chore(tests): parallelize cmd tests that touch no shared state

cmd/archera_comparison_key_test.go

@@ -193,6 +193,7 @@ func TestArcheraLongKeyVisibleDisguisesAreWithheld(t *testing.T) {
 // Exactly 8 consecutive key characters are withheld, 7 are shown; the first
 // and last 8 count as much as any other.
 func TestArcheraKeyFragmentBoundary(t *testing.T) {
+	t.Parallel()
 	spaced := func(frag string) error {
 		return archeraSafeError(errors.New("A: "+archeraSplitEverywhere(frag, "\u2800")), archeraLongKey)
 	}
@@ -208,6 +209,7 @@ func TestArcheraKeyFragmentBoundary(t *testing.T) {
 // The irregular-insertion rule is bounded: key characters 2 apart read as the
 // key, 3 apart do not. Uses an 8-character key so there is a single window.
 func TestArcheraKeyGapBound(t *testing.T) {
+	t.Parallel()
 	const key = "abcdefgh"
 	two := archeraSafeError(errors.New("A: abc"+"aa"+"defgh"), key).Error()
 	assert.Contains(t, two, archeraWithheld)
@@ -241,6 +243,7 @@ func TestArcheraHostileLargeDecodeValueIsBounded(t *testing.T) {
 // Only text that could be displayed (plus a small slack for a key cut by the
 // cap) is checked: a key echoed far beyond the cap changes nothing.
 func TestArcheraKeyBeyondCheckWindowIsIgnored(t *testing.T) {
+	t.Parallel()
 	far := strings.Repeat("A", archeraMaxErrorSize+archeraCheckSlack+64) + archeraSplitEverywhere(archeraLongKey, "\u2800")
 	got := archeraSafeError(errors.New(far), archeraLongKey).Error()
 	assert.NotContains(t, got, archeraWithheld)
@@ -250,6 +253,7 @@ func TestArcheraKeyBeyondCheckWindowIsIgnored(t *testing.T) {
 // A key spaced by the longest separator and cut by the cap is still withheld,
 // so the look-ahead slack covers a whole window of such a key.
 func TestArcheraKeySpacedByLongestSeparatorAtCapIsWithheld(t *testing.T) {
+	t.Parallel()
 	sep := strings.Repeat("-", archeraMaxSep)
 	msg := strings.Repeat("A", archeraMaxErrorSize-4) + archeraSplitEverywhere(archeraLongKey, sep)
 	got := archeraSafeError(errors.New(msg), archeraLongKey).Error()
@@ -259,6 +263,7 @@ func TestArcheraKeySpacedByLongestSeparatorAtCapIsWithheld(t *testing.T) {
 // A key with an inner space or a format character is matched on what a reader
 // sees of it.
 func TestArcheraKeyWithInnerSpaceOrFormatRune(t *testing.T) {
+	t.Parallel()
 	for name, key := range map[string]string{"inner space": "abcd efgh ijkl", "format rune": "abcdefg\u200bhijklmn"} {
 		got := archeraSafeError(errors.New("A: abcd\u2800efgh\u2800ijkl and abcdefghijklmn"), key).Error()
 		assert.Contains(t, got, archeraWithheld, name)
@@ -267,6 +272,7 @@ func TestArcheraKeyWithInnerSpaceOrFormatRune(t *testing.T) {
 
 // Ordinary vendor text must survive: the gap rule only fires on the key.
 func TestArcheraOrdinaryVendorTextIsNotWithheld(t *testing.T) {
+	t.Parallel()
 	msgs := []string{
 		"invalid credentials for the account; request id 4821-aa; HTTP 403 forbidden",
 		"organization not found: check the org id and the plan id",

