Chore/parity upgrade

.github/workflows/ci.yml

@@ -84,6 +84,26 @@ jobs:
       - name: go fix (modernize)
         run: go fix -diff ./...
 
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          token: ${{ env.GH_CI_TOKEN }}
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+
+      - name: Generate docs
+        run: make docs
+
+      - name: Fail if docs are out of date
+        run: git diff --exit-code
+
   govulncheck:
     runs-on: ubuntu-latest
     steps:

.golangci.yml

@@ -502,6 +502,16 @@ linters:
       # injectable RNG field, so it must live in the same package.
       - path: 'route53/routing_test.go'
         linters: [ testpackage ]
+      # ordering_requirements_test.go white-box tests buildOrderingRequirements
+      # and its unexported per-check helpers directly with hand-built Site/
+      # Outpost structs -- several of the real OrderingRequirementType checks
+      # (SHIPPING_ADDRESS_MISSING_CONTACT_*) need a partially-populated Address
+      # the real SDK client's own validators.go refuses to construct (every
+      # Address field is client-side required once OperatingAddress/
+      # ShippingAddress is non-nil), so this cannot be reached through the
+      # real SDK client the way this package's other tests are.
+      - path: 'outposts/ordering_requirements_test.go'
+        linters: [ testpackage ]
       - path: 'pkgs/service/cloudtrail_capture_test.go'
         linters: [ testpackage ]
       - path: 'pkgs/service/registry_test.go'
@@ -515,6 +525,20 @@ linters:
         linters: [ testpackage ]
       - path: 'autoscaling/scheduled_action_scheduler_test.go'
         linters: [ testpackage ]
+      # whitebox_test.go: the export_test.go cleanup (gopherstack-f84y) moved
+      # tests needing unexported field/const access out of the external _test
+      # package into these in-package files instead of re-exporting test-only
+      # helpers. One shared rule covers every service's whitebox_test.go.
+      - path: 'whitebox_test\.go$'
+        linters: [ testpackage ]
+      - path: 'sdkcheck/check_test.go'
+        linters: [ testpackage ]
+      - path: 'pkgs/telemetry/collector_test.go'
+        linters: [ testpackage ]
+      - path: 'cognitoidentity/errors_test.go'
+        linters: [ testpackage ]
+      - path: 'glacier/select_sql_test.go'
+        linters: [ testpackage ]
       - text: 'should have a package comment'
         linters: [ revive ]
       - text: 'exported \S+ \S+ should have comment( \(or a comment on this block\))? or be unexported'

AGENTS.md

@@ -11,6 +11,11 @@ go vet ./services/<pkg>/...
 golangci-lint run ./services/<pkg>/...
 ```
 
+`make lint` also runs mulint (mutex misuse detection) via `go vet -vettool`.
+mulint cannot follow mutex wrappers across package boundaries, so it does
+**not** see `lockmetrics.RWMutex` (used almost everywhere in this repo) — it
+only guards direct `sync.Mutex`/`sync.RWMutex` use.
+
 
 **Logging — context-aware only (no exceptions):**
 - NEVER call `slog.Default()` or construct an ad-hoc `slog.New(...)` in service/production

Makefile

@@ -123,6 +123,7 @@ install-tofu:
 
 lint: install-deps ui-lint ui-fmt ui-check
 	golangci-lint run --timeout 20m ./...
+	go vet -vettool=$$(go tool -n mulint-vet) ./...
 	go tool govulncheck ./...
 
 lint-fix: install-deps ui-lint-fix ui-fmt-fix
@@ -138,7 +139,7 @@ integration-test: build-linux
 	go tool gotestsum --format pkgname -- -race -shuffle on -timeout 10m ./test/integration/...
 
 terraform-test: install-tofu
-	PATH="$$PWD/bin:$$PATH" go tool gotestsum --format pkgname -- -v -race -parallel 8 -timeout 10m ./test/terraform/...
+	PATH="$$PWD/bin:$$PATH" go tool gotestsum --format pkgname -- -v -race -parallel 8 -timeout 45m ./test/terraform/...
 
 e2e: e2e-test
 
@@ -152,7 +153,7 @@ total-coverage: build-linux
 	@echo "Running integration tests with coverage..."
 	go tool gotestsum --format pkgname -- -race -shuffle on -timeout 10m -coverpkg=$(COVERPKGS) -coverprofile=integration-coverage.out -covermode=atomic ./test/integration/...
 	@echo "Running terraform tests with coverage..."
-	go tool gotestsum --format pkgname -- -race -parallel 8 -timeout 20m -coverpkg=$(COVERPKGS) -coverprofile=terraform-coverage.out -covermode=atomic ./test/terraform/...
+	go tool gotestsum --format pkgname -- -race -parallel 8 -timeout 45m -coverpkg=$(COVERPKGS) -coverprofile=terraform-coverage.out -covermode=atomic ./test/terraform/...
 	@echo "Running E2E tests with coverage..."
 	go tool gotestsum --format pkgname -- -race -shuffle on -timeout 10m -tags=e2e -coverpkg=$(COVERPKGS) -coverprofile=e2e-coverage.out -covermode=atomic ./test/e2e/...
 	@echo "Merging coverage profiles..."