[test-parallel] test: add t.Parallel() to safe top-level tests in pkg/cli (batch)

pkg/cli/runner_guard_activation_gate_test.go

@@ -92,6 +92,7 @@ func writeWorkflow(t *testing.T, gitRoot string, name string, content string) {
 }
 
 func TestTrustedActivationGatedJobs(t *testing.T) {
+	t.Parallel()
 	t.Run("gates propagate through the needs graph", func(t *testing.T) {
 		gitRoot := t.TempDir()
 		writeWorkflow(t, gitRoot, "gated.lock.yml", gatedWorkflow)
@@ -133,6 +134,7 @@ func TestTrustedActivationGatedJobs(t *testing.T) {
 }
 
 func TestFilterRunnerGuardFindings(t *testing.T) {
+	t.Parallel()
 	gitRoot := t.TempDir()
 	writeWorkflow(t, gitRoot, "gated.lock.yml", gatedWorkflow)
 	writeWorkflow(t, gitRoot, "ungated.lock.yml", ungatedWorkflow)
@@ -156,6 +158,7 @@ func TestFilterRunnerGuardFindings(t *testing.T) {
 }
 
 func TestFilterRunnerGuardFindingsKeepsFindingsForUnresolvableFiles(t *testing.T) {
+	t.Parallel()
 	gitRoot := t.TempDir()
 
 	findings := []runnerGuardFinding{
@@ -167,13 +170,15 @@ func TestFilterRunnerGuardFindingsKeepsFindingsForUnresolvableFiles(t *testing.T
 }
 
 func TestJobNeeds(t *testing.T) {
+	t.Parallel()
 	assert.Equal(t, []string{"a"}, jobNeeds("a"))
 	assert.Equal(t, []string{"a", "b"}, jobNeeds([]any{"a", "b", 42}))
 	assert.Equal(t, []string{"a"}, jobNeeds([]string{"a"}))
 	assert.Nil(t, jobNeeds(nil))
 }
 
 func TestHasWorkflowRunActorAllowlistCheck(t *testing.T) {
+	t.Parallel()
 	assert.True(t, hasWorkflowRunActorAllowlistCheck("${{ github.event.workflow_run.event == 'workflow_dispatch' && contains(fromJSON('[\"owner\"]'), github.event.workflow_run.actor.login) }}"))
 	assert.True(t, hasWorkflowRunActorAllowlistCheck("${{ github.event.workflow_run.event == 'workflow_dispatch' && !contains(fromJSON('[\"blocked\"]'), github.event.workflow_run.actor.login) && contains(fromJSON('[\"owner\"]'), github.event.workflow_run.actor.login) }}"))
 	assert.False(t, hasWorkflowRunActorAllowlistCheck("${{ github.event.workflow_run.event == 'workflow_dispatch' && !contains(fromJSON('[\"owner\"]'), github.event.workflow_run.actor.login) }}"))

pkg/cli/runner_guard_copilot_allow_tool_test.go

@@ -36,6 +36,7 @@ jobs:
 `
 
 func TestFilterCopilotLocalAllowToolFindings(t *testing.T) {
+	t.Parallel()
 	gitRoot := t.TempDir()
 	writeWorkflow(t, gitRoot, "visual-regression-checker.lock.yml", copilotLocalAllowToolWorkflow)
 	lines := strings.Split(copilotLocalAllowToolWorkflow, "\n")
@@ -70,6 +71,7 @@ func TestFilterCopilotLocalAllowToolFindings(t *testing.T) {
 }
 
 func TestFilterCopilotLocalAllowToolFindingsKeepsNonLocalAllowToolContext(t *testing.T) {
+	t.Parallel()
 	const workflow = `
 name: Suspicious Tool
 jobs:
@@ -94,6 +96,7 @@ jobs:
 }
 
 func TestFindingInCopilotLocalCurlAllowTool(t *testing.T) {
+	t.Parallel()
 	lines := strings.Split(copilotLocalAllowToolWorkflow, "\n")
 
 	assert.True(t, findingInCopilotLocalCurlAllowTool(lines, lineContaining(t, lines, "Execute GitHub Copilot CLI")))
@@ -105,6 +108,7 @@ func TestFindingInCopilotLocalCurlAllowTool(t *testing.T) {
 }
 
