refactor(ci): move unit-test package filter to go helper

[skevetter]

Summary

Moves the unit-test package filter out of an inline awk pipeline in the unit-tests job of .github/workflows/pr-ci.yml into a tested Go helper, hack/unit_test_packages. task cli:test now uses the same helper, so local and CI share one definition of "unit-test package".

Commits

1. refactor(ci): move unit-test package filter to go helper: helper and table-driven tests.
2. ci: use unit_test_packages helper in unit-tests job: workflow step now runs packages="$(go run ./hack/unit_test_packages)". The empty-check and xargs go test -race -short lines are unchanged.
3. refactor(ci): share unit-test package list with task cli:test: Taskfile.yml cli:test runs the helper inside a set -euo pipefail block.

Behaviour changes

• Local task cli:test now matches CI. The old grep -v -e /test -e /e2e also dropped pkg/driver/external/internal/testfixture. The helper keeps it, as the CI awk did. Old local list vs helper: 189 vs 190 lines, and the only difference is github.com/devsy-org/devsy/pkg/driver/external/internal/testfixture.
• cli:test fails closed. The helper runs inside packages="$(...)", so under set -e a helper failure aborts the target. Without this, go test with no package args would silently test only the root package.
• Error text is lowercase (no unit-test packages found, package directory is outside the repository: <dir>) to satisfy the revive/staticcheck error-string rule. Only capitalization differs from the old awk messages.
• Blank lines in go list output are skipped. go list does not emit them. The old awk treated a blank middle line as an outside-repo error. This path is unreachable in practice.
• The helper uses os.Getwd(), which honours $PWD like the old awk's -v root="$PWD".
• -short is not added to the Taskfile target. CI keeps -short; local does not.

Verification

• go test -race -short -count=1 ./hack/unit_test_packages/...: pass.
• golangci-lint run ./hack/unit_test_packages/...: 0 issues. The CI-parity lint gate diffs against the merge base and skips untracked files, so the new package was linted explicitly.
• prek run --files on the changed files: all hooks pass (golangci-lint, golangci-lint-fmt, actionlint, check-yaml, gitleaks, trailing-whitespace, end-of-file-fixer).
• Helper output vs the old CI awk pipeline (from /tmp): identical, 190 packages.
• Helper output vs old local go list | grep -v: one extra line, testfixture (see above).
• go test -race -run '^$' $(go run ./hack/unit_test_packages): exit 0. All selected test binaries compile.
• Temp Taskfile with the exact new cli:test cmd (plus -run '^$'): exit 0. A forced helper failure (packages="$(false)") aborts before the next command (task exit 201).

CodeRabbit

• CLI (coderabbit review --agent --committed): not run. The CLI returned Rate limit exceeded: free OSS quota used, reset in about 48 minutes, no on-demand option. No CLI findings were produced.
• GitHub-side CodeRabbit status is checked separately before marking ready.

Summary by CodeRabbit

• Chores
  • Standardized unit-test package selection across CI and local test commands, excluding test and end-to-end packages.
  • Local test runs continue to use race detection and now produce atomic coverage output.
  • Added checks for package selection, including handling of invalid or empty results.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	72ac2c1
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ad078db6d2b65496d68f354

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c09b7374-ea26-4634-ada3-936af58d94c0

📥 Commits

Reviewing files that changed from the base of the PR and between 7d04a47 and 72ac2c1.

📒 Files selected for processing: 4

• .github/workflows/pr-ci.yml
• Taskfile.yml
• hack/unit_test_packages/main.go
• hack/unit_test_packages/main_test.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Walkthrough

Adds a command that selects Go unit-test packages and updates the CI unit-test job and cli:test task to use it. The command excludes test and e2e directory segments and reports errors for invalid or empty package listings.

Changes: Unit-test package selection

Layer / File(s)	Summary
Implement and test package selection hack/unit_test_packages/*	Adds a command that runs go list, filters packages by directory, and reports errors for invalid input, malformed listings, paths outside the root, or no eligible packages. Tests cover package filtering and error cases.
Use shared selection in test entry points .github/workflows/pr-ci.yml, Taskfile.yml	The CI unit-test job and cli:test task now get package lists from the command. cli:test also enables strict shell failure handling and retains race detection and atomic coverage output.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 72ac2

The shared package selector appears ready to merge after normal checks.

Security architecture risk: ⚪ Minimal · up to 72ac2

The shared selector preserves CI’s package exclusions and existing execution privileges while making local package-discovery failures stop testing. No material security risk was found introduced or worsened by this change.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed execution surface is repository testing on CI runners and developer machines. The comparison shows no new authority requested by the workflow and no modifications to the supplied credential-helper, sandbox, or module paths.

Security Findings and Attack Paths

• inferred — A contributor can modify the helper executed by CI, but these same test callers already executed contributor-controlled repository code through go test. With unchanged workflow authority and no newly reached privileged sink identified, the helper does not establish an expanded code-execution trust boundary.

Trust Boundaries and Controls

• observed — Package eligibility retains CI’s lexical repository-directory boundary: a directory must equal the root or begin with the root plus a path separator. Exact test and e2e path segments are excluded. This is a package-selection control, not a sandbox for untrusted repository code.

Resilience and Maintainability Implications

• observed — Validation completes before package output begins, so a later invalid listing entry cannot yield a partial successful selection. Both callers capture the command under set -euo pipefail; selector failure stops test execution rather than allowing an empty argument list to fall back to testing only the current package.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: moving the unit-test package filter from CI configuration into a Go helper.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 zizmor (1.30.1)

.github/workflows/pr-ci.yml

INFO zizmor: 🌈 zizmor v1.30.1
WARN audit:audit{input=Workflow(file://.github/workflows/pr-ci.yml)}: zizmor::audit::unsound_ternary: couldn't parse expression: matrix.provider-mode || ''parity''
fatal: no audit was performed
'template-injection' audit failed on file://.github/workflows/pr-ci.yml

Caused by:
0: error in 'template-injection' audit
1: failed to locate subfeature 'Subfeature { after: 143, fragment: Regex(Regex("matrix\.provider\-mode\s+\|\|\s+'parity'")) }' in feature ''"${RUNNER_TEMP}/devsy-ci-microsandbox" run --label "${{ matrix.label }}" --expected-count "${{ matrix.expected-spec-count }}" --provider-mode "${{ matrix.provider-mode || ''parity'' }}"''

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	72ac2c1
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ad078db3870ae4aae019946

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[skevetter]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.