check / check (push) Failing after 7m12s
The tests that check the apps' recorded requests move to internal/coreruleset/recorded_test.go, behind the recorded build tag. The test phase runs them in a second go test, without -race. The Gitea and WordPress tests are split in two. Their recorded-request loops become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass; their attack checks stay in the race pass as TestGiteaAttacksAreRefused and TestWordPressAttacksAreRefused. Model: opus-5-5