chore: backport CI improvements to v2.3

[sylr]

Summary

• default action: disable nix cache (downloading from cache.nixos.org is faster), use go env for proper GOCACHE/GOMODCACHE paths, add golangci-lint cache
• all workflows: use treeless clones (filter: tree:0) for faster checkout
• main.yml: add build provenance attestations, upload goreleaser metadata, update Deploy job to tailscale v4 with OIDC auth
• benchmark workflows: fix report path, allow workflow_dispatch trigger for comparison, fix trailing whitespace

Test plan

• CI workflows run successfully on the PR
• Verify caching works correctly with new go env paths

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• .github/workflows/benchmark-comparison.yml is excluded by !**/*.yml
• .github/workflows/benchmark.yml is excluded by !**/*.yml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Reordered Justfile pre-commit targets, added a fmt target, conditioned speakeasy invocation on SPEAKEASY_API_KEY, and adjusted lint navigation and flags. Refactored flake.nix: fixed nixpkgs URL, removed go overlay mapping, changed unfree handling to a predicate, corrected speakeasy hash, and split devShells packages into stable and other lists. Updated a test to use deferred.FromValue.

Changes

Cohort / File(s)	Summary
Build / Make-like targets Justfile	Reordered pre-commit sequence to include generate earlier; added fmt target; lint now runs golangci-lint --version and uses build-tags it,local; generate-client conditionally runs speakeasy only when SPEAKEASY_API_KEY is set; added explicit directory pops and adjusted navigation.
Nix configuration flake.nix	Replaced nixpkgs.url with fixed revision; removed goVersion and the overlays.default mapping (keeping nur.overlays.default); changed config.allowUnfree to config.allowUnfreePredicate allowing only goreleaser-pro; removed GOROOT suffix from speakeasyHashes aarch64 entry; refactored devShells to compute stablePackages and otherPackages and set packages = stablePackages ++ otherPackages.
Tests test/performance/pkg/write/local_env_test.go	Switched deferred value construction: replaced NewValuedDeferred(...) with deferred.FromValue(...) for connection options and OTLPConfig in test setup.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

🐰
I hop through lines of build and nix,
rearrange a target, fix some ticks.
A conditional sprinkle, hashes right,
deferred values tucked in tight.
Carrots compiled, the pipeline's light.

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description focuses on CI workflow improvements (caching, checkout optimization, provenance, Tailscale updates) but the changeset includes significant non-CI changes to Justfile, flake.nix, and test code that are not mentioned in the description.	Update the description to include all changes: Justfile lint/generate targets, flake.nix nixpkgs/overlays updates, and test helper imports to accurately reflect the full changeset scope.
Title check	⚠️ Warning	The PR title 'chore: backport CI improvements to v2.3' is partially related to the changeset but does not capture the main changes accurately.	Clarify the title to better reflect the actual changes: the primary changes are to Justfile and flake.nix configurations with a minor test helper import fix, not just CI improvements.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch backport/v2.3/ci-improvements

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.73%. Comparing base (5dc50f7) to head (8b48908).
⚠️ Report is 2 commits behind head on release/v2.3.

Additional details and impacted files

@@               Coverage Diff                @@
##           release/v2.3    #1278      +/-   ##
================================================
+ Coverage         81.71%   81.73%   +0.02%     
================================================
  Files               187      187              
  Lines              9078     9078              
================================================
+ Hits               7418     7420       +2     
+ Misses             1220     1219       -1     
+ Partials            440      439       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.