GeezerVison

Problem

The test job in ci.yml compiles vexctl v0.3.0 with go install on every OS, on every CI run. Here is how long the Install vexctl step took across the last 7 successful CI runs:

test (windows-latest) is the slowest job in the workflow: 1656s on main run 36899292199. yarn-classic-matrix, yarn-berry-e2e, cargo-vex-matrix and cargo-old-toolchains all wait on it with needs: test, so in that run they started only at 18:13, after Windows finished. That makes the windows compile part of every run's wall-clock. The compile also builds sigstore/cosign and reads dozens of sum.golang.org tiles. That has failed the step on otherwise-green runs; the step's own comment records the 2026-08-20 incident and already suggested this fix as the follow-up.

Fix

The Install vexctl step in .github/workflows/ci.yml:

• Linux / Windows: downloads vexctl-linux-amd64 / vexctl-windows-amd64.exe from the v0.3.0 release and checks each against a sha256 pinned in the workflow (copied from the release's vexctl_checksums.txt). It runs vexctl version once as a smoke test and puts the binary's directory on PATH. On Windows the file is named vexctl.exe, which is the name find_vexctl_on_path in tests/e2e_vex.rs looks for.
• macOS: keeps the retried go install exactly as before. The release's darwin binaries are built with go1.22.7 and have no LC_UUID load command: I parsed the Mach-O header of vexctl-darwin-arm64 (17 load commands, no 0x1b). The runner's dyld refuses such a binary, which is why the Go 1.24 pin exists.
• The vexctl version and both digests are in the step's env. Go setup is unchanged, since the Go e2e suites still need it.

Proof

• I downloaded all three assets and sha256sum -c vexctl_checksums.txt passed. go version -m vexctl-darwin-arm64 reports go1.22.7, which confirms macOS has to keep compiling.

• I ran the step's script locally with RUNNER_OS=Linux. It downloaded the binary, passed the checksum, printed GitVersion: v0.3.0 … GoVersion: go1.22.7 and wrote the directory to GITHUB_PATH. When I set a wrong digest, the step exits 1 at sha256sum -c and writes nothing to GITHUB_PATH.

• With that binary on PATH, cargo test -p socket-patch-cli --test e2e_vex gives 16 passed, and no skipping vexctl validation line is printed, so the vexctl merge validation really ran.

• actionlint v1.7.7 reports no issues on ci.yml.

• Expected saving: about 4.3 job-minutes per CI run (≈177s + ≈81s, minus a few seconds of download). On the Windows leg it cuts ~3 min from the job that ends the run.

• Measured on this PR. On CI run 36926566381 (head ec0d507), every workflow is green: CI, PDM, vlt, Pin check and Audit GHA Workflows. Here is how long Install vexctl took:

  • windows: 3s (median was 177s)
  • ubuntu: 1s (median was 81s)
  • macos: 108s (still compiles, unchanged)

  test (windows-latest) took 1320s in total, down from 1656s on the main run cited above. The whole CI run took 25 minutes.

Where tests run

Nothing moved or removed. All three test legs still validate the vex output with vexctl v0.3.0. Job and check names are unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LPCZKE7kADjPbgE9NrbgdS

Generated by Claude Code

Generated by Claude Code