test: enforce a slow-test budget on CI

[LKSNDRTMLKV]

Item 5 of the CI/test-speed plan: the guardrail. Two layers, calibrated against measured numbers rather than a round guess.

Why

A resolver test drifted to 50 seconds — a debug-build loop asserting a bound that holds at any size. It was the slowest test in the workspace by roughly 500x, and it was found only because I went looking for where CI time went. Nothing in the repo objected, and nothing would have objected to the next one.

Layer 1 — slow-timeout warns

.config/nextest.toml gains slow-timeout = { period = "10s", terminate-after = 12 }. nextest prints SLOW [> 10.000s] and counts it in the summary.

terminate-after lands at 120s and is set to catch a hang, not a slow test — deliberately generous, because a budget that fails the build intermittently is a budget people delete.

One override, with its reason: migration_0024_restores_registrations_lost_before_the_fix applies a migration to a server that predates it, so by definition it cannot clone the shared template and must boot its own Postgres.

Verified firing: a deliberately-slow probe produced SLOW [> 10.000s] and 1 passed (1 slow). Reverted.

Layer 2 — the budget that actually fails

A warning in a log nobody reads is not a budget. scripts/slow-test-check.sh reads the JUnit CI already writes and fails the job on anything over 10s.

Reading recorded times rather than re-running means the check measures what happened and cannot itself be flaky.

Verified in both directions against real CI output: passes at 10s over 575 tests, and at a 3s budget correctly names the eight tests that exceed it.

Why 10s, and why CI-only

Taken from the JUnit artifact of the last main run, not from intuition:

• Slowest single test on CI: 5.14s. 10s is ~2x headroom.
• The same suite locally reaches 17.6s. migration_0024 is 3.83s on a Linux runner and 17.6s on this machine — container startup behind Docker Desktop goes through a VM.

Enforcing that threshold locally would fail honest work on the wrong machine, so locally slow-timeout warns and that is the right strength.

The allowlist is empty on purpose

Every test that starts its own container still lands under 10s on a Linux runner, so nothing needs an exemption today. The list exists so the first real one is argued for in review rather than absorbed by raising the number — and the failure message says so: "Raising the budget is not the fix."

Verification

just check green: 842 tests, all gates, cargo audit. The budget script was run against the real CI JUnit at both a passing and a failing threshold. ci.yml parses.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}