From 6b22e28c3ac621462d063aaa7c26f45ca014452e Mon Sep 17 00:00:00 2001
From: Sergey Kozyrenko <sirozha_blr@tut.by>
Date: Mon, 20 Jul 2026 03:06:25 +0700
Subject: [PATCH] fix(ci): drop the duplicate Go cache restore and pin token
 permissions

setup-go's cache:true already caches the build and module caches keyed
on go.sum; the extra actions/cache step restored the same read-only
~/go/pkg/mod on top and failed with "Cannot open: File exists" whenever
both caches hit. Also sets the workflow's GITHUB_TOKEN to contents:read.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f51df94..17ccbdff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
@@ -23,7 +26,9 @@ jobs:
           echo "Expected Node: $NVMRC"
           grep -q "node:${NVMRC}-slim" Dockerfile || { echo "::error::Dockerfile node tag != .nvmrc ($NVMRC)"; exit 1; }
 
-      # Go setup and cache
+      # Go setup and cache (setup-go's cache:true already covers the build cache
+      # and the module cache; a second actions/cache restore over the read-only
+      # ~/go/pkg/mod collides with "File exists" whenever both caches hit)
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -31,17 +36,6 @@ jobs:
           cache: true
           cache-dependency-path: backend/go.sum
 
-      # Cache Go dependencies
-      - name: Go Mod Cache
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
-
       # pnpm setup
       - name: Install pnpm
         uses: pnpm/action-setup@v4