cmd/archera_comparison_masking_test.go

@@ -157,6 +157,7 @@ func mustJSON(t *testing.T, v string) string {
 // otherwise survive as a readable prefix. Sweep the boundary and assert no
 // 4+ byte prefix of the key remains, for a plain and a strip-split key.
 func TestArcheraErrorsLeaveNoKeyPrefixAtCap(t *testing.T) {
+	t.Parallel()
 	k := archeraTestKey
 	for _, echo := range []string{k, k[:5] + "\u200b" + k[5:], archeraSplitEverywhere(k, "\u200b")} {
 		for padLen := archeraMaxErrorSize - len(k) - 8; padLen <= archeraMaxErrorSize+2; padLen++ {
@@ -174,6 +175,7 @@ func TestArcheraErrorsLeaveNoKeyPrefixAtCap(t *testing.T) {
 // The withhold check must see the full text: a cut through a split key would
 // hide it from a check run after the cap while leaving a readable prefix.
 func TestArcheraErrorsWithholdSplitKeyAtAnyCapOffset(t *testing.T) {
+	t.Parallel()
 	k := archeraTestKey
 	for name, sep := range map[string]string{"variation selector": "\ufe0f", "invalid utf-8": "\xff", "combining acute": "\u0301"} {
 		for padLen := archeraMaxErrorSize - 3*len(k); padLen <= archeraMaxErrorSize+2; padLen++ {
@@ -184,6 +186,7 @@ func TestArcheraErrorsWithholdSplitKeyAtAnyCapOffset(t *testing.T) {
 }
 
 func TestArcheraErrorsTrimKeyBeforeMasking(t *testing.T) {
+	t.Parallel()
 	got := archeraSafeError(errors.New("bad key "+archeraTestKey[:5]+"\u200b"+archeraTestKey[5:]), " "+archeraTestKey+"\n").Error()
 	assert.Equal(t, "bad key [redacted]", got)
 }

cmd/archera_comparison_test.go

@@ -310,6 +310,7 @@ func TestArcheraComparisonJSON(t *testing.T) {
 }
 
 func TestArcheraMoneyExact(t *testing.T) {
+	t.Parallel()
 	for in, want := range map[string]string{"0": "0", "7.25": "7.25", "10.125": "10.125", "1200": "1200", "0.00001": "0.00001"} {
 		r, ok := new(big.Rat).SetString(in)
 		require.True(t, ok)
@@ -321,6 +322,7 @@ func TestArcheraMoneyExact(t *testing.T) {
 }
 
 func TestArcheraSanitize(t *testing.T) {
+	t.Parallel()
 	got := archeraSanitize("a\x1bb\u009bc\nd")
 	assert.Equal(t, "abcd", got)
 	long := archeraSanitize(strings.Repeat("é", 300))
@@ -406,6 +408,7 @@ func TestArcheraNoKeyFlagAndStructsRedacted(t *testing.T) {
 // fields the decoder would reject (enums, UUIDs, terms) still carry control
 // characters into the DTO.
 func TestArcheraDTOSanitizesEveryVendorString(t *testing.T) {
+	t.Parallel()
 	dirty := func(s string) string { return s + "\x1b[31m\u0085\u009b\u202e\u200b\u2028\u2029" }
 	str := func(s string) *string { v := dirty(s); return &v }
 	pay := insurance.PaymentOption(dirty("no_upfront"))

cmd/cancellation_prepurchase_test.go

@@ -313,6 +313,7 @@ func TestFetchAllRecs_AccountFilters(t *testing.T) {
 }
 
 func TestRequireResolvedAccountNames_CSVRows(t *testing.T) {
+	t.Parallel()
 	rows := []common.Recommendation{{Account: testCallerAccount, AccountName: testCallerAccount}}
 	// The CSV wrote the ID where the name lookup had failed.
 	require.Error(t, requireResolvedAccountNames(rows, &Config{ExcludeAccounts: []string{"sandbox"}}))
@@ -324,6 +325,7 @@ func TestRequireResolvedAccountNames_CSVRows(t *testing.T) {
 }
 
 func TestRequireNamesResolved_BlankFilterValueIsNotANameFilter(t *testing.T) {
+	t.Parallel()
 	unresolved := []common.Recommendation{{Account: testCallerAccount, AccountName: testCallerAccount}}
 
 	require.NoError(t, requireNamesResolved(unresolved, &Config{ExcludeAccounts: []string{" "}}))

