ci: rename test-unit-bindata, simplify and address review comments

Rename:
- test-unit-bindata -> test-unit-nogogit. Both jobs run with the
  bindata tag; the meaningful difference is the gogit codepath, and
  the codebase already uses the nogogit/gogit suffix on its
  build-tagged source files.

test-unit-gogit cleanup:
- The gogit-affected package set (modules/git/gitrepo/lfs and direct
  importers) doesn't touch elasticsearch/meilisearch/redis/minio/
  azurite, so drop those services and the matching /etc/hosts step.

Shard runner robustness (Copilot review feedback):
- Validate TEST_SHARD/TEST_TOTAL_SHARDS are positive ints with
  shard in [1, total]; exit 2 on bad input.
- Tighten the test-name grep to require `*testing.T` or `*testing.TB`
  arg, dropping the TestMain false-positive.
- Force LC_ALL=C sort so the partition is deterministic regardless
  of the runner's locale.
- Empty assignment now exits 1 instead of silently passing.

find-gogit-test-pkgs.sh:
- Mirror the Makefile's GO_TEST_PACKAGES exclusions (drop
  models/migrations/..., tests/integration, tests/integration/migration-test).
- Tighten the comment header — the script returns packages WITH TESTS,
  not all callers.
- Drop dead alternatives from the import-match regex.

Makefile test-backend-gogit:
- Fail when the script fails or returns no packages instead of
  silently running `go test` with no args.

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>

.github/workflows/pull-db-tests.yml

@@ -127,7 +127,7 @@ jobs:
     steps:
       - run: '[ "${{ needs.test-sqlite-shards.result }}" = "success" ]'
 
-  test-unit-bindata:
+  test-unit-nogogit:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
     needs: files-changed
     runs-on: ubuntu-latest
@@ -193,40 +193,9 @@ jobs:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
     needs: files-changed
     runs-on: ubuntu-latest
-    services:
-      elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
-        env:
-          discovery.type: single-node
-          xpack.security.enabled: false
-        ports:
-          - "9200:9200"
-      meilisearch:
-        image: getmeili/meilisearch:v1
-        env:
-          MEILI_ENV: development # disable auth
-        ports:
-          - "7700:7700"
-      redis:
-        image: redis
-        options: >- # wait until redis has started
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 3s
-          --health-retries 10
-        ports:
-          - 6379:6379
-      minio:
-        image: bitnamilegacy/minio:2021.12.29
-        env:
-          MINIO_ACCESS_KEY: 123456
-          MINIO_SECRET_KEY: 12345678
-        ports:
-          - "9000:9000"
-      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest
-        ports:
-          - 10000:10000
+    # the gogit-affected package set (modules/git, modules/gitrepo, modules/lfs and
+    # their direct importers) doesn't touch elasticsearch/meilisearch/redis/minio/
+    # azurite — no services needed.
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -238,8 +207,6 @@ jobs:
         with:
           cache-name: unit-gogit
           build-cache-rotate: "true"
-      - name: Add hosts to /etc/hosts
-        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
       - run: make deps-backend
       - run: make backend
         env:
@@ -254,11 +221,11 @@ jobs:
           GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
 
   test-unit:
-    needs: [files-changed, test-unit-bindata, test-unit-gogit]
+    needs: [files-changed, test-unit-nogogit, test-unit-gogit]
     if: always() && (needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true')
     runs-on: ubuntu-latest
     steps:
-      - run: '[ "${{ needs.test-unit-bindata.result }}" = "success" ] && [ "${{ needs.test-unit-gogit.result }}" = "success" ]'
+      - run: '[ "${{ needs.test-unit-nogogit.result }}" = "success" ] && [ "${{ needs.test-unit-gogit.result }}" = "success" ]'
 
   test-mysql-shards:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'

