Core Rule Set tests: only the concurrency test runs with the race detector (closes #306)

Of internal/coreruleset's tests, the race pass runs only those written to
check concurrent inspection, selected by the name prefix TestConcurrent.
Every other test of the package moves to the pass that runs the recorded
requests, without the race detector. Other packages run under -race as
before. The 90-second limit stays.

Model: opus-5-5

Dockerfile

@@ -42,20 +42,35 @@ RUN go mod tidy -diff || \
 # Go's build cache is kept on a tmpfs, out of the image: nothing uses it
 # after this step, and writing it into the image takes seconds. The tests
 # are built with the no_fs_access tag, as the binary is in the build stage.
+#
+# The race detector finds bugs only in code that runs in several goroutines
+# at once. Of the Core Rule Set's tests, this pass runs only those written
+# to check concurrent inspection, whose names start with TestConcurrent.
+# The second pass runs the rest.
 FROM test-setup AS test-race
 
 RUN --mount=type=tmpfs,target=/root/.cache/go-build \
-    go test -tags no_fs_access -timeout 90s -race -cover ./... || \
+    others="$(go list ./... | grep -vxF sneak.berlin/go/smallwebwaf/internal/coreruleset)"; \
+    { go test -tags no_fs_access -timeout 90s -race -cover $others && \
+      go test -tags no_fs_access -timeout 90s -race -cover \
+        -run '^TestConcurrent' ./internal/coreruleset; } || \
     { echo "--- Rerunning with -v for details ---"; \
-      go test -tags no_fs_access -timeout 90s -race -v ./...; exit 1; }
+      go test -tags no_fs_access -timeout 90s -race -v $others; \
+      go test -tags no_fs_access -timeout 90s -race -v \
+        -run '^TestConcurrent' ./internal/coreruleset; \
+      exit 1; }
 
-# Second pass: the recorded requests, too slow for make test under -race.
+# Second pass: every other test of the Core Rule Set, the recorded requests
+# among them, without the race detector.
 FROM test-setup AS test-recorded
 
 RUN --mount=type=tmpfs,target=/root/.cache/go-build \
-    go test -tags no_fs_access,recorded -timeout 90s -cover -run '^TestOrdinary' ./internal/coreruleset/... || \
+    go test -tags no_fs_access,recorded -timeout 90s -cover \
+        -skip '^TestConcurrent' ./internal/coreruleset || \
     { echo "--- Rerunning with -v for details ---"; \
-      go test -tags no_fs_access,recorded -timeout 90s -run '^TestOrdinary' -v ./internal/coreruleset/...; exit 1; }
+      go test -tags no_fs_access,recorded -timeout 90s -v \
+        -skip '^TestConcurrent' ./internal/coreruleset; \
+      exit 1; }
 
 # The test phase that script/test and the build stage name. Nothing is
 # wanted from the two passes; the copies are what make BuildKit run them.

README.md

@@ -702,8 +702,12 @@ on the host.
 - `script/projectname`: prints `smallwebwaf`, which the other scripts tag their
   images with.
 - `script/test`: checks that `go.mod` and `go.sum` are tidy, then runs the
-  tests, as the `test` phase of the `Dockerfile`. It runs them twice: once with
-  the race detector, and once without it for the recorded requests. `make test`.
+  tests, as the `test` phase of the `Dockerfile`, in two passes. `make test`.
+    - The first runs every package's tests with the race detector. Of the Core
+      Rule Set's tests, it runs only those written to check concurrent
+      inspection, whose names start with `TestConcurrent`.
+    - The second runs the Core Rule Set's other tests without the race detector,
+      the recorded requests among them.
 - `script/tidy`: writes `go.mod` and `go.sum` as `go mod tidy` writes them, in
   the `tidy` stage of the `Dockerfile`. `make tidy`.
 - `script/lint`: runs golangci-lint, as the `lint` phase of the `Dockerfile`.