cmd/cancellation_test.go

@@ -265,6 +265,7 @@ func TestRegisterShutdownSignalHandler_CancelSetsFlagAndPrintsNoticeOnce(t *test
 // handler would return and the second signal below would terminate the test
 // binary.
 func TestInvocationContext_FurtherSigintsAreAbsorbed(t *testing.T) {
+	// Serial: syscall.Kill(SIGINT) is process-wide and would hit any parallel test that installs a handler.
 	ctx, stop := invocationContext()
 	defer stop()
 

cmd/configure_azure_sp_test.go

@@ -102,6 +102,7 @@ const (
 )
 
 func TestCreateAzureServicePrincipal_Success(t *testing.T) {
+	t.Parallel()
 	m := &mockSPProvisioner{
 		appObjectID: "app-object-id",
 		appID:       "app-client-id",
@@ -145,6 +146,7 @@ func TestCreateAzureServicePrincipal_Success(t *testing.T) {
 }
 
 func TestCreateAzureServicePrincipal_ErrorPropagation(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name          string
 		setup         func(*mockSPProvisioner)
@@ -227,6 +229,7 @@ func TestCreateAzureServicePrincipal_ErrorPropagation(t *testing.T) {
 // the compensating delete also fails, the error names the orphaned application
 // so the operator can delete it manually.
 func TestCreateAzureServicePrincipal_RollbackFailureSurfaced(t *testing.T) {
+	t.Parallel()
 	m := &mockSPProvisioner{
 		appObjectID:  "app-object-id",
 		appID:        "app-client-id",
@@ -246,6 +249,7 @@ func TestCreateAzureServicePrincipal_RollbackFailureSurfaced(t *testing.T) {
 }
 
 func TestCreateAzureServicePrincipal_ScopeFormat(t *testing.T) {
+	t.Parallel()
 	m := &mockSPProvisioner{
 		appObjectID: "o", appID: "a", secret: "s", principalID: "p", roleDefID: "r",
 	}
@@ -297,6 +301,7 @@ func newFakePrincipalNotFoundProvisioner(fake *fakeRoleAssigner) *graphSPProvisi
 // TestGraphSPProvisioner_AssignRole_RetrySucceeds verifies that AssignRole
 // retries when ARM returns PrincipalNotFound and eventually succeeds.
 func TestGraphSPProvisioner_AssignRole_RetrySucceeds(t *testing.T) {
+	t.Parallel()
 	principalNotFound := &azcore.ResponseError{ErrorCode: "PrincipalNotFound", StatusCode: 400}
 	fake := &fakeRoleAssigner{failsRemaining: 2, principalNotFoundErr: principalNotFound}
 	p := newFakePrincipalNotFoundProvisioner(fake)
@@ -312,6 +317,7 @@ func TestGraphSPProvisioner_AssignRole_RetrySucceeds(t *testing.T) {
 // AssignRole fails loud with a clear message when the service principal never
 // propagates within the budget.
 func TestGraphSPProvisioner_AssignRole_ExhaustsRetryBudget(t *testing.T) {
+	t.Parallel()
 	principalNotFound := &azcore.ResponseError{ErrorCode: "PrincipalNotFound", StatusCode: 400}
 	fake := &fakeRoleAssigner{failsRemaining: 100, principalNotFoundErr: principalNotFound}
 	p := newFakePrincipalNotFoundProvisioner(fake)
@@ -329,6 +335,7 @@ func TestGraphSPProvisioner_AssignRole_ExhaustsRetryBudget(t *testing.T) {
 // TestGraphSPProvisioner_AssignRole_NonRetryableError verifies that a
 // non-PrincipalNotFound error is returned immediately without retrying.
 func TestGraphSPProvisioner_AssignRole_NonRetryableError(t *testing.T) {
+	t.Parallel()
 	fake := &fakeRoleAssigner{otherErr: errors.New("authorization denied")}
 	p := newFakePrincipalNotFoundProvisioner(fake)
 
