Move GOMODCACHE out of workspace

When GOMODCACHE is in the workspace, some of our make targets end
up running tests against non-Teleport Go modules.

.cloudbuild/scripts/cmd/integration-tests/main.go

@@ -24,7 +24,6 @@ import (
 	"log"
 	"os"
 	"os/exec"
-	"path"
 	"path/filepath"
 	"syscall"
 
@@ -93,7 +92,8 @@ func innerMain() error {
 		return trace.Wrap(err)
 	}
 
-	gomodcache := fmt.Sprintf("GOMODCACHE=%s", path.Join(args.workspace, gomodcacheDir))
+	moduleCacheDir := filepath.Join(os.TempDir(), gomodcacheDir)
+	gomodcache := fmt.Sprintf("GOMODCACHE=%s", moduleCacheDir)
 
 	log.Println("Analysing code changes")
 	ch, err := changes.Analyze(args.workspace, args.targetBranch, args.commitSHA)
@@ -113,15 +113,24 @@ func innerMain() error {
 		return trace.Wrap(err, "Root-only integration tests failed")
 	}
 	log.Println("Root-only integration tests passed.")
+
 	if !args.skipChown {
 		// We run some build steps as root and others as a non user, and we
 		// want the nonroot user to be able to manipulate the artifacts
-		// created by root, so we `chown -R` the whole workspace to allow it.
+		// created by root, so we `chown -R` the whole workspace & module
+		// cache to allow it.
+
 		log.Printf("Reconfiguring workspace for nonroot user")
 		err = chownR(args.workspace, nonrootUID, nonrootGID)
 		if err != nil {
 			return trace.Wrap(err, "failed reconfiguring workspace")
 		}
+
+		log.Printf("Reconfiguring module cache for nonroot user")
+		err = chownR(moduleCacheDir, nonrootUID, nonrootGID)
+		if err != nil {
+			return trace.Wrap(err, "failed reconfiguring module cache")
+		}
 	}
 
 	// Note that we run `etcd` as nonroot here. The files created by etcd live

.cloudbuild/scripts/cmd/unit-tests/main.go

@@ -19,22 +19,16 @@ package main
 import (
 	"context"
 	"flag"
-	"fmt"
 	"log"
 	"os"
 	"os/exec"
-	"path"
 	"path/filepath"
 
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/changes"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/etcd"
 	"github.com/gravitational/trace"
 )
 
-const (
-	gomodcacheDir = ".gomodcache-ci"
-)
-
 // main is just a stub that prints out an error message and sets a nonzero exit
 // code on failure. All of the work happens in `innerMain()`.
 func main() {
@@ -119,11 +113,9 @@ func innerMain() error {
 }
 
 func runUnitTests(workspace string) error {
-	gomodcache := fmt.Sprintf("GOMODCACHE=%s", path.Join(workspace, gomodcacheDir))
-
 	cmd := exec.Command("make", "test")
 	cmd.Dir = workspace
-	cmd.Env = append(os.Environ(), gomodcache, "TELEPORT_ETCD_TEST=yes")
+	cmd.Env = append(os.Environ(), "TELEPORT_ETCD_TEST=yes")
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 

Makefile

@@ -550,7 +550,6 @@ lint-go:
 	golangci-lint run -c .golangci.yml $(GO_LINT_FLAGS)
 
 # api is no longer part of the teleport package, so golangci-lint skips it by default
-# GOMODCACHE needs to be set here as api downloads dependencies and cannot write to /go/pkg/mod/cache
 .PHONY: lint-api
 lint-api: GO_LINT_API_FLAGS ?=
 lint-api: