From 556d6bafa29da7adf369a14d3a7041ef5f51ced9 Mon Sep 17 00:00:00 2001
From: mannie-exe <mannie@inherent.design>
Date: Sun, 22 Feb 2026 15:07:23 -0800
Subject: [PATCH] Fix CI: enable ICMP tests on Linux and fix gotestfmt on
 macOS/Windows

Three pre-existing issues prevented the Check workflow from passing:

1. Linux: ICMP tests fail because ping_group_range on GitHub Actions
   runners defaults to "1 0" (unprivileged ICMP disabled). Add sysctl
   step to allow unprivileged ICMP sockets.

2. macOS: go test -json emits linker warnings (LC_DYSYMTAB) as
   "Action":"build-output" JSON lines. gotestfmt v2.5.0 predates this
   action type (Go 1.21+) and panics in parseLine
   (gotesttools/gotestfmt#64). Filter build-output lines before piping
   to gotestfmt.

3. Windows: GO_TEST_LOG_OUTPUT pointed to /tmp/gotest.log which does
   not resolve through the MSYS2-to-native-Go boundary. Use relative
   path instead.

These failures were masked by fail-fast: Linux failed first (ICMP),
cancelling macOS and Windows before they reached gotestfmt.
---
 .github/workflows/check.yaml | 3 +++
 .gitignore                   | 1 +
 Makefile                     | 4 ++--
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index e8a2aa0b..979457b8 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -14,5 +14,8 @@ jobs:
         go-version: ${{ matrix.go-version }}
     - name: Checkout code
       uses: actions/checkout@v4
+    - name: Allow unprivileged ICMP (Linux)
+      if: runner.os == 'Linux'
+      run: sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"
     - name: Test
       run: make test
diff --git a/.gitignore b/.gitignore
index 46e818f1..f34ffc65 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,6 +14,7 @@ cscope.*
 /packaging
 .DS_Store
 *-session.log
+gotest.log
 ssh_server_tests/.env
 /.cover
 built_artifacts/
diff --git a/Makefile b/Makefile
index 8490480e..207c64cc 100644
--- a/Makefile
+++ b/Makefile
@@ -128,7 +128,7 @@ endif
 #for FIPS compliance, FPM defaults to MD5.
 RPM_DIGEST := --rpm-digest sha256
 
-GO_TEST_LOG_OUTPUT = /tmp/gotest.log
+GO_TEST_LOG_OUTPUT = gotest.log
 
 .PHONY: all
 all: cloudflared test
@@ -164,7 +164,7 @@ generate-docker-version:
 test: vet
 	$Q go test -json -v -mod=vendor -race $(LDFLAGS) ./... 2>&1 | tee $(GO_TEST_LOG_OUTPUT)
 ifneq ($(FIPS), true)
-	@go run -mod=readonly github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest -input $(GO_TEST_LOG_OUTPUT)
+	@grep -v '"Action":"build-output"' $(GO_TEST_LOG_OUTPUT) | go run -mod=readonly github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest
 endif
 
 .PHONY: cover