@@ -342,6 +349,7 @@ func TestGraphSPProvisioner_AssignRole_NonRetryableError(t *testing.T) {
 // TestGraphSPProvisioner_AssignRole_ContextCancellation verifies that context
 // cancellation is treated as a terminal stop and does not continue retrying.
 func TestGraphSPProvisioner_AssignRole_ContextCancellation(t *testing.T) {
+	t.Parallel()
 	principalNotFound := &azcore.ResponseError{ErrorCode: "PrincipalNotFound", StatusCode: 400}
 	fake := &fakeRoleAssigner{failsRemaining: 100, principalNotFoundErr: principalNotFound}
 	p := newFakePrincipalNotFoundProvisioner(fake)
@@ -359,6 +367,7 @@ func TestGraphSPProvisioner_AssignRole_ContextCancellation(t *testing.T) {
 
 // TestIsPrincipalNotFoundErr covers the error-code detection helper directly.
 func TestIsPrincipalNotFoundErr(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		err  error
 		name string

cmd/configure_azure_store_test.go

@@ -12,6 +12,7 @@ import (
 
 // Tests for storeAzureCredentials function.
 func TestStoreAzureCredentials(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		mockSetup     func(*MockSecretsStore)
 		validateStore func(*testing.T, *MockSecretsStore)

cmd/configure_gcp_step_test.go

@@ -11,6 +11,7 @@ import (
 )
 
 func TestGCPStepCreateServiceAccount_SkipUsesOperatorEmail(t *testing.T) {
+	t.Parallel()
 	const existing = "existing-sa@my-proj.iam.gserviceaccount.com"
 	reader := bufio.NewReader(strings.NewReader("s\n  " + existing + "  \n"))
 
@@ -22,6 +23,7 @@ func TestGCPStepCreateServiceAccount_SkipUsesOperatorEmail(t *testing.T) {
 }
 
 func TestGCPStepCreateServiceAccount_UnknownOptionPromptsForEmail(t *testing.T) {
+	t.Parallel()
 	const existing = "other@my-proj.iam.gserviceaccount.com"
 	reader := bufio.NewReader(strings.NewReader("x\n" + existing + "\n"))
 
@@ -32,6 +34,7 @@ func TestGCPStepCreateServiceAccount_UnknownOptionPromptsForEmail(t *testing.T)
 }
 
 func TestGCPStepCreateServiceAccount_SkipRejectsInvalidEmail(t *testing.T) {
+	t.Parallel()
 	for _, in := range []string{"s\n\n", "s\nnot-an-email\n", "s\nuser@example.com\n", "s\n@x.gserviceaccount.com\n", "s\na@b@c.gserviceaccount.com\n", "s\na@.gserviceaccount.com\n", "s\n   ", "s\na\x00@x.gserviceaccount.com\n", "s\n"} {
 		email, err := gcpStepCreateServiceAccount(context.Background(), bufio.NewReader(strings.NewReader(in)), "my-proj")
 		require.Error(t, err, "input %q", in)
@@ -40,6 +43,7 @@ func TestGCPStepCreateServiceAccount_SkipRejectsInvalidEmail(t *testing.T) {
 }
 
 func TestGCPStepCreateServiceAccount_SkipAcceptsUppercaseEmail(t *testing.T) {
+	t.Parallel()
 	const existing = "Existing-SA@My-Proj.IAM.GServiceAccount.com"
 	email, err := gcpStepCreateServiceAccount(context.Background(), bufio.NewReader(strings.NewReader("s\n"+existing+"\n")), "my-proj")
 	require.NoError(t, err)

cmd/configure_gcp_store_test.go

@@ -12,6 +12,7 @@ import (
 
 // Tests for storeGCPCredentials function.
 func TestStoreGCPCredentials(t *testing.T) {
+	t.Parallel()
 	// private_key validation is presence-only; the key content is not parsed or
 	// validated as a real PEM block by storeGCPCredentials.
 	validGCPJSON := `{

