[WIP] Fix CI failure during lint-go in run #32305

[Copilot]

Thanks for assigning this issue to me. I'm starting to work on it and will keep this PR's description up to date as I form a plan and make progress.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[CI Failure Doctor] CI Failure Investigation - Run #32305</issue_title>
<issue_description># 🏥 CI Failure Investigation - Run githubnext/gh-aw#32305

Summary

lint-go against ff7e012 fails during make lint because the Go toolchain download from (redacted) is forbidden and golangci-lint is missing, so the job cannot even finish acquiring its tooling.

Failure Details

• Run: 32305
• Commit: ff7e012
• Trigger: push

Root Cause Analysis

make lint invokes go install and golangci-lint tooling; the runner cannot download Go 1.25 from proxy.golang.org (HTTP 403) and stops before installing golangci-lint, so lint targets never run.

Failed Jobs and Errors

• lint-go: go: download go1.25.0: golang.org/toolchain@v0.0.1-go1.25.0.linux-amd64.zip: Get "(redacted) Forbidden
• lint-go: golangci-lint is not installed. Run 'make deps-dev' to install dependencies.

Investigation Findings

• Re-running make lint locally also fails with the same forbidden error from proxy.golang.org and the missing golangci-lint message, proving the failure is deterministic in this environment.
• Attempted to download the GitHub Actions job logs but the API returned Must have admin rights to Repository, so the raw logs were inaccessible.

Recommended Actions

• Ensure the CI runner can reach (redacted) or vendor the Go 1.25 toolchain so go install succeeds without network 403 errors.
• Install or cache golangci-lint by running make deps-dev (or equivalent) before make lint so the lint binary exists.
• Add a pre-check that verifies required tooling is present before lint execution to produce a clearer failure if installation still fails.

Prevention Strategies

• Cache the Go toolchain and golangci-lint binaries in the runner image or artifacts so they are reused without relying on outbound downloads.
• Have lint-related jobs explicitly run make deps-dev (or make format-deps) and fail fast with a console hint when tooling is missing.

AI Team Self-Improvement

Before running lint/skipping steps that install binaries, check that the runner has network access to required download hosts and that the tools are already installed; if not, emit a pre-flight warning and install them (or use vendored copies) so CI does not die mid-lint.

Historical Context

No previous investigations for this exact forbidden-access pattern were found in the cached investigation history.

AI generated by CI Failure Doctor

To add this workflow in your repository, run gh aw add githubnext/agentics/workflows/ci-doctor.md@ea350161ad5dcc9624cf510f134c6a9e39a6f94d. See usage guide.

Comments on the Issue (you are @copilot in this section)

• Fixes [CI Failure Doctor] CI Failure Investigation - Run #32305 #12319

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.