ci: run the Go race detector on concurrency-sensitive packages (APA-83 P8)

[Aparnap2]

Why

No workflow invoked go test -race. Data races in the packages that share mutable state would not fail CI — race coverage was manual-only, so a regression could ship green.

Scope — derived from actual concurrency surface

Not a blanket -race ./.... Verified surface:

• the only production goroutine spawn is cmd/api/main.go:159
• sync.Mutex / sync/atomic state lives in internal/investigate, internal/investigate/orchestrate, internal/ingest, internal/workflow, internal/worker, internal/ports (event bus), internal/observability, internal/metrics, internal/adapters/memblob

-race adds substantial runtime, so the step covers the packages that actually share mutable state. orchestrate is reached via ./internal/investigate/....

1 file, +22. No test, assertion, or gate modified — this only adds a step.

Evidence

Green baseline — all 10 packages under -race, provider keys and TEST_POSTGRES_DSN unset:

ok  claimops-api/internal/investigate            1.038s
ok  claimops-api/internal/investigate/orchestrate 4.614s
ok  claimops-api/internal/investigate/tools       1.057s
ok  claimops-api/internal/ingest                  1.044s
ok  claimops-api/internal/workflow                1.097s
ok  claimops-api/internal/worker                  1.290s
ok  claimops-api/internal/ports                   1.035s
ok  claimops-api/internal/observability           1.033s
ok  claimops-api/internal/metrics                 1.053s
ok  claimops-api/internal/adapters/memblob        1.033s
EXIT: 0

Negative control — the detector is proven active, not merely configured. A deliberate unsynchronized shared++ across 8 goroutines in internal/metrics (since reverted):

Run	Result
with -race	WARNING: DATA RACE → FAIL, exit 1
without -race	ok exit 0 — passes, race is timing-dependent
-race, 3 repeats	exit 1, 1, 1 — deterministic detection

The second row is the important one: the test passes on its own, so the detector, not the test, is what caught it. The control file was removed and is not part of this diff.

Live-provider safety

Live suites are not compiled into this scope. go test -race -list reports 0 live-named tests on a clean checkout — APA-82/APA-89 build tags hold. No live-provider test bodies executed.

Existing gates unchanged

gofmt clean · go vet clean · offline go test ./... exit 0 · pytest tests/unit 44 passed · ruff check . clean · mypy strict clean (9 source files) · isolation guard PASS.

Scope guard

Isolated from the other APA-83 gaps (P10/P12, P7, P11/P13–P15) and from P9. Release remains NOT QUALIFIED.

Refs APA-83 (P8). Next: P10/P12 PostgreSQL and Mockoon.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5dd87f73-85a1-4c78-869f-682bb849325b

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}