cmd/configure_gcp_test.go

@@ -20,6 +20,7 @@ import (
 // appended to an existing binding for the role and the function reports a
 // change.
 func TestAddMemberToPolicyBinding_AppendsToExistingBinding(t *testing.T) {
+	t.Parallel()
 	policy := &cloudresourcemanager.Policy{
 		Bindings: []*cloudresourcemanager.Binding{
 			{Role: "roles/viewer", Members: []string{"user:existing@example.com"}},
@@ -40,6 +41,7 @@ func TestAddMemberToPolicyBinding_AppendsToExistingBinding(t *testing.T) {
 // TestAddMemberToPolicyBinding_AlreadyBoundNoChange verifies that an
 // already-bound member is a no-op (returns false, no duplicate appended).
 func TestAddMemberToPolicyBinding_AlreadyBoundNoChange(t *testing.T) {
+	t.Parallel()
 	member := "serviceAccount:sa@proj.iam.gserviceaccount.com"
 	policy := &cloudresourcemanager.Policy{
 		Bindings: []*cloudresourcemanager.Binding{
@@ -59,6 +61,7 @@ func TestAddMemberToPolicyBinding_AlreadyBoundNoChange(t *testing.T) {
 // TestAddMemberToPolicyBinding_CreatesMissingBinding verifies a new binding is
 // appended when the role is absent from the policy.
 func TestAddMemberToPolicyBinding_CreatesMissingBinding(t *testing.T) {
+	t.Parallel()
 	policy := &cloudresourcemanager.Policy{
 		Bindings: []*cloudresourcemanager.Binding{
 			{Role: "roles/viewer", Members: []string{"user:existing@example.com"}},
@@ -81,6 +84,7 @@ func TestAddMemberToPolicyBinding_CreatesMissingBinding(t *testing.T) {
 // role must NOT drop or mutate a conditional (IAM condition) binding on another
 // role. Losing conditional bindings would silently widen access.
 func TestAddMemberToPolicyBinding_PreservesConditionalBindings(t *testing.T) {
+	t.Parallel()
 	conditional := &cloudresourcemanager.Binding{
 		Role:    "roles/storage.objectViewer",
 		Members: []string{"user:auditor@example.com"},
@@ -150,6 +154,7 @@ func (m *mockGCPKeyProvisioner) DeleteKey(_ context.Context, keyName string) err
 }
 
 func TestWriteServiceAccountKey_Success(t *testing.T) {
+	t.Parallel()
 	keyMaterial := []byte(`{"type":"service_account","project_id":"proj"}`)
 	m := &mockGCPKeyProvisioner{
 		keyName:        "projects/-/serviceAccounts/sa@proj.iam.gserviceaccount.com/keys/abc123",
@@ -175,6 +180,7 @@ func TestWriteServiceAccountKey_Success(t *testing.T) {
 // (so it does not linger as an active unused credential) and the reserved local
 // file is cleaned up.
 func TestWriteServiceAccountKey_DecodeFailureRollsBack(t *testing.T) {
+	t.Parallel()
 	m := &mockGCPKeyProvisioner{
 		keyName:        "projects/-/serviceAccounts/sa@proj.iam.gserviceaccount.com/keys/abc123",
 		privateKeyData: "!!!not-base64!!!",
@@ -198,6 +204,7 @@ func TestWriteServiceAccountKey_DecodeFailureRollsBack(t *testing.T) {
 // compensating DeleteKey also fails, the error names the orphaned remote key so
 // the operator can delete it manually, while still surfacing the original cause.
 func TestWriteServiceAccountKey_RollbackFailureSurfaced(t *testing.T) {
+	t.Parallel()
 	m := &mockGCPKeyProvisioner{
 		keyName:        "projects/-/serviceAccounts/sa@proj.iam.gserviceaccount.com/keys/orphan999",
 		privateKeyData: "!!!not-base64!!!",
@@ -217,6 +224,7 @@ func TestWriteServiceAccountKey_RollbackFailureSurfaced(t *testing.T) {
 // the remote key fails, no rollback is attempted (nothing was minted) and no
 // local file is left behind.
 func TestWriteServiceAccountKey_CreateFailureNoOrphan(t *testing.T) {
+	t.Parallel()
 	m := &mockGCPKeyProvisioner{
 		createErr: &googleapi.Error{Code: 403},
 	}
@@ -235,6 +243,7 @@ func TestWriteServiceAccountKey_CreateFailureNoOrphan(t *testing.T) {
 // TestWriteServiceAccountKey_CreateFailureAmbiguous verifies that only a 4xx
 // googleapi error is a definite failure; every other outcome may have minted a key.
 func TestWriteServiceAccountKey_CreateFailureAmbiguous(t *testing.T) {
+	t.Parallel()
 	const sa = "sa@proj.iam.gserviceaccount.com"
 	cases := []struct {
 		name      string
@@ -267,6 +276,7 @@ func TestWriteServiceAccountKey_CreateFailureAmbiguous(t *testing.T) {
 // destination file already exists (exclusive-create fails), the remote key is
 // never minted, so there is nothing to orphan.
 func TestWriteServiceAccountKey_ReserveFailureNoMint(t *testing.T) {
+	t.Parallel()
 	keyFile := filepath.Join(t.TempDir(), "cudly-gcp-key.json")
 	require.NoError(t, os.WriteFile(keyFile, []byte("pre-existing"), 0o600))
 
