5/5

Safe to merge — the implementation is correct and the previously raised arch-awareness concern has been fully addressed.

No P0 or P1 issues remain. The cache key includes runner.arch, the download URL is arch-aware via the resolution step, runner.temp and RUNNER_TEMP refer to the same path so the cache/download/install chain is consistent, and the unconditional Install Caddy step is intentional since the binary always needs to be copied to /usr/local/bin regardless of cache hit or miss.

No files require special attention.

_{Reviews (2): Last reviewed commit: "fix(ci): fix Caddy cache path and add ar..." | Re-trigger Greptile}

[macroscopeapp]

Approvability

Verdict: Needs human review

CI caching optimization for Caddy binary. An unresolved review comment raises a security concern about downloading executables without integrity verification (checksums/signatures), which warrants human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci-e2e.yml:
- Around line 128-130: The workflow currently streams and extracts the Caddy
tarball directly into /usr/local/bin (the curl | tar step for
caddy_2.9.1_linux_amd64.tar.gz and chmod +x /usr/local/bin/caddy); change this
to first download the tarball and the corresponding caddy_2.9.1_checksums.txt
(and its signature), verify the checksums file signature with cosign (or
Sigstore) to ensure authenticity, compute and compare the tarball SHA256 against
the verified checksums entry, and only if the checksum matches proceed to
extract the tarball and run sudo chmod +x /usr/local/bin/caddy. Include clear
failure exits on signature or checksum mismatch.
- Around line 118-126: The cache step "caddy-cache" currently caches
/usr/local/bin/caddy (root-owned) which causes permission errors; change the
cache path to a user-writable location such as $RUNNER_TEMP/caddy or
./.cache/caddy (update the actions/cache step's path and keep the same key
caddy-${{ runner.os }}-2.9.1), then after the cache restore (in the "Install
Caddy" or a new step) copy the cached file into /usr/local/bin/caddy using sudo
(e.g., sudo cp $RUNNER_TEMP/caddy /usr/local/bin/caddy && sudo chmod +x
/usr/local/bin/caddy) so the cache is read/written as the runner user and the
binary is placed with root permissions afterward.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 709c0aeb-4db5-4520-bd0a-cfb794724657

📥 Commits

Reviewing files that changed from the base of the PR and between c5adb75 and 69446cc.

📒 Files selected for processing (1)

• .github/workflows/ci-e2e.yml

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's examine the workflow file to understand the full context
cat -n .github/workflows/ci-e2e.yml | head -150 | tail -30

Repository: fluffyx/github-workflows

Length of output: 1328

---

🌐 Web query:

Caddy releases integrity verification checksums GPG signatures

💡 Result:

Caddy provides checksums and cryptographic signatures for verifying the integrity and authenticity of its release artifacts (binaries, source tarballs). Since v2.6.0, they use Sigstore (not traditional GPG) for signing. No GPG signatures on binaries or checksums themselves. Process: 1. Download from GitHub releases (e.g., https://github.com/caddyserver/caddy/releases): binary tar.gz/zip, caddy_VERSION_checksums.txt (SHA256 sums of binaries), checksums.txt.sig, checksums.txt.pem. 2. Verify checksums.txt integrity/authenticity first (protects all binary checksums): - Install cosign (https://github.com/sigstore/cosign). - Run: COSIGN_EXPERIMENTAL=1 cosign verify-blob --certificate caddy_VERSION_checksums.txt.pem --signature caddy_VERSION_checksums.txt.sig caddy_VERSION_checksums.txt - Expect "Verified OK" + tlog entry. 3. Compute SHA256 of your binary and match against checksums.txt (e.g., sha256sum caddy_VERSION_linux_amd64.tar.gz). 4. Optionally verify individual binary: cosign verify-blob --certificate binary.pem --signature binary.sig binary.tar.gz. Full details: https://caddyserver.com/docs/signature-verification. All logged in Sigstore Rekor transparency log. APT/Yum repos use separate GPG keys (Cloudsmith, rotated periodically). Git tags use GPG/SSH signatures (not for binaries).

Citations:

• 1: https://caddyserver.com/docs/signature-verification
• 2: http://caddyserver.com/docs/install
• 3: https://github.com/caddyserver/caddy/releases/tag/v2.11.1
• 4: https://github.com/caddyserver/caddy-docker/blob/master/getChecksums.sh

---

Add integrity checks before unpacking the release tarball.

This downloads an executable over the network and unpacks it directly into PATH without verification. Caddy provides SHA256 checksums and Sigstore signatures for release verification—download caddy_2.9.1_checksums.txt, verify its signature with cosign, then validate the tarball SHA256 before extraction.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci-e2e.yml around lines 128 - 130, The workflow currently
streams and extracts the Caddy tarball directly into /usr/local/bin (the curl |
tar step for caddy_2.9.1_linux_amd64.tar.gz and chmod +x /usr/local/bin/caddy);
change this to first download the tarball and the corresponding
caddy_2.9.1_checksums.txt (and its signature), verify the checksums file
signature with cosign (or Sigstore) to ensure authenticity, compute and compare
the tarball SHA256 against the verified checksums entry, and only if the
checksum matches proceed to extract the tarball and run sudo chmod +x
/usr/local/bin/caddy. Include clear failure exits on signature or checksum
mismatch.

Dismissing prior approval to re-evaluate b62a1ff

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/ci-e2e.yml (1)

134-143: ⚠️ Potential issue | 🟠 Major

Verify the Caddy release artifact before extracting it.

This still streams a remote executable tarball straight into tar and then installs it into PATH without checksum or signature verification. Please add release integrity checks before unpacking the binary.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c77a565a-c5bc-4492-a2ac-e637422bd45d

📥 Commits

Reviewing files that changed from the base of the PR and between 69446cc and b62a1ff.

📒 Files selected for processing (1)

• .github/workflows/ci-e2e.yml