clanker CI is macOS-only with no -race and no Linux/Windows test or build coverage
Problem
clanker is shipped and run on Linux and Windows — it is bundled into clanker-cloud (which has Linux .deb/.rpm and Windows MSI release targets), installed on Linux servers, and the homebrew formula declares Linux unsupported precisely because nothing tests it. Yet CI tests only on macOS-latest, builds only darwin/amd64 and darwin/arm64, and runs go test -short (line 52) which skips longer tests entirely. Critically there is no -race flag despite a concurrent coordinator (internal/agent/coordinator/coordinator.go uses goroutines/WaitGroups for parallel execution), so data races never surface in CI. Linux-only build failures (path handling, syscalls, CGO/sqlite) and races can reach users undetected.
Where
/Users/nashrafeeg/workspace/clanker/.github/workflows/ci.yml:37 (matrix os: [macos-latest])/Users/nashrafeeg/workspace/clanker/.github/workflows/ci.yml:52 (go test -short, no -race)/Users/nashrafeeg/workspace/clanker/.github/workflows/ci.yml:58-67 (build only darwin amd64/arm64)
Root cause
CI matrix was set up for the maintainer's macOS environment and never expanded to the platforms the binary actually targets; -race and full (non-short) runs were never enabled.
How to fix
Expand the test matrix in ci.yml to os: [ubuntu-latest, macos-latest, windows-latest] with Go 1.23 and 1.24. Add a Linux+Go1.24 leg that runs go test -race ./... (not -short) to catch coordinator races; keep -short only on the slower legs if runtime is a concern. Expand the build matrix to add linux/amd64, linux/arm64, and windows/amd64 targets (mirror the GOOS/GOARCH pattern already at ci.yml:78-81) and upload those artifacts so cross-platform breakage is caught before release.
Acceptance criteria
A PR that introduces a Linux-only compile error or a data race in the coordinator fails CI; build artifacts for linux and windows appear on every run.
No code-coverage reporting or gating anywhere except clanker-backend
Problem
clanker-backend is the only in-scope repo that measures coverage (it uploads coverage.xml to Codecov in test.yml). clanker, clanker-cloud, and monorepo have no coverage measurement at all, so there is no visibility into which of the high-risk untested areas (maker exec loop, deploy pipeline, monorepo auth) are actually exercised, and no way to prevent coverage from regressing as code is added. This makes the 'maker/deploy ~85% untested' and 'monorepo zero' situations invisible to reviewers.
Where
/Users/nashrafeeg/workspace/clanker/.github/workflows/ci.yml:52 (no -coverprofile/codecov)/Users/nashrafeeg/workspace/clanker-cloud/ (no CI, no coverage)/Users/nashrafeeg/workspace/clanker-backend/.github/workflows/test.yml:40-44 (only repo with codecov)
Root cause
Coverage instrumentation was only ever added to the Python Lambda backend; the Go repos run go test without -coverprofile and never publish a report.
How to fix
In each Go CI test step add -coverprofile=coverage.out -covermode=atomic and upload via codecov/codecov-action@v4 (already used in clanker-backend/test.yml:41). Start with informational (no threshold) to establish a baseline, then add a per-PR coverage diff so new code in maker/deploy and monorepo auth must carry tests. This depends on the CI workflows from the other findings existing first.
Acceptance criteria
Each Go repo's CI publishes a coverage report and PRs show a coverage delta; the maker and monorepo auth packages have a measurable, tracked coverage number.
Severity: high · from holistic hardening review.
clanker CI is macOS-only with no -race and no Linux/Windows test or build coverage
Problem
clanker is shipped and run on Linux and Windows — it is bundled into clanker-cloud (which has Linux .deb/.rpm and Windows MSI release targets), installed on Linux servers, and the homebrew formula declares Linux unsupported precisely because nothing tests it. Yet CI tests only on macOS-latest, builds only darwin/amd64 and darwin/arm64, and runs go test -short (line 52) which skips longer tests entirely. Critically there is no -race flag despite a concurrent coordinator (internal/agent/coordinator/coordinator.go uses goroutines/WaitGroups for parallel execution), so data races never surface in CI. Linux-only build failures (path handling, syscalls, CGO/sqlite) and races can reach users undetected.
Where
/Users/nashrafeeg/workspace/clanker/.github/workflows/ci.yml:37 (matrix os: [macos-latest])/Users/nashrafeeg/workspace/clanker/.github/workflows/ci.yml:52 (go test -short, no -race)/Users/nashrafeeg/workspace/clanker/.github/workflows/ci.yml:58-67 (build only darwin amd64/arm64)Root cause
CI matrix was set up for the maintainer's macOS environment and never expanded to the platforms the binary actually targets; -race and full (non-short) runs were never enabled.
How to fix
Expand the test matrix in ci.yml to os: [ubuntu-latest, macos-latest, windows-latest] with Go 1.23 and 1.24. Add a Linux+Go1.24 leg that runs go test -race ./... (not -short) to catch coordinator races; keep -short only on the slower legs if runtime is a concern. Expand the build matrix to add linux/amd64, linux/arm64, and windows/amd64 targets (mirror the GOOS/GOARCH pattern already at ci.yml:78-81) and upload those artifacts so cross-platform breakage is caught before release.
Acceptance criteria
A PR that introduces a Linux-only compile error or a data race in the coordinator fails CI; build artifacts for linux and windows appear on every run.
No code-coverage reporting or gating anywhere except clanker-backend
Problem
clanker-backend is the only in-scope repo that measures coverage (it uploads coverage.xml to Codecov in test.yml). clanker, clanker-cloud, and monorepo have no coverage measurement at all, so there is no visibility into which of the high-risk untested areas (maker exec loop, deploy pipeline, monorepo auth) are actually exercised, and no way to prevent coverage from regressing as code is added. This makes the 'maker/deploy ~85% untested' and 'monorepo zero' situations invisible to reviewers.
Where
/Users/nashrafeeg/workspace/clanker/.github/workflows/ci.yml:52 (no -coverprofile/codecov)/Users/nashrafeeg/workspace/clanker-cloud/ (no CI, no coverage)/Users/nashrafeeg/workspace/clanker-backend/.github/workflows/test.yml:40-44 (only repo with codecov)Root cause
Coverage instrumentation was only ever added to the Python Lambda backend; the Go repos run go test without -coverprofile and never publish a report.
How to fix
In each Go CI test step add -coverprofile=coverage.out -covermode=atomic and upload via codecov/codecov-action@v4 (already used in clanker-backend/test.yml:41). Start with informational (no threshold) to establish a baseline, then add a per-PR coverage diff so new code in maker/deploy and monorepo auth must carry tests. This depends on the CI workflows from the other findings existing first.
Acceptance criteria
Each Go repo's CI publishes a coverage report and PRs show a coverage delta; the maker and monorepo auth packages have a measurable, tracked coverage number.
Severity: high · from holistic hardening review.