Chore/parity upgrade

.dockerignore

@@ -1,6 +1,7 @@
 .git
 bin/
 !bin/gopherstack
+!bin/gopherstack-linux
 test/e2e/failures/
 coverage.out
 coverage.html

.github/workflows/ci.yml

@@ -49,6 +49,8 @@ jobs:
 
       - name: Run UI type check
         run: npm --prefix ui run check
+        env:
+          NODE_OPTIONS: --max-old-space-size=8192
 
   lint:
     runs-on: ubuntu-latest
@@ -84,6 +86,29 @@ jobs:
       - name: go fix (modernize)
         run: go fix -diff ./...
 
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          token: ${{ env.GH_CI_TOKEN }}
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+
+      - name: Check sdk_module pins
+        run: make check-pins
+
+      - name: Generate docs
+        run: make docs
+
+      - name: Fail if docs are out of date
+        run: git diff --exit-code
+
   govulncheck:
     runs-on: ubuntu-latest
     steps:
@@ -233,13 +258,13 @@ jobs:
           mkdir -p dashboard/static/spa
           touch dashboard/static/spa/.keep
           CGO_ENABLED=0 GOOS=linux go build -tags 'netgo osusergo static_build' -trimpath \
-            -ldflags="-w -s" -o bin/gopherstack .
+            -ldflags="-w -s" -o bin/gopherstack-linux .
 
       - name: Upload binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: gopherstack-binary
-          path: bin/gopherstack
+          path: bin/gopherstack-linux
           retention-days: 1
 
   integration-tests:
@@ -279,7 +304,7 @@ jobs:
           path: bin/
 
       - name: Make binary executable
-        run: chmod +x bin/gopherstack
+        run: chmod +x bin/gopherstack-linux
 
       - name: Compute test pattern for chunk
         id: tests
@@ -297,7 +322,7 @@ jobs:
 
       - name: Run Integration Tests (chunk ${{ matrix.chunk }})
         run: |
-          echo "bin/gopherstack exists: $(test -f bin/gopherstack && echo yes || echo no)"
+          echo "bin/gopherstack-linux exists: $(test -f bin/gopherstack-linux && echo yes || echo no)"
           go tool gotestsum --format standard-verbose -- \
             -race -shuffle on -timeout 10m -v \
             -run '${{ steps.tests.outputs.pattern }}' \
@@ -361,7 +386,7 @@ jobs:
           path: bin/
 
       - name: Make binary executable
-        run: chmod +x bin/gopherstack
+        run: chmod +x bin/gopherstack-linux
 
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2
@@ -392,7 +417,7 @@ jobs:
       - name: Run OpenTofu Tests (chunk ${{ matrix.chunk }})
         run: |
           echo "tofu version: $(tofu version)"
-          echo "bin/gopherstack exists: $(test -f bin/gopherstack && echo yes || echo no)"
+          echo "bin/gopherstack-linux exists: $(test -f bin/gopherstack-linux && echo yes || echo no)"
           go tool gotestsum --format standard-verbose -- \
             -race -parallel 8 -timeout 15m \
             -run '${{ steps.tests.outputs.pattern }}' \
@@ -427,6 +452,8 @@ jobs:
 
       - name: Build UI
         working-directory: ui
+        env:
+          NODE_OPTIONS: --max-old-space-size=8192
         run: |
           npm ci
           npm run build
@@ -483,6 +510,8 @@ jobs:
 
       - name: Run UI Tests
         working-directory: ui
+        env:
+          NODE_OPTIONS: --max-old-space-size=8192
         run: npx vitest run
 
   coverage:

