Parity sweep: burn down items_still_open across all AWS services (685 → 161)

.github/workflows/ci.yml

@@ -149,13 +149,33 @@ jobs:
           token: ${{ env.GH_CI_TOKEN }}
           persist-credentials: false
 
-      - name: govulncheck
-        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version-file: go.mod
-          go-package: ./...
-          output-format: sarif
-          output-file: govulncheck.sarif
+          go-version: '1.27'
+          check-latest: true
+          cache: true
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@19b0bb6a272792b9afa8a6983c3e9b9a1816947f
+
+      # Source mode (./...) peaks at ~11 GB RSS and ~20 min on this module and
+      # OOM-kills the runner; binary mode scans the shipped binary in ~0.5 GB.
+      - name: Build gopherstack binary
+        run: go build -o "$RUNNER_TEMP/gopherstack" .
+
+      - name: Run govulncheck and save to file
+        run: govulncheck -mode=binary -format sarif "$RUNNER_TEMP/gopherstack" > govulncheck-raw.sarif
+
+      # Binary mode emits identical stacks (schema requires unique items) and no
+      # locations (code scanning requires one); anchor to go.mod:1 like source mode.
+      - name: Normalize SARIF for code scanning
+        run: |
+          jq '.runs[].results[] |= (
+            (if .stacks then .stacks |= unique else . end)
+            | (if (.locations // []) | length == 0
+               then .locations = [{physicalLocation: {artifactLocation: {uri: "go.mod"}, region: {startLine: 1}}}]
+               else . end))' govulncheck-raw.sarif > govulncheck.sarif
 
       - name: Upload govulncheck SARIF
         if: always()
@@ -204,6 +224,23 @@ jobs:
         with:
           category: "/language:${{ matrix.language }}"
 
+  leak-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          token: ${{ env.GH_CI_TOKEN }}
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+
+      - name: Run leak tests
+        run: make leak-test
+
   unit-tests:
     runs-on: ubuntu-latest
     strategy:
@@ -272,7 +309,7 @@ jobs:
       - name: Run Unit Tests (chunk ${{ matrix.chunk }})
         run: |
           go tool gotestsum --format pkgname -- \
-            -race -shuffle on -short -timeout 10m \
+            -race -shuffle on -short -timeout 20m \
             -coverpkg="${{ steps.pkgs.outputs.coverpkgs }}" -coverprofile=unit-${{ matrix.chunk }}-coverage.out -covermode=atomic \
             ${{ steps.pkgs.outputs.pkgs }}
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build build-check ui-install ui-lint ui-check ui-lint-fix ui-fmt ui-fmt-fix ui-test ui-build install-deps install-tofu lint lint-changed lint-fix test integration-test terraform-test e2e e2e-test total-coverage clean demo all dev-mcp-install dev-mcp-check pgo docs check-pins bd-audit parity-lint cfn-attrs-gen cfn-attrs-spec-refresh
+.PHONY: build build-check ui-install ui-lint ui-check ui-lint-fix ui-fmt ui-fmt-fix ui-test ui-build install-deps install-tofu lint lint-changed lint-fix test leak-test integration-test terraform-test e2e e2e-test total-coverage clean demo all dev-mcp-install dev-mcp-check pgo docs check-pins bd-audit parity-lint cfn-attrs-gen cfn-attrs-spec-refresh
 
 BINARY_NAME=gopherstack
 VERSION_PKG=github.com/blackbirdworks/gopherstack/pkgs/version
@@ -155,6 +155,9 @@ lint-fix: install-deps ui-lint-fix ui-fmt-fix
 test:
 	go tool gotestsum --format pkgname -- -race -shuffle on -short ./...
 
+leak-test:
+	go tool gotestsum --format pkgname -- -race -count=1 -timeout 20m -run TestLeak .
+
 integration-test: build-linux
 	go tool gotestsum --format pkgname -- -race -shuffle on -timeout 10m ./test/integration/...