The tests of internal/coreruleset take about 60 seconds of the 90-second limit on go test in the Dockerfile's test phase, on next at 3093ed8 under this host's load. Each app added under #212 adds more: three PRs in flight add WordPress, Drupal and MediaWiki tests. Past 90 seconds, make check fails and next goes red.
Most of the time is spent loading the Core Rule Set: almost every test calls coreruleset.New, directly or through newCoreRuleSet, and loads and parses every rule again under -race, although most use the same few settings.
Definition of done, one PR into next, test files only:
In internal/coreruleset's tests, each set of settings (paranoia level, disabled rules, body limit, exclusions file) is loaded once per test run and shared by every test that uses it; a test that needs settings no other test uses still loads its own. Use the plainest form, such as sync.OnceValues per set or one small map behind a mutex, in coreruleset_test.go beside newCoreRuleSet.
No test is removed, merged or weakened: every request sent and every expected outcome stays the same.
The 90-second limit and the Dockerfile stay as they are.
internal/coreruleset's tests take well under half the limit in make test.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Label the PR needs-review.
Model: opus-5-5
The tests of `internal/coreruleset` take about 60 seconds of the 90-second limit on `go test` in the `Dockerfile`'s test phase, on `next` at `3093ed8` under this host's load. Each app added under https://git.eeqj.de/sneak/smallwebwaf/issues/212 adds more: three PRs in flight add WordPress, Drupal and MediaWiki tests. Past 90 seconds, `make check` fails and `next` goes red.
Most of the time is spent loading the Core Rule Set: almost every test calls `coreruleset.New`, directly or through `newCoreRuleSet`, and loads and parses every rule again under `-race`, although most use the same few settings.
**Definition of done**, one PR into `next`, test files only:
- In `internal/coreruleset`'s tests, each set of settings (paranoia level, disabled rules, body limit, exclusions file) is loaded once per test run and shared by every test that uses it; a test that needs settings no other test uses still loads its own. Use the plainest form, such as `sync.OnceValues` per set or one small map behind a mutex, in `coreruleset_test.go` beside `newCoreRuleSet`.
- No test is removed, merged or weakened: every request sent and every expected outcome stays the same.
- The 90-second limit and the `Dockerfile` stay as they are.
- `internal/coreruleset`'s tests take well under half the limit in `make test`.
- `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 21:27:16 +01:00
Loading was not the slow part. The WordPress and Drupal recorded-request loops were, at about 39 and 30 seconds. Load sharing alone left the package at about 43 seconds.
The PR also runs each recorded request as a parallel subtest. With the Coraza fix the package takes about 12 seconds.
Any concurrent use of one Core Rule Set hits a Coraza v3.8.1 race that refuses ordinary requests. That race also affects production, so it has its own issue: #254.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/253, which is red until https://git.eeqj.de/sneak/smallwebwaf/issues/254 lands.
- Loading was not the slow part. The WordPress and Drupal recorded-request loops were, at about 39 and 30 seconds. Load sharing alone left the package at about 43 seconds.
- The PR also runs each recorded request as a parallel subtest. With the Coraza fix the package takes about 12 seconds.
- Any concurrent use of one Core Rule Set hits a Coraza v3.8.1 race that refuses ordinary requests. That race also affects production, so it has its own issue: https://git.eeqj.de/sneak/smallwebwaf/issues/254.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The tests of
internal/corerulesettake about 60 seconds of the 90-second limit ongo testin theDockerfile's test phase, onnextat3093ed8under this host's load. Each app added under #212 adds more: three PRs in flight add WordPress, Drupal and MediaWiki tests. Past 90 seconds,make checkfails andnextgoes red.Most of the time is spent loading the Core Rule Set: almost every test calls
coreruleset.New, directly or throughnewCoreRuleSet, and loads and parses every rule again under-race, although most use the same few settings.Definition of done, one PR into
next, test files only:internal/coreruleset's tests, each set of settings (paranoia level, disabled rules, body limit, exclusions file) is loaded once per test run and shared by every test that uses it; a test that needs settings no other test uses still loads its own. Use the plainest form, such assync.OnceValuesper set or one small map behind a mutex, incoreruleset_test.gobesidenewCoreRuleSet.Dockerfilestay as they are.internal/coreruleset's tests take well under half the limit inmake test.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Label the PRneeds-review.Model: opus-5-5
Built in #253, which is red until #254 lands.
Model: opus-5-5