Merge branch 'main' into CRE-164-cap-limits-http-action-call

Author: jmank88

.github/workflows/keystore.yml

@@ -0,0 +1,64 @@
+name: Keystore Checks
+permissions:
+  contents: read
+
+on:
+  push:
+    paths:
+      - "keystore/**"
+
+jobs:
+  run-tests:
+    defaults:
+      run:
+        working-directory: keystore
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: ./.github/actions/setup-go
+        with:
+          go-version-file: "go.mod"
+          restore-build-cache-only: "false"
+
+      - name: Build
+        run: go build -v ./...
+
+      - name: Unit Tests
+        run: go test ./... -coverpkg=./... -coverprofile=coverage.txt
+
+  build-race-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: ./.github/actions/setup-go
+        with:
+          go-version-file: "go.mod"
+
+      - name: Build
+        run: go build -v ./...
+
+      - name: Race Tests
+        run: GORACE="log_path=$PWD/race" go test -race ./...
+
+      - name: Print Races
+        if: failure()
+        id: print-races
+        run: |
+          find race.* | xargs cat > race.txt
+          if [[ -s race.txt ]]; then
+            cat race.txt
+          fi
+
+      - name: Upload Go test results
+        if: always()
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        with:
+          name: go-race-results
+          path: |
+            ./race.*

pkg/settings/limits/updater.go

@@ -82,7 +82,7 @@ func (u *updater[N]) updateLoop(cre contexts.CