sneak
3d615ef612
Some checks failed
check / check (push) Failing after 1m45s
script/test ended with `go test ./... || go test -v ./...`, so the verbose rerun's exit status became the script's. A test that failed once and passed on the retry produced exit 0, and since the Dockerfile runs `make test` and CI runs script/cibuild, flaky failures were invisible repo-wide. Replace that with the pattern from REPO_POLICIES.md: run `go test -timeout 30s -race -cover ./...`, and on failure rerun verbosely and then exit 1, so the rerun is diagnostic only and can never turn a failed run green. `go vet ./...` still runs first; the script stays POSIX sh with set -eu, the CGO_ENABLED=1 export, and the repo-root cd idiom. Enabling -race surfaced a genuine timing conflict rather than a data race: no package that ran to completion reported one, but internal/cli now exceeds the 30s timeout because the 99MB/100MB boundary cases in secrets_size_test.go are about 10x slower under race instrumentation. Measured in the CI-equivalent container (script/cibuild, with the memlock ulimit): 18.7s for the make test layer without -race, versus internal/cli alone needing roughly 55-60s with it. Neither the flags nor the tests were weakened to hide this; the conflict is filed as #52 for a decision.