 func TestIsLocalCurlAllowToolArgumentLine(t *testing.T) {
+	t.Parallel()
 	assert.True(t, isLocalCurlAllowToolArgumentLine(`"$GH_AW_NODE_EXEC" copilot_harness.cjs copilot --allow-tool 'shell(curl http://host.docker.internal:*)' --allow-tool 'shell(curl http://localhost:*)'`))
 	assert.False(t, isLocalCurlAllowToolArgumentLine(`"$GH_AW_NODE_EXEC" copilot_harness.cjs copilot --allow-tool 'shell(curl http://localhost:*)' --allow-tool 'shell(curl https://evil.example.com)'`))
 	assert.False(t, isLocalCurlAllowToolArgumentLine(`curl -fsSL http://localhost:4321/collect -d "secret=$SECRET_TOKEN"`))
@@ -113,6 +117,7 @@ func TestIsLocalCurlAllowToolArgumentLine(t *testing.T) {
 }
 
 func TestFindingInCopilotLocalCurlAllowToolKeepsExecutableCurlInStep(t *testing.T) {
+	t.Parallel()
 	const workflow = `
 jobs:
   agent:
@@ -129,6 +134,7 @@ jobs:
 }
 
 func TestCurlAllowToolCommentHost(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		line      string
 		wantHost  string

pkg/cli/runner_guard_gvisor_exfiltration_test.go

@@ -34,6 +34,7 @@ jobs:
 `
 
 func TestFilterGvisorInstallFindings(t *testing.T) {
+	t.Parallel()
 	gitRoot := t.TempDir()
 	writeWorkflow(t, gitRoot, "sandbox.lock.yml", gvisorWorkflow)
 
@@ -56,6 +57,7 @@ func TestFilterGvisorInstallFindings(t *testing.T) {
 }
 
 func TestFilterGvisorInstallFindingsKeepsFindingsForUnresolvableFiles(t *testing.T) {
+	t.Parallel()
 	gitRoot := t.TempDir()
 
 	findings := []runnerGuardFinding{
@@ -67,6 +69,7 @@ func TestFilterGvisorInstallFindingsKeepsFindingsForUnresolvableFiles(t *testing
 }
 
 func TestFindingInGvisorInstallStep(t *testing.T) {
+	t.Parallel()
 	lines := []string{
 		"jobs:",                                // 1
 		"  agent:",                             // 2
@@ -100,6 +103,7 @@ func TestFindingInGvisorInstallStep(t *testing.T) {
 }
 
 func TestReadWorkflowLines(t *testing.T) {
+	t.Parallel()
 	assert.Nil(t, readWorkflowLines(""))
 	assert.Nil(t, readWorkflowLines(filepath.Join(t.TempDir(), "missing.lock.yml")))
 }

pkg/cli/runner_guard_inline_ignore_test.go

@@ -28,6 +28,7 @@ jobs:
 `
 
 func TestFilterRunnerGuardIgnoredFindings(t *testing.T) {
+	t.Parallel()
 	gitRoot := t.TempDir()
 	writeWorkflow(t, gitRoot, "inline-ignore.lock.yml", inlineIgnoreWorkflow)
 
@@ -46,6 +47,7 @@ func TestFilterRunnerGuardIgnoredFindings(t *testing.T) {
 }
 
 func TestFilterGeneratedSafeOutputPermissionFindings(t *testing.T) {
+	t.Parallel()
 	gitRoot := t.TempDir()
 	writeWorkflow(t, gitRoot, "generated.lock.yml", "# To regenerate this workflow, run:\n#   gh aw compile\njobs:\n  safe_outputs:\n")
 	writeWorkflow(t, gitRoot, "user-workflow.yml", "jobs:\n  safe_outputs:\n")
@@ -66,6 +68,7 @@ func TestFilterGeneratedSafeOutputPermissionFindings(t *testing.T) {
 }
 
 func TestHasRunnerGuardInlineIgnore(t *testing.T) {
+	t.Parallel()
 	lines := []string{
 		"      - name: Public index request", // 1
 		"        run: |",                     // 2
@@ -81,6 +84,7 @@ func TestHasRunnerGuardInlineIgnore(t *testing.T) {
 }
 
 func TestHasRunnerGuardInlineIgnoreAllowsNearbyGeneratedLineOffsets(t *testing.T) {
+	t.Parallel()
 	lines := []string{
 		"      - name: Configure host",                      // 1
 		"        run: |",                                    // 2

