Merge pull request #4497 from gofiber/ci/v2-gotestsum-rerun-fails

fix(proxy) + ci: fix proxy data race and get the v2 CI green

Author: ReneWerner87

.github/workflows/codeql-analysis.yml

@@ -13,13 +13,25 @@ on:
       - "!**.md"
 
 name: Test
+
+# Least-privilege GITHUB_TOKEN: both jobs only check out and run tests.
+permissions:
+  contents: read
+
 jobs:
   Build:
     strategy:
+      fail-fast: false
       matrix:
-        go-version: [1.17.x, 1.18.x, 1.19.x, 1.20.x, 1.21.x, 1.22.x, 1.23.x]
-        platform: [ubuntu-latest, windows-latest, macos-latest]
+        # Floor is 1.20 to match the module's go.mod (go 1.20).
+        go-version: [1.20.x, 1.21.x, 1.22.x, 1.23.x]
+        # No macOS: the current macos-latest runners (macOS 26, arm64) abort
+        # binaries built by Go <= 1.23 with "dyld: missing LC_UUID load
+        # command", so v2's supported Go range cannot run there. ubuntu and
+        # windows cover the matrix.
+        platform: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.platform }}
+    timeout-minutes: 20
     steps:
       - name: Fetch Repository
         uses: actions/checkout@v4
@@ -29,9 +41,34 @@ jobs:
         with:
           go-version: ${{ matrix.go-version }}
 
+      # Whole-suite retry, without -race and without -shuffle in the blocking
+      # job: the suite has pre-existing data races (whose -race abort fails the
+      # run) and order-dependent tests (which -shuffle exposes). gotestsum's
+      # per-test rerun cannot absorb these because the recover test prints a
+      # literal "panic:" (via debug.Stack), which makes gotestsum treat the
+      # whole run as a suspected panic and refuse to rerun. Race detection runs
+      # in the separate non-blocking Race job below.
       - name: Run Test
         uses: nick-fields/retry@v2
         with:
           max_attempts: 3
           timeout_minutes: 15
-          command: go test ./... -v -race -count=1
+          command: go test ./... -count=1
+
+  # Non-blocking: surfaces the suite's pre-existing data races without gating
+  # merges on them. Fix the races over time, then fold -race into Build.
+  Race:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    timeout-minutes: 20
+    steps:
+      - name: Fetch Repository
+        uses: actions/checkout@v4
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: 1.23.x
+
+      - name: Test (race)
+        run: go test ./... -race -count=1 -shuffle=on

.github/workflows/test.yml

@@ -249,8 +249,9 @@ func Test_Proxy_Forward_WithTlsConfig(t *testing.T) {
 	addr := ln.Addr().String()
 	clientTLSConf := &tls.Config{InsecureSkipVerify: true} //nolint:gosec // We're in a test func, so this is fine
 
-	// disable certificate verification
-	WithTlsConfig(clientTLSConf)
+	// disable certificate verification by swapping the whole global client
+	// (WithTlsConfig mutates the shared client's field and races with parallel proxy tests)
+	WithClient(&fasthttp.Client{TLSConfig: clientTLSConf})
 	app.Use(Forward("https://" + addr + "/tlsfwd"))
 
 	go func() { utils.AssertEqual(t, nil, app.Listener(ln)) }()
@@ -565,7 +566,9 @@ func Test_Proxy_DoDeadline_PastDeadline(t *testing.T) {
 
 	app := fiber.New()
 	app.Get("/test", func(c *fiber.Ctx) error {
-		return DoDeadline(c, "http://"+addr, time.Now().Add(time.Second))
+		// Deadline is longer than app.Test's 1000ms timeout so the test timeout
+		// deterministically fires first (avoids two coincident 1s timers racing).
+		return DoDeadline(c, "http://"+addr, time.Now().Add(2*time.Second))
 	})
 
 	_, err1 := app.Test(httptest.NewRequest(fiber.MethodGet, "/test", nil))