ci: add -race gate (ccp-sbp.4)

[dkoosis]

What

Adds a check CI workflow running go test -race -count=1 ./... on every PR and push to main.

Why

The 9-repo bug-class scan (2026-08-04, decision nug d7ea466a8172, epic ccp-sbp.4) found concurrency-lifecycle defects as a recurring, race-detector-catchable class. This repo had no CI test gate — race ran only in local make audit. This closes the gap.

Notes

• Review-only — do not merge without a maintainer pass. Minimal, focused on the -race gap only (goleak/synctest wiring is per-repo judgment, documented separately).
• CI will validate whether the suite currently passes under -race.

Summary by CodeRabbit

• Tests
  • Added automated checks for Go code quality, race conditions, and project builds.
• Chores
  • Added continuous integration checks for pull requests and updates to the main branch.
  • Configured read-only permissions, run cancellation, and execution time limits for improved workflow management.

[coderabbitai]

Warning

Review limit reached

@dkoosis, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2c3690a1-66f5-452d-b040-2114a81a02bc

📥 Commits

Reviewing files that changed from the base of the PR and between 5ea7202 and a9db943.

📒 Files selected for processing (1)

• .github/workflows/check.yml

📝 Walkthrough

Walkthrough

The pull request adds a GitHub Actions workflow that runs Go validation for pull requests and pushes to main. It configures read-only permissions, concurrency cancellation, a 15-minute timeout, linting, race-enabled tests, and builds.

Changes

Go CI workflow

Layer / File(s)	Summary
Workflow triggers and Go validation .github/workflows/check.yml	The workflow runs on pull requests and pushes to main. It uses read-only permissions and cancels older runs for the same ref. The job installs Go 1.26, runs go vet, executes race-enabled tests without cache reuse, and builds the project.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the addition of a CI race-detector gate, which is the main change.
Description check	✅ Passed	The description explains the new CI workflow, its race-testing purpose, and the required maintainer review.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/check.yml:
- Line 20: Update the actions/checkout@v4 step in the workflow to disable
credential persistence by setting persist-credentials to false, ensuring
subsequent pull-request-controlled Go test steps cannot access the workflow
token.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fda5d211-945b-4b13-8880-ef6c8d37bebf

📥 Commits

Reviewing files that changed from the base of the PR and between c04a499 and 5ea7202.

📒 Files selected for processing (1)

• .github/workflows/check.yml

[dkoosis]

Applied CodeRabbit's one actionable finding: added persist-credentials: false to the checkout step, so the workflow token isn't retained for later steps. Accepted -- correct hardening, no downside. Holding merge per the PR's own note ("do not merge without a maintainer pass").