.golangci.yml

@@ -502,6 +502,27 @@ linters:
       # injectable RNG field, so it must live in the same package.
       - path: 'route53/routing_test.go'
         linters: [ testpackage ]
+      # ordering_requirements_test.go white-box tests buildOrderingRequirements
+      # and its unexported per-check helpers directly with hand-built Site/
+      # Outpost structs -- several of the real OrderingRequirementType checks
+      # (SHIPPING_ADDRESS_MISSING_CONTACT_*) need a partially-populated Address
+      # the real SDK client's own validators.go refuses to construct (every
+      # Address field is client-side required once OperatingAddress/
+      # ShippingAddress is non-nil), so this cannot be reached through the
+      # real SDK client the way this package's other tests are.
+      - path: 'outposts/ordering_requirements_test.go'
+        linters: [ testpackage ]
+      # iotanalytics is AWS-deprecated (no longer available for use), so every
+      # SDK type/method/field the client touches carries an SA1019 deprecation
+      # notice -- gopherstack still emulates it, so the whole file is exempt
+      # rather than sprinkling ~15 identical inline nolints.
+      - path: 'iotanalytics/handler_create_tags_test.go'
+        linters: [ staticcheck ]
+      # Same reasoning as iotanalytics/handler_create_tags_test.go above -- this
+      # cli.go composition-root wiring test also drives the deprecated iotanalytics
+      # SDK client end to end.
+      - path: 'cli_iotanalytics_lambda_iot_wiring_test.go'
+        linters: [ staticcheck ]
       - path: 'pkgs/service/cloudtrail_capture_test.go'
         linters: [ testpackage ]
       - path: 'pkgs/service/registry_test.go'
@@ -515,6 +536,20 @@ linters:
         linters: [ testpackage ]
       - path: 'autoscaling/scheduled_action_scheduler_test.go'
         linters: [ testpackage ]
+      # whitebox_test.go: the export_test.go cleanup (gopherstack-f84y) moved
+      # tests needing unexported field/const access out of the external _test
+      # package into these in-package files instead of re-exporting test-only
+      # helpers. One shared rule covers every service's whitebox_test.go.
+      - path: 'whitebox_test\.go$'
+        linters: [ testpackage ]
+      - path: 'sdkcheck/check_test.go'
+        linters: [ testpackage ]
+      - path: 'pkgs/telemetry/collector_test.go'
+        linters: [ testpackage ]
+      - path: 'cognitoidentity/errors_test.go'
+        linters: [ testpackage ]
+      - path: 'glacier/select_sql_test.go'
+        linters: [ testpackage ]
       - text: 'should have a package comment'
         linters: [ revive ]
       - text: 'exported \S+ \S+ should have comment( \(or a comment on this block\))? or be unexported'

