TODO.md records "go test runs without -race" as an accepted divergence, justified by the mandated CGO_ENABLED=0 — the race detector needs cgo. The justification is correct for the shipped binary and wrong as a reason to never run the detector at all.
The riskiest code in this repo is precisely the concurrent part: the walk dispatcher (scan.go:619-648), the walk and hash worker pools (scan.go:590-613, scan.go:788-801), and the shared events / subdirs / results channels. Nothing currently checks any of it for races, and issues #5, #6 and #13 all add or change synchronization in exactly that code.
The org-standard make test recipe includes -race; this repo dropped it wholesale rather than isolating it.
Definition of done
A new script/test-race runs CGO_ENABLED=1 go test -race -timeout 60s ./... (or a -run subset covering the walk, scan and hash tests if the full suite is too slow), with a matching make test-race shim.
It is NOT wired into make check, so make check stays pure-Go and fast.
The Dockerfile lint and build stages keep CGO_ENABLED=0; the shipped binary stays pure Go with no new dependency on a C toolchain.
It is clean — any race it finds is fixed as part of this issue or filed separately with a reference here.
TODO.md's accepted-divergence note is rewritten to say the detector runs in a separate cgo-enabled target rather than not at all.
README §Build documents make test-race.
make check green and make test-race clean.
`TODO.md` records "go test runs without `-race`" as an accepted divergence, justified by the mandated `CGO_ENABLED=0` — the race detector needs cgo. The justification is correct for the shipped binary and wrong as a reason to never run the detector at all.
The riskiest code in this repo is precisely the concurrent part: the walk dispatcher (`scan.go:619-648`), the walk and hash worker pools (`scan.go:590-613`, `scan.go:788-801`), and the shared `events` / `subdirs` / `results` channels. Nothing currently checks any of it for races, and issues #5, #6 and #13 all add or change synchronization in exactly that code.
The org-standard `make test` recipe includes `-race`; this repo dropped it wholesale rather than isolating it.
## Definition of done
1. A new `script/test-race` runs `CGO_ENABLED=1 go test -race -timeout 60s ./...` (or a `-run` subset covering the walk, scan and hash tests if the full suite is too slow), with a matching `make test-race` shim.
2. It is NOT wired into `make check`, so `make check` stays pure-Go and fast.
3. The Dockerfile lint and build stages keep `CGO_ENABLED=0`; the shipped binary stays pure Go with no new dependency on a C toolchain.
4. It is clean — any race it finds is fixed as part of this issue or filed separately with a reference here.
5. `TODO.md`'s accepted-divergence note is rewritten to say the detector runs in a separate cgo-enabled target rather than not at all.
6. README §Build documents `make test-race`.
7. `make check` green and `make test-race` clean.
clawbot
added this to the 1.0.0 milestone 2026-08-09 03:46:29 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
TODO.mdrecords "go test runs without-race" as an accepted divergence, justified by the mandatedCGO_ENABLED=0— the race detector needs cgo. The justification is correct for the shipped binary and wrong as a reason to never run the detector at all.The riskiest code in this repo is precisely the concurrent part: the walk dispatcher (
scan.go:619-648), the walk and hash worker pools (scan.go:590-613,scan.go:788-801), and the sharedevents/subdirs/resultschannels. Nothing currently checks any of it for races, and issues #5, #6 and #13 all add or change synchronization in exactly that code.The org-standard
make testrecipe includes-race; this repo dropped it wholesale rather than isolating it.Definition of done
script/test-racerunsCGO_ENABLED=1 go test -race -timeout 60s ./...(or a-runsubset covering the walk, scan and hash tests if the full suite is too slow), with a matchingmake test-raceshim.make check, somake checkstays pure-Go and fast.CGO_ENABLED=0; the shipped binary stays pure Go with no new dependency on a C toolchain.TODO.md's accepted-divergence note is rewritten to say the detector runs in a separate cgo-enabled target rather than not at all.make test-race.make checkgreen andmake test-raceclean.