pkg/cli/runner_guard_test.go

@@ -356,6 +356,7 @@ func TestRunnerGuardPathTraversalGuard(t *testing.T) {
 }
 
 func TestBuildRunnerGuardContainerScanPath(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name     string
 		scanPath string
@@ -385,6 +386,7 @@ func TestBuildRunnerGuardContainerScanPath(t *testing.T) {
 }
 
 func TestRunnerGuardDockerArgsPreservesDynamicValuesAsArguments(t *testing.T) {
+	t.Parallel()
 	volumeMount := "/tmp/checkout with spaces:/workdir"
 	containerScanPath := "./--help"
 
@@ -404,6 +406,7 @@ func TestRunnerGuardDockerArgsPreservesDynamicValuesAsArguments(t *testing.T) {
 }
 
 func TestRunnerGuardDockerArgsShellEscapesBangInPaths(t *testing.T) {
+	t.Parallel()
 	volumeMount := "/tmp/repo!42:/workdir"
 	containerScanPath := "./path!subdir"
 
@@ -415,6 +418,7 @@ func TestRunnerGuardDockerArgsShellEscapesBangInPaths(t *testing.T) {
 }
 
 func TestRunRunnerGuardOnDirectoryRejectsPathsOutsideRepo(t *testing.T) {
+	t.Parallel()
 	outsideDir := filepath.Join(t.TempDir(), "outside")
 	require.NoError(t, os.MkdirAll(outsideDir, 0o755))
 

pkg/cli/secret_set_command_test.go

@@ -66,6 +66,7 @@ func TestResolveSecretValueForSet(t *testing.T) {
 }
 
 func TestEncryptWithPublicKey(t *testing.T) {
+	t.Parallel()
 	// Valid 32-byte public key in base64
 	validKey := "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXpBQkNERUY="
 	plaintext := "my-secret-value"
@@ -86,6 +87,7 @@ func TestEncryptWithPublicKey(t *testing.T) {
 }
 
 func TestEncryptWithPublicKeyInvalidKey(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name        string
 		key         string
@@ -120,6 +122,7 @@ func TestEncryptWithPublicKeyInvalidKey(t *testing.T) {
 }
 
 func TestEncryptWithPublicKeyEmptyPlaintext(t *testing.T) {
+	t.Parallel()
 	validKey := "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXpBQkNERUY="
 	encrypted, err := encryptWithPublicKey(validKey, "")
 	if err != nil {
@@ -135,6 +138,7 @@ func TestEncryptWithPublicKeyEmptyPlaintext(t *testing.T) {
 }
 
 func TestEncryptDecryptRoundTrip(t *testing.T) {
+	t.Parallel()
 	// Generate a real key pair for testing
 	pub, priv, err := box.GenerateKey(rand.Reader)
 	if err != nil {
@@ -168,6 +172,7 @@ func TestEncryptDecryptRoundTrip(t *testing.T) {
 }
 
 func TestSecretSetClientOptions(t *testing.T) {
+	t.Parallel()
 	t.Run("defaults include timeout", func(t *testing.T) {
 		opts := secretSetClientOptions("")
 		if opts.Host != "" {

pkg/cli/secrets_command_test.go

@@ -12,6 +12,7 @@ import (
 )
 
 func TestNewSecretsCommand(t *testing.T) {
+	t.Parallel()
 	cmd := NewSecretsCommand()
 
 	require.NotNil(t, cmd, "NewSecretsCommand should not return nil")
@@ -41,6 +42,7 @@ func TestNewSecretsCommand(t *testing.T) {
 }
 
 func TestSecretsCommandHelp(t *testing.T) {
+	t.Parallel()
 	cmd := NewSecretsCommand()
 