AGENTS.md

@@ -11,6 +11,11 @@ go vet ./services/<pkg>/...
 golangci-lint run ./services/<pkg>/...
 ```
 
+`make lint` also runs mulint (mutex misuse detection) via `go vet -vettool`.
+mulint cannot follow mutex wrappers across package boundaries, so it does
+**not** see `lockmetrics.RWMutex` (used almost everywhere in this repo) — it
+only guards direct `sync.Mutex`/`sync.RWMutex` use.
+
 
 **Logging — context-aware only (no exceptions):**
 - NEVER call `slog.Default()` or construct an ad-hoc `slog.New(...)` in service/production

Dockerfile.test

@@ -1,6 +1,8 @@
-# Lightweight test image — expects a pre-built static binary at bin/gopherstack.
+# Lightweight test image — expects a pre-built static binary at bin/gopherstack-linux
+# (from `make build-linux`; this is a separate path from `make build`'s bin/gopherstack
+# so the two targets can't clobber each other — see gopherstack-gooq).
 FROM scratch
-COPY bin/gopherstack /root/gopherstack
+COPY bin/gopherstack-linux /root/gopherstack
 EXPOSE 8000
 EXPOSE 1883
 CMD ["/root/gopherstack"]

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build ui-install ui-lint ui-check ui-lint-fix ui-fmt ui-fmt-fix ui-test ui-build install-deps install-tofu lint lint-fix test integration-test terraform-test e2e e2e-test total-coverage clean demo all dev-mcp-install dev-mcp-check pgo docs
+.PHONY: build ui-install ui-lint ui-check ui-lint-fix ui-fmt ui-fmt-fix ui-test ui-build install-deps install-tofu lint lint-fix test integration-test terraform-test e2e e2e-test total-coverage clean demo all dev-mcp-install dev-mcp-check pgo docs check-pins
 
 BINARY_NAME=gopherstack
 VERSION_PKG=github.com/blackbirdworks/gopherstack/pkgs/version
@@ -17,7 +17,7 @@ ui-lint: ui-install
 	PATH="/opt/homebrew/bin:$(PATH)" npm --prefix ui run lint
 
 ui-check: ui-install
-	PATH="/opt/homebrew/bin:$(PATH)" NODE_OPTIONS="--max-old-space-size=4096" npm --prefix ui run check
+	PATH="/opt/homebrew/bin:$(PATH)" NODE_OPTIONS="--max-old-space-size=8192" npm --prefix ui run check
 
 ui-lint-fix: ui-install
 	PATH="/opt/homebrew/bin:$(PATH)" npm --prefix ui run lint:fix
@@ -29,19 +29,25 @@ ui-fmt-fix: ui-install
 	PATH="/opt/homebrew/bin:$(PATH)" npm --prefix ui run fmt
 
 ui-test: ui-install
-	PATH="/opt/homebrew/bin:$(PATH)" NODE_OPTIONS="--max-old-space-size=4096" npm --prefix ui run test:coverage
+	PATH="/opt/homebrew/bin:$(PATH)" NODE_OPTIONS="--max-old-space-size=8192" npm --prefix ui run test:coverage
 
 ui-build: ui-install
 	mkdir -p dashboard/static/spa
 	find dashboard/static/spa -mindepth 1 ! -name '.keep' -exec rm -rf {} +
-	PATH="/opt/homebrew/bin:$(PATH)" NODE_OPTIONS="--max-old-space-size=4096" npm --prefix ui run build
+	PATH="/opt/homebrew/bin:$(PATH)" NODE_OPTIONS="--max-old-space-size=8192" npm --prefix ui run build
+	@# Embedded so a browser repro / server log can show what SPA is actually
+	@# running instead of silently serving a stale go:embed artifact (gopherstack-0rkc).
+	echo "{\"builtAt\":\"$$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"commit\":\"$$(git rev-parse --short HEAD 2>/dev/null || echo unknown)\"}" > dashboard/static/spa/build-stamp.json
 	touch dashboard/static/spa/.keep
 
+# Distinct output path from `build`: both used to write bin/gopherstack, so
+# running `make build` (dynamic) while integration tests were mid-flight
+# silently replaced the static binary Dockerfile.test's `FROM scratch` needs.
 build-linux:
 	CGO_ENABLED=0 GOOS=linux go build \
 		-trimpath \
 		-ldflags "-w -s -X $(VERSION_PKG).Build=$(BUILD_VERSION)" \
-		-o bin/$(BINARY_NAME) .
+		-o bin/$(BINARY_NAME)-linux .
 
 install-deps:
 	@echo "Checking for golangci-lint..."
@@ -123,6 +129,7 @@ install-tofu:
 
 lint: install-deps ui-lint ui-fmt ui-check
 	golangci-lint run --timeout 20m ./...
+	go vet -vettool=$$(go tool -n mulint-vet) ./...
 	go tool govulncheck ./...
 
 lint-fix: install-deps ui-lint-fix ui-fmt-fix
@@ -138,7 +145,7 @@ integration-test: build-linux
 	go tool gotestsum --format pkgname -- -race -shuffle on -timeout 10m ./test/integration/...
 
 terraform-test: install-tofu
-	PATH="$$PWD/bin:$$PATH" go tool gotestsum --format pkgname -- -v -race -parallel 8 -timeout 10m ./test/terraform/...
+	PATH="$$PWD/bin:$$PATH" go tool gotestsum --format pkgname -- -v -race -parallel 8 -timeout 45m ./test/terraform/...
 
 e2e: e2e-test
 
@@ -148,11 +155,14 @@ e2e-test: ui-build
 total-coverage: build-linux
 	$(eval COVERPKGS := $(shell go list ./... | grep -v -E '(test/|/demo$$|/modules/|/teststack$$)' | tr '\n' ',' | sed 's/,$$//'))
 	@echo "Running unit tests with coverage..."
-	go tool gotestsum --format pkgname -- -race -shuffle on -short -timeout 5m -coverpkg=$(COVERPKGS) -coverprofile=unit-coverage.out -covermode=atomic ./...
+	@# Same -race -shuffle on -short ./... as the `test` target (go test's own
+	@# default timeout, 10m, applies there) plus coverage instrumentation
+	@# overhead, so this step needs at least as much room, not less.
+	go tool gotestsum --format pkgname -- -race -shuffle on -short -timeout 10m -coverpkg=$(COVERPKGS) -coverprofile=unit-coverage.out -covermode=atomic ./...
 	@echo "Running integration tests with coverage..."
 	go tool gotestsum --format pkgname -- -race -shuffle on -timeout 10m -coverpkg=$(COVERPKGS) -coverprofile=integration-coverage.out -covermode=atomic ./test/integration/...
 	@echo "Running terraform tests with coverage..."
-	go tool gotestsum --format pkgname -- -race -parallel 8 -timeout 20m -coverpkg=$(COVERPKGS) -coverprofile=terraform-coverage.out -covermode=atomic ./test/terraform/...
+	go tool gotestsum --format pkgname -- -race -parallel 8 -timeout 45m -coverpkg=$(COVERPKGS) -coverprofile=terraform-coverage.out -covermode=atomic ./test/terraform/...
 	@echo "Running E2E tests with coverage..."
 	go tool gotestsum --format pkgname -- -race -shuffle on -timeout 10m -tags=e2e -coverpkg=$(COVERPKGS) -coverprofile=e2e-coverage.out -covermode=atomic ./test/e2e/...
 	@echo "Merging coverage profiles..."
@@ -191,6 +201,12 @@ pgo:
 docs:
 	go run ./cmd/gendocs
 
+# Verify every services/<svc>/PARITY.md sdk_module pin matches the version
+# go.mod actually requires -- a stale pin silently undermines every wire
+# claim audited against it. See cmd/checkpins.
+check-pins:
+	go run ./cmd/checkpins
+
 demo: ui-build
 	docker compose down
 	docker compose build