[CI] Enable race detection for unit tests in CI

Makefile

@@ -181,11 +181,11 @@ test-requires-db: FORCE
 
 # Tests that require no DB at all, e.g., pure logic, utilities
 test-no-db: FORCE
-	@$(call test_method_with_coverage, ${NO_DB_PACKAGES})
+	@$(call test_method_with_coverage, ${NO_DB_PACKAGES}, -race)
 
 # Tests for components that depend on the DB layer, and ones that are agnostic to the specific DB used.
 test-all-db: FORCE
-	@$(call test_method_with_coverage, ${REQUIRES_DB_PACKAGES} ${COR_DB_PACKAGES})
+	@$(call test_method_with_coverage, ${REQUIRES_DB_PACKAGES} ${COR_DB_PACKAGES}, -race)
 
 # Runs test coverage analysis. It uses same tests that will be covered by the CI.
 test-cover: FORCE

docs/setup.md

@@ -103,6 +103,13 @@ To execute the tests, use:
 make test
 ```
 
+### Race Detection
+
+The project uses Go's race detector to catch data race conditions during test execution. Race detection is:
+
+- **Enabled by default in CI and local development** for unit tests (test-no-db, test-all-db)
+- **Not enabled for integration and container tests** to avoid excessive slowdown
+
 ## Golang Development Dependencies Installation
 
 ```shell

loadgen/client_test.go

@@ -457,11 +457,11 @@ func TestLoadGenRateLimiterServer(t *testing.T) {
 	t.Parallel()
 	clientConf := DefaultClientConf(t, test.InsecureTLSConfig)
 	clientConf.Adapter.VerifierClient = startVerifiers(t, test.InsecureTLSConfig, test.InsecureTLSConfig)
-	curRate := uint64(100)
+	curRate := uint64(10)
 	clientConf.Stream.RateLimit = curRate
 	// We use small wait to ensure the rate limiter serves in low granularity.
 	clientConf.LoadProfile.Block.PreferredRate = 10 * time.Millisecond
-	clientConf.LoadProfile.Block.MaxSize = 100
+	clientConf.LoadProfile.Block.MaxSize = 10
 	clientConf.LoadProfile.Block.MinSize = 1
 	clientConf.HTTPServer = test.NewLocalHostServer(test.InsecureTLSConfig)
 
@@ -495,7 +495,7 @@ func TestLoadGenRateLimiterServer(t *testing.T) {
 	requireGetRate(curRate)
 	requireEventuallyMeasuredRate(t, client.resources.Metrics, curRate)
 
-	curRate = uint64(1_000)
+	curRate = uint64(50)
 	setRate(curRate)
 	requireGetRate(curRate)
 	requireEventuallyMeasuredRate(t, client.resources.Metrics, curRate)

scripts/get-and-start-postgres.sh

@@ -12,4 +12,5 @@ echo "Running Postgres container"
 docker run --name sc_test_postgres_unit_tests \
   -e POSTGRES_PASSWORD=postgres \
   -p 5433:5432 \
-  -d postgres:18.3-alpine3.23
+  -d postgres:18.3-alpine3.23 \
+  -c max_connections=1000

service/verifier/policy/policy_test.go

@@ -40,6 +40,7 @@ func TestGetUpdatesFromNamespace(t *testing.T) {
 		ReadWrites: items,
 	}
 	update := GetUpdatesFromNamespace(tx)
+	require.NotNil(t, update)
 	require.NotNil(t, update.GetNamespacePolicies())
 	require.Nil(t, update.Config)
 	require.Len(t, update.NamespacePolicies.Policies, len(items))
@@ -118,6 +119,9 @@ func TestParsePolicyItem(t *testing.T) {
 func TestParseLifecycleEndorsementPolicy(t *testing.T) {
 	t.Parallel()
 
+	// Initialize factory before parallel subtests to avoid data race
+	require.NotNil(t, factory.GetDefault())
+
 	t.Run("valid bundle returns verifier", func(t *testing.T) {
 		t.Parallel()
 		bundle, cryptoPath := createTestBundle(t)

utils/signature/verify_schemes_test.go

@@ -275,8 +275,8 @@ func TestBlsSignatureVerificationErrors(t *testing.T) {
 	t.Parallel()
 
 	_, pub := testsig.NewKeyPair(signature.Bls)
-	verifier, err := signature.NewNsVerifierFromKey(signature.Bls, pub)
-	require.NoError(t, err)
+	verifier, verErr := signature.NewNsVerifierFromKey(signature.Bls, pub)
+	require.NoError(t, verErr)
 
 	tx := &applicationpb.Tx{
 		Namespaces: []*applicationpb.TxNamespace{{
@@ -296,7 +296,7 @@ func TestBlsSignatureVerificationErrors(t *testing.T) {
 				}},
 			}},
 		}
-		err = verifier.VerifyNs("txid", txBad, 0)
+		err := verifier.VerifyNs("txid", txBad, 0)
 		require.ErrorContains(t, err, "cannot set G1 from signature bytes")
 	})
 
@@ -312,7 +312,7 @@ func TestBlsSignatureVerificationErrors(t *testing.T) {
 				}},
 			}},
 		}
-		err = verifier.VerifyNs("txid", txBad, 0)
+		err := verifier.VerifyNs("txid", txBad, 0)
 		require.ErrorIs(t, err, signature.ErrSignatureMismatch)
 	})
 }