ci: migrate to Qiniu sandbox runner

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  pull_request:
   push:
     branches:
       - main
@@ -12,27 +13,87 @@ concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  # Keep writable Go directories outside the runner template's built-in GOPATH.
+  GOPATH: ${{ github.workspace }}/.cache/go
+  GOMODCACHE: ${{ github.workspace }}/.cache/go/pkg/mod
+  GOCACHE: /tmp/go-build-cache
+  GOPRIVATE: github.com/qbox/*
+
+  # Shared Qiniu S3 cache configuration. Credentials come from repository secrets.
+  RUNNER_S3_BUCKET: las-github-runner-dal
+  RUNNER_S3_ENDPOINT: s3.us-north-1.qiniucs.com
+  RUNNER_S3_REGION: us-north-1
+  RUNNER_S3_AK: ${{ secrets.RUNNER_S3_AK }}
+  RUNNER_S3_SK: ${{ secrets.RUNNER_S3_SK }}
+
 jobs:
+  prepare:
+    if: github.repository == '1024XEngineer/xinfra'
+    name: Prepare CI context
+    runs-on: github-runner-ubuntu-24-04
+    outputs:
+      ci_go_mod_hash: ${{ steps.context.outputs.ci_go_mod_hash }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Calculate Go module cache key
+        id: context
+        shell: bash
+        run: |
+          set -euo pipefail
+          ci_go_mod_hash="$(sha256sum server/go.mod server/go.sum | sha256sum | awk '{print $1}')"
+          echo "ci_go_mod_hash=${ci_go_mod_hash}" >> "${GITHUB_OUTPUT}"
+          echo "CI_GO_MOD_HASH=${ci_go_mod_hash}"
+
+  go-mod-cache:
+    if: github.repository == '1024XEngineer/xinfra'
+    name: Prepare Go module cache
+    needs: prepare
+    runs-on: github-runner-ubuntu-24-04
+    env:
+      CI_GO_MOD_HASH: ${{ needs.prepare.outputs.ci_go_mod_hash }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Prepare Go environment
+        uses: ./.github/actions/ci-go-prep
+
+      - name: Download and verify Go modules
+        working-directory: server
+        shell: bash
+        run: |
+          set -euo pipefail
+          go mod download
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
+
+      - name: Save Go module cache to S3
+        if: success()
+        continue-on-error: true
+        shell: bash
+        run: bash "${GITHUB_WORKSPACE}/.github/scripts/ci/save-go-cache.sh"
+
   backend-unit:
     if: github.repository == '1024XEngineer/xinfra'
     name: Backend unit tests
-    runs-on: ubuntu-latest
+    needs:
+      - prepare
+      - go-mod-cache
+    runs-on: github-runner-ubuntu-24-04
+    env:
+      CI_GO_MOD_HASH: ${{ needs.prepare.outputs.ci_go_mod_hash }}
     defaults:
       run:
         working-directory: server
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: server/go.mod
-          cache: true
-          cache-dependency-path: server/go.sum
-
-      - name: Download Go modules
-        run: go mod download
+      - name: Prepare Go environment
+        uses: ./.github/actions/ci-go-prep
 
       - name: Go vet
         run: go vet ./...
@@ -51,20 +112,13 @@ jobs:
   frontend-validation:
     if: github.repository == '1024XEngineer/xinfra'
     name: Frontend typecheck and build
-    runs-on: ubuntu-latest
+    runs-on: github-runner-ubuntu-24-04
     defaults:
       run:
         working-directory: frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: npm ci
@@ -75,10 +129,14 @@ jobs:
   integration:
     if: github.repository == '1024XEngineer/xinfra'
     name: Backend integration smoke test
-    runs-on: ubuntu-latest
     needs:
+      - prepare
+      - go-mod-cache
       - backend-unit
       - frontend-validation
+    runs-on: github-runner-ubuntu-24-04
+    env:
+      CI_GO_MOD_HASH: ${{ needs.prepare.outputs.ci_go_mod_hash }}
     services:
       mysql:
         image: mysql:8.0.46
@@ -97,18 +155,10 @@ jobs:
           --health-retries=12
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: server/go.mod
-          cache: true
-          cache-dependency-path: server/go.sum
-
-      - name: Download Go modules
-        working-directory: server
-        run: go mod download
+      - name: Prepare Go environment
+        uses: ./.github/actions/ci-go-prep
 
       - name: Run integration smoke test
         working-directory: server