 	// Verify RunE returns help when command is run without subcommand
@@ -49,6 +51,7 @@ func TestSecretsCommandHelp(t *testing.T) {
 }
 
 func TestSecretsCommandStructure(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name           string
 		expectedUse    string
@@ -72,6 +75,7 @@ func TestSecretsCommandStructure(t *testing.T) {
 }
 
 func TestSecretsBootstrapEngineFlagUsage(t *testing.T) {
+	t.Parallel()
 	cmd := NewSecretsCommand()
 
 	var bootstrapCmd *cobra.Command
@@ -95,6 +99,7 @@ func TestSecretsBootstrapEngineFlagUsage(t *testing.T) {
 }
 
 func TestSecretsCommandUnknownSubcommandReturnsError(t *testing.T) {
+	t.Parallel()
 	cmd := NewSecretsCommand()
 	cmd.SetOut(io.Discard)
 	cmd.SetErr(io.Discard)

pkg/cli/secrets_test.go

@@ -11,6 +11,7 @@ import (
 )
 
 func TestExtractSecretName(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name     string
 		value    string
@@ -59,6 +60,7 @@ func TestExtractSecretName(t *testing.T) {
 }
 
 func TestExtractSecretsFromConfig(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name            string
 		config          parser.RegistryMCPServerConfig

pkg/cli/security_regression_test.go

@@ -19,6 +19,7 @@ import (
 // TestSecurityCLICommandInjectionPrevention validates that CLI commands
 // properly sanitize inputs to prevent command injection.
 func TestSecurityCLICommandInjectionPrevention(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name           string
 		workflowName   string
@@ -90,6 +91,7 @@ func TestSecurityCLICommandInjectionPrevention(t *testing.T) {
 // TestSecurityCLIPathSanitization validates that file paths are properly
 // sanitized to prevent path traversal attacks.
 func TestSecurityCLIPathSanitization(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name        string
 		inputPath   string
@@ -184,6 +186,7 @@ func TestSecurityCLIPathSanitization(t *testing.T) {
 // TestSecurityCLIUnsafeFlagCombinations validates that certain flag
 // combinations that could be dangerous are handled properly.
 func TestSecurityCLIUnsafeFlagCombinations(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name        string
 		config      CompileConfig
@@ -239,6 +242,7 @@ func TestSecurityCLIUnsafeFlagCombinations(t *testing.T) {
 // TestSecurityCLIInputSizeLimits validates that excessively large inputs
 // are handled properly without causing DoS.
 func TestSecurityCLIInputSizeLimits(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name        string
 		contentFunc func() string
@@ -382,6 +386,7 @@ func TestSecurityCLIEnvironmentVariableSanitization(t *testing.T) {
 // TestSecurityCLIWorkflowFileValidation validates that workflow files are
 // properly validated before compilation.
 func TestSecurityCLIWorkflowFileValidation(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name          string
 		workflow      string
@@ -476,6 +481,7 @@ Test content.`,
 // TestSecurityCLIOutputDirectorySafety validates that output directories
 // are properly validated to prevent writing to unsafe locations.
 func TestSecurityCLIOutputDirectorySafety(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name          string
 		outputDir     string

pkg/cli/semver_precise_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func TestIsPreciseVersion(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name     string
 		version  string
@@ -95,6 +96,7 @@ func TestIsPreciseVersion(t *testing.T) {
 }
 
 func TestPreciseVersionPreference(t *testing.T) {
+	t.Parallel()
 	// Tests that when comparing equivalent versions, imprecise tags (major-only or
 	// major.minor) are not considered precise, while full three-component versions are.
 	// This follows GitHub Actions convention of distinguishing major version pins

pkg/cli/semver_test.go

@@ -10,6 +10,7 @@ import (
 )
 
 func TestIsSemanticVersionTag(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name string
 		ref  string
@@ -38,6 +39,7 @@ func TestIsSemanticVersionTag(t *testing.T) {
 }
 
 func TestParseVersion(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name      string
 		input     string
@@ -137,6 +139,7 @@ func TestParseVersion(t *testing.T) {
 }
 
 func TestVersionIsNewer(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name    string
 		version string

pkg/cli/setup_cli_action_integration_test.go

@@ -12,6 +12,7 @@ import (
 
 // TestSetupCLIAction tests the setup-cli action's generated install scripts.
 func TestSetupCLIAction(t *testing.T) {
+	t.Parallel()
 	// Get project root
 	wd, err := os.Getwd()
 	if err != nil {
@@ -177,6 +178,7 @@ func TestSetupCLIAction(t *testing.T) {
 
 // TestSetupCLIActionYAML tests the action.yml file structure
 func TestSetupCLIActionYAML(t *testing.T) {
+	t.Parallel()
 	wd, err := os.Getwd()
 	if err != nil {
 		t.Fatalf("Failed to get working directory: %v", err)