The larger demo estate overflowed the rollups mock test's single
500-row page and pushed internal/api past the 25m -race budget, and
the alert history tests raced TempDir cleanup by never joining the
periodic save worker.
Walk every rollups page in the integration test, raise the shard
budget to 50m, and stop history managers through Stop() so the save
worker is joined before cleanup.
Contract-Neutral: test-only CI fix: paginate rollups mock test, join history save worker in test teardown, raise shard go test timeout for the 50-node demo estate; no runtime or contract delta
Build and Test audits npm dependencies on every push, but nothing scans the
Go module for known vulnerabilities and neither surface is re-checked when
no pushes happen — which is exactly when a newly disclosed advisory against
unchanged code goes unnoticed. Run govulncheck and both npm audits weekly on
a schedule so a failed run emails the maintainer.
* Make release dry-run diagnostics fail closed
Select the installed Chromium project with retries disabled, replace the unconditional pass with fail-closed API and rendered-UI readiness assertions, retain actionable runtime evidence, and guard the release workflow contract against regression.
Contract-Neutral: Release diagnostic and workflow verification hardening only; no product runtime contract changes.
* Expose stable E2E failure identities
Project Playwright JUnit failures into bounded GitHub annotations so repeated stable-tier failures can be diagnosed without rerunning or weakening the gate. Keep the full reports and runtime logs as the forensic record, and cover annotation parsing and escaping with deterministic tests.
Contract-Neutral: This changes CI failure observability only and does not alter product runtime behavior, stable-tier membership, retries, or verdict semantics.
---------
Co-authored-by: rcourtman <rcourtman@users.noreply.github.com>
Reapply the still-applicable exact-candidate tool setup hardening and its workflow contract assertions on current main. Current main already contains the native-path Docker and host fixtures plus the prescribed resource guardrail source path.
Contract-Neutral: Release-workflow hardening and test-fixture portability do not change the product runtime contract.
Co-authored-by: rcourtman <rcourtman@users.noreply.github.com>
The internal/api race suite now routinely exceeds the old 20-minute package timeout on hosted runners while passing. Set a governed 30-minute package timeout and 40-minute release job ceiling, pin the relationship with contract tests, and refresh the rc.4 packet with the fixes landed since preparation.
pulse-triage[bot]