@@ -457,6 +467,7 @@ func TestUploadGCPCredentialsFile_OperatorFileKept(t *testing.T) {
 }
 
 func TestGcloudDeleteKeyCommand(t *testing.T) {
+	t.Parallel()
 	assert.Equal(t,
 		"gcloud iam service-accounts keys delete abc123 --iam-account=sa@proj.iam.gserviceaccount.com",
 		gcloudDeleteKeyCommand(testMintedKeyName))

cmd/configure_test.go

@@ -39,6 +39,7 @@ func (m *MockSecretsStore) UpdateSecret(ctx context.Context, secretID string, se
 
 // TestAzureCredentials_Struct tests the AzureCredentials struct.
 func TestAzureCredentials_Struct(t *testing.T) {
+	t.Parallel()
 	creds := AzureCredentials{
 		TenantID:       "tenant-123",
 		ClientID:       "client-456",
@@ -54,6 +55,7 @@ func TestAzureCredentials_Struct(t *testing.T) {
 
 // TestAzureConfigOptions_Defaults tests AzureConfigOptions defaults.
 func TestAzureConfigOptions_Defaults(t *testing.T) {
+	t.Parallel()
 	opts := AzureConfigOptions{}
 
 	assert.Equal(t, "", opts.StackName)
@@ -67,6 +69,7 @@ func TestAzureConfigOptions_Defaults(t *testing.T) {
 
 // TestAzureConfigOptions_WithValues tests AzureConfigOptions with values.
 func TestAzureConfigOptions_WithValues(t *testing.T) {
+	t.Parallel()
 	opts := AzureConfigOptions{
 		StackName:      "my-cudly",
 		Profile:        "production",
@@ -88,6 +91,7 @@ func TestAzureConfigOptions_WithValues(t *testing.T) {
 
 // TestGCPCredentials_Struct tests the GCPCredentials struct.
 func TestGCPCredentials_Struct(t *testing.T) {
+	t.Parallel()
 	creds := GCPCredentials{
 		Type:         "service_account",
 		ProjectID:    "my-project",
@@ -107,6 +111,7 @@ func TestGCPCredentials_Struct(t *testing.T) {
 
 // TestGCPConfigOptions_Defaults tests GCPConfigOptions defaults.
 func TestGCPConfigOptions_Defaults(t *testing.T) {
+	t.Parallel()
 	opts := GCPConfigOptions{}
 
 	assert.Equal(t, "", opts.StackName)
@@ -118,6 +123,7 @@ func TestGCPConfigOptions_Defaults(t *testing.T) {
 
 // TestGCPConfigOptions_WithValues tests GCPConfigOptions with values.
 func TestGCPConfigOptions_WithValues(t *testing.T) {
+	t.Parallel()
 	opts := GCPConfigOptions{
 		StackName:       "my-cudly",
 		Profile:         "production",
@@ -135,6 +141,7 @@ func TestGCPConfigOptions_WithValues(t *testing.T) {
 
 // Tests for validateAzureUUID function.
 func TestValidateAzureUUID(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name      string
 		uuid      string
@@ -255,6 +262,7 @@ func TestValidateAzureUUID(t *testing.T) {
 
 // Tests for validateGCPProjectID function.
 func TestValidateGCPProjectID(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name      string
 		projectID string