From 822b523cbd94cf9529f7237d81ed1bf20c1bb5c9 Mon Sep 17 00:00:00 2001
From: Sam Calder-Mason <sam@puritydev.io>
Date: Fri, 12 Jun 2026 12:22:21 +1000
Subject: [PATCH 1/2] ci: add govulncheck, race detector, build and vet; fix
 cache test race

---
 .github/workflows/govulncheck.yaml | 30 +++++++++++++++++
 .github/workflows/test.yaml        |  8 ++++-
 pkg/cache/ttl_test.go              | 52 +++++++++++++-----------------
 3 files changed, 60 insertions(+), 30 deletions(-)
 create mode 100644 .github/workflows/govulncheck.yaml

diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml
new file mode 100644
index 00000000..decdd9f1
--- /dev/null
+++ b/.github/workflows/govulncheck.yaml
@@ -0,0 +1,30 @@
+name: govulncheck
+
+on:
+  pull_request:
+
+  push:
+    branches:
+      - master
+
+  schedule:
+    - cron: '0 7 * * 1'
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: govulncheck
+        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
+        with:
+          go-version-file: go.mod
+          repo-checkout: false
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index c5df913a..bda39d30 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -23,5 +23,11 @@ jobs:
         with:
           go-version: ${{ matrix.go_version }}
 
+      - name: build
+        run: go build ./...
+
+      - name: vet
+        run: go vet ./...
+
       - name: run tests
-        run: go test ./...
+        run: go test -race ./...
diff --git a/pkg/cache/ttl_test.go b/pkg/cache/ttl_test.go
index b94cb501..09b86b03 100644
--- a/pkg/cache/ttl_test.go
+++ b/pkg/cache/ttl_test.go
@@ -96,45 +96,39 @@ func TestMaxItemsEvictsOldest(t *testing.T) {
 func TestCallbacks(t *testing.T) {
 	instance := NewTTLMap(10, "", "")
 
-	evictedCallback := false
+	// Callbacks fire in their own goroutines, so synchronise on channels
+	// rather than reading shared state after a sleep.
+	evicted := make(chan [2]string, 1)
+	added := make(chan [2]string, 1)
 
 	instance.OnItemDeleted(func(key string, value interface{}, expiresAt time.Time) {
-		if key != "key4" {
-			t.Fatalf("Expected key to be key4, got %s", key)
-		}
-
-		if value != "value4" {
-			t.Fatalf("Expected value to be value4, got %s", value)
-		}
-
-		evictedCallback = true
+		str, _ := value.(string)
+		evicted <- [2]string{key, str}
 	})
 
-	addedCallback := false
-
 	instance.OnItemAdded(func(key string, value interface{}, expiresAt time.Time) {
-		if key != "key4" {
-			t.Fatalf("Expected key to be key4, got %s", key)
-		}
-
-		if value != "value4" {
-			t.Fatalf("Expected value to be value4, got %s", value)
-		}
-
-		addedCallback = true
+		str, _ := value.(string)
+		added <- [2]string{key, str}
 	})
 
 	instance.Add("key4", "value4", time.Now().Add(time.Hour), false)
 	instance.Delete("key4")
 
-	time.Sleep(time.Second * 1)
-
-	if !evictedCallback {
-		t.Fatalf("Expected evicted callback to have been called")
-	}
-
-	if !addedCallback {
-		t.Fatalf("Expected added callback to have been called")
+	for _, tc := range []struct {
+		name string
+		ch   chan [2]string
+	}{
+		{"added", added},
+		{"evicted", evicted},
+	} {
+		select {
+		case got := <-tc.ch:
+			if got[0] != "key4" || got[1] != "value4" {
+				t.Fatalf("%s callback: expected key4/value4, got %s/%s", tc.name, got[0], got[1])
+			}
+		case <-time.After(time.Second * 5):
+			t.Fatalf("Expected %s callback to have been called", tc.name)
+		}
 	}
 }
 

From 9441eaea0d4f08ac63573a06418fcfbc871ee2d0 Mon Sep 17 00:00:00 2001
From: Sam Calder-Mason <sam@puritydev.io>
Date: Fri, 12 Jun 2026 12:54:22 +1000
Subject: [PATCH 2/2] ci: only flag new lint issues; move govulncheck gate to
 the dependency-bump PR

---
 .github/workflows/golangci-lint.yaml |  4 ++--
 .github/workflows/govulncheck.yaml   | 30 ----------------------------
 2 files changed, 2 insertions(+), 32 deletions(-)
 delete mode 100644 .github/workflows/govulncheck.yaml

diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml
index ce7054a8..85af0445 100644
--- a/.github/workflows/golangci-lint.yaml
+++ b/.github/workflows/golangci-lint.yaml
@@ -9,7 +9,7 @@ on:
 permissions:
   contents: read
   # Optional: allow read access to pull request. Use with `only-new-issues` option.
-  # pull-requests: read
+  pull-requests: read
 jobs:
   golangci:
     name: lint
@@ -32,7 +32,7 @@ jobs:
           # args: --issues-exit-code=0
 
           # Optional: show only new issues if it's a pull request. The default value is `false`.
-          # only-new-issues: true
+          only-new-issues: true
 
           # Optional: if set to true then the all caching functionality will be complete disabled,
           #           takes precedence over all other caching options.
diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml
deleted file mode 100644
index decdd9f1..00000000
--- a/.github/workflows/govulncheck.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: govulncheck
-
-on:
-  pull_request:
-
-  push:
-    branches:
-      - master
-
-  schedule:
-    - cron: '0 7 * * 1'
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  govulncheck:
-    runs-on: ubuntu-24.04
-
-    steps:
-      - name: checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: govulncheck
-        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
-        with:
-          go-version-file: go.mod
-          repo-checkout: false