[polylane]

The parity test for the package-level nldump functions failed the lint job on three errorlint findings, because it passed a listing error through a non-wrapping format verb. Each listing call now handles its error before checking membership, so the error is wrapped and the membership message stays readable.

Detection evidence

Affected: int_17ad4b457001o98datdn4tkm

Why this fix

The CI lint failure was three errorlint errors on the package-level listing checks, which passed the listing error to a plain format verb. Handling each error before the membership check wraps it and keeps the assertion message free of the old cosmetic %!w() output. The test's behavior is unchanged, so the earlier race fix stands.

Fix walkthrough

Watch the fix explained (1:05). Recorded for commit 6715d8ac6c35033a52d5c6b84df3afdd612ab636.

Out of scope

• The rollout envtest timeout: not touched, since the timing measurement on the issue shows the budget is not the plausible cause.

Production impact: Test-only change in one Go test file, no production path

The diff changes only internal/plumbing/nldump/nldump_test.go, a Go test file. It is not compiled into any binary or deployed resource, so no production behavior changes. ./bin/golangci-lint run ./internal/plumbing/nldump/... reports 0 issues.

Observability

• The changed lines are test assertions; they emit Go test output only. No production signal changes.

Polylane assessed this pull request at 017ace2.

Causal chain

• Signal (log template): --- FAIL: TestLister_ListsTheHandlesNamespace / "package NeighList = %v, %!w(); want 1 entries"
• Surfacing site: datum-cloud/galactic CI, workflow "CI", job "Unit Tests (root)" at datum-cloud/galactic:internal/plumbing/nldump/nldump_test.go#TestLister_ListsTheHandlesNamespace
• Mechanism: The test compares len() of a package-level NeighList dump with len() of an earlier handle NeighList dump. The kernel adds the all-routers multicast neighbor ff02::2 to the test link's IPv6 neighbor table between the two dumps, so the second dump holds two entries against the first one's single entry.
• Producer: nldump parity test (the count-equality assertion), at datum-cloud/galactic:internal/plumbing/nldump/nldump_test.go#TestLister_ListsTheHandlesNamespace
• Trigger: Any run where the kernel adds the all-routers multicast neighbor after the handle dump and before the package-level dump
• What happens to the failed unit today: The test asserts the package-level netlink helpers list the calling thread's namespace rather than the handle's; its doc comment states parity of entries, but two dumps of live kernel state cannot be equal in size by construction
• Cadence check: Intermittent: 2 failures in 200 earlier runs, 13 in 2000 later runs of the same command on an idle host; the CI failure is one of 4 failures in 32 CI runs on main
• Blast radius: unknown other resource(s), unknown other tenant(s); data at risk: none named
• Producer evidence:
  • nldump_test.go:184 compares len(got) != len(neighs) between two dumps taken at different times
  • Reproduced: 13 failing assertions in 2000 runs of the test on this host; the failure message lists ff02::2 and the test's own fd00:2::2
  • Sibling assertions in the same test (AddrList, NeighList, RuleList at lines 173-179) already check membership of the specific object with slices.ContainsFunc

1 file changed (+22/-7)

• internal/plumbing/nldump/nldump_test.go: modified, +22/-7

Repository lint: task lint (declared in Taskfile.yaml) could not run in the sandbox because its tool is not installed there; run it before merging.

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

[polylane]

The lint failure is fixed and the update landed on datum-cloud/galactic#1177.

The Lint job failed on three errorlint findings in internal/plumbing/nldump/nldump_test.go (lines 189, 193, 197): each package-level listing call passed its error to a non-wrapping format verb. I split each call so the error is checked and wrapped with %w before the membership check, which also keeps the assertion message free of the old %!w(<nil>) output. No test behavior changes, so the earlier neighbor-race fix still stands.

Validation (with the CI Go toolchain, GOTOOLCHAIN=go1.26.4):

• golangci-lint run ./internal/plumbing/nldump/... (pinned v2.12.2): 0 issues
• go vet ./internal/plumbing/nldump/: pass
• go test -count=1 ./internal/plumbing/nldump/: ok
• gofmt -l: clean
• not run: whole-module task lint and task test:unit-root (the module-wide run needs eBPF regeneration and is outside this one-file change)

The initial golangci-lint run reported only spurious typecheck errors from an export-data version mismatch (linter built with go1.27 against CI's go1.26); rebuilding it with GOTOOLCHAIN=go1.26.4 cleared them and confirmed the real result.

Pushed in 017ace2.