Switch CI to hardened runners with JFrog Go module proxy (#1609)

## Summary

Route Go module downloads through JFrog Artifactory on hardened runners
that block direct access to proxy.golang.org. Authenticate via GitHub
Actions OIDC (zero stored secrets).

- Add composite action for JFrog + Go setup
- Switch tests and lint jobs to databricks-protected-runner-group-large
- Pre-cache project deps and build tools via jf go mod download/install
- Keep fmt job on ubuntu-latest (only runs gofmt, no module downloads)

NO_CHANGELOG=true

## Test plan
- [x] Verify `make test` passes on Linux, Windows, macOS
- [x] Verify `test-exp-aitools`, `test-exp-ssh`, `test-pipelines` are
triggered and pass

---------

Signed-off-by: Mihai Mitrea <mihai.mitrea@databricks.com>

Author: mihaimitrea-db

.github/actions/setup-build-environment/action.yml

@@ -0,0 +1,42 @@
+name: Setup build environment
+description: Set up Go toolchain and dependencies for CI
+
+inputs:
+  go-version:
+    description: "Go version to install"
+    required: true
+  go-cache:
+    description: "Enable Go module caching in setup-go"
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: Setup JFrog CLI with OIDC
+      uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
+      env:
+        JF_URL: https://databricks.jfrog.io
+      with:
+        oidc-provider-name: github-actions
+
+    - name: Setup Go
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+      with:
+        go-version: ${{ inputs.go-version }}
+        cache: ${{ inputs.go-cache }}
+
+    - name: Download Go modules via JFrog
+      shell: bash
+      run: |
+        jf goc --repo-resolve=db-golang
+        jf go mod download
+        jf go install gotest.tools/gotestsum@c4a0df2e75a225d979a444342dd3db752b53619f # v1.13.0
+        jf go install honnef.co/go/tools/cmd/staticcheck@b8ec13ce4d00445d75da053c47498e6f9ec5d7d6 # v0.6.1
+
+        # Point native go commands at the local module cache instead of
+        # the network. go run pkg@version needs module lookups even when
+        # cached; file:// satisfies these from disk without network access.
+        echo "GOPROXY=file://$(go env GOMODCACHE)/cache/download" >> $GITHUB_ENV
+        echo "GONOSUMCHECK=*" >> $GITHUB_ENV
+        echo "GONOSUMDB=*" >> $GITHUB_ENV

.github/workflows/push.yml

@@ -16,7 +16,14 @@ on:
 
 jobs:
   tests:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+
+    permissions:
+      id-token: write
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:
@@ -28,8 +35,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+      - name: Setup build environment
+        uses: ./.github/actions/setup-build-environment
         with:
           go-version: ${{ matrix.goVersion }}
 
@@ -42,14 +49,20 @@ jobs:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   lint:
-    runs-on: ubuntu-latest
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+      - name: Setup build environment
+        uses: ./.github/actions/setup-build-environment
         with:
           go-version: "1.26"
 

config/auth_azure_github_oidc_test.go

@@ -255,6 +255,15 @@ func TestAzureGithubOIDCCredentials(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
+			// Clear OIDC env vars that GitHub Actions injects when id-token: write
+			// is set. Without this, Config picks them up via the env: struct tag
+			// and tests that assert "not configured" fail.
+			if tc.cfg.ActionsIDTokenRequestURL == "" {
+				t.Setenv("ACTIONS_ID_TOKEN_REQUEST_URL", "")
+			}
+			if tc.cfg.ActionsIDTokenRequestToken == "" {
+				t.Setenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN", "")
+			}
 			tc.cfg.Credentials = &AzureGithubOIDCCredentials{} // only test this credential strategy
 			tc.cfg.DebugHeaders = true
 			if tc.wantHeaders == nil {