Makefile

@@ -383,8 +383,9 @@ test-backend: ## test backend files
 
 .PHONY: test-backend-gogit
 test-backend-gogit: ## test packages whose code or tests import the gogit-affected modules
-	@pkgs=$$(./tools/find-gogit-test-pkgs.sh '$(TAGS)'); \
-	echo "Running go test with $(GOTEST_FLAGS) -tags '$(TAGS)' over $$(echo $$pkgs | wc -w) gogit-affected packages..."; \
+	@pkgs=$$(./tools/find-gogit-test-pkgs.sh '$(TAGS)') && \
+	if [ -z "$$pkgs" ]; then echo "no gogit-affected packages found" >&2; exit 1; fi && \
+	echo "Running go test with $(GOTEST_FLAGS) -tags '$(TAGS)' over $$(echo $$pkgs | wc -w) gogit-affected packages..." && \
 	$(GO) test $(GOTEST_FLAGS) -tags='$(TAGS)' $$pkgs
 
 .PHONY: test-frontend

tools/find-gogit-test-pkgs.sh

@@ -1,16 +1,20 @@
 #!/bin/bash
 set -euo pipefail
 
-# Print packages whose own code or test code imports any of the gogit-affected
-# modules (modules/git, modules/gitrepo, modules/lfs). These are the packages
-# whose tests can observe behavioral differences between the bindata and
-# bindata+gogit tag sets.
+# Print packages with tests whose own code or test code imports any of the
+# gogit-affected modules (modules/git, modules/gitrepo, modules/lfs). These
+# are the packages whose tests can observe behavioral differences between
+# the bindata and bindata+gogit tag sets.
+#
+# Packages without tests are intentionally skipped — they're compiled
+# transitively by their consumers, so any tag-related compile error would
+# already surface in those consumers' test builds.
 
 tags=${1:?usage: $0 TAGS}
 
 # Exclusions mirror the Makefile's GO_TEST_PACKAGES filter — these packages
 # need a real database / dedicated harness and are tested separately.
 go list -tags "$tags" -f '{{if or .TestGoFiles .XTestGoFiles}}{{.ImportPath}}|{{range .Imports}}{{.}};{{end}}{{range .TestImports}}{{.}};{{end}}{{range .XTestImports}}{{.}};{{end}}{{end}}' ./... \
-  | awk -F'|' '$2 ~ /code\.gitea\.io\/gitea\/modules\/(git|gitrepo|lfs)([\.\/;]|$)/ { print $1 }' \
+  | awk -F'|' '$2 ~ /code\.gitea\.io\/gitea\/modules\/(git|gitrepo|lfs)[\/;]/ { print $1 }' \
   | grep -vE '^code\.gitea\.io/gitea/(models/migrations(/|$)|tests(/integration(/migration-test)?)?$)' \
   | sort -u

tools/test-integration-shard.sh

@@ -10,14 +10,24 @@ binary=$1
 shard=${TEST_SHARD:?missing TEST_SHARD}
 total=${TEST_TOTAL_SHARDS:?missing TEST_TOTAL_SHARDS}
 
-names=$(grep -hE '^func Test[A-Z][A-Za-z0-9_]*\(' tests/integration/*.go \
+if ! [[ "$total" =~ ^[1-9][0-9]*$ ]]; then
+  echo "TEST_TOTAL_SHARDS must be a positive integer, got: $total" >&2
+  exit 2
+fi
+if ! [[ "$shard" =~ ^[1-9][0-9]*$ ]] || [ "$shard" -gt "$total" ]; then
+  echo "TEST_SHARD must be in [1, $total], got: $shard" >&2
+  exit 2
+fi
+
+# match `func Test*(t *testing.T|TB)` only — excludes TestMain (takes *testing.M)
+names=$(grep -hE '^func Test[A-Z][A-Za-z0-9_]*\([a-zA-Z_][a-zA-Z0-9_]* \*testing\.(T|TB)\)' tests/integration/*.go \
   | sed -E 's/^func (Test[A-Z][A-Za-z0-9_]*).*/\1/' \
-  | sort -u \
-  | awk -v s="$shard" -v t="$total" 'NR % t == (s - 1) % t')
+  | LC_ALL=C sort -u \
+  | awk -v r=$((shard - 1)) -v t="$total" 'NR % t == r')
 
 if [ -z "$names" ]; then
-  echo "shard $shard/$total has no tests assigned" >&2
-  exit 0
+  echo "no tests assigned to shard $shard/$total — likely a misconfiguration" >&2
+  exit 1
 fi
 
 pattern=$(echo "$names" | paste -sd '|' -)