From 10720de9fbfe13fbcb55cdbc9e636e629ba67f00 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 23 Jul 2026 06:39:03 +0000
Subject: [PATCH] Harden CI: download deps, check fmt/vet/tidy, race tests

The test workflow ran `go mod tidy` as its dependency step, which mutates
go.mod/go.sum inside CI and would hide an untidy module rather than catch
it. It also ran no formatting, vet, or race checks.

- Install deps with `go mod download` (non-mutating).
- Fail the build on non-gofmt-ed files and on `go vet` findings.
- Verify go.mod/go.sum are tidy via `go mod tidy` + `git diff --exit-code`.
- Run tests with `-race`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pc6NAURAqjU4LYJx93tgSC
---
 .github/workflows/test.yml | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e608a28..5c2b674 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,8 +24,25 @@ jobs:
         with:
           go-version: ${{ steps.go-version.outputs.go-version }}
 
-      - name: Install dependencies
-        run: go mod tidy
+      - name: Download dependencies
+        run: go mod download
+
+      - name: Check formatting
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "The following files are not gofmt-ed:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Verify go.mod and go.sum are tidy
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
 
       - name: Run tests
-        run: go test ./...
+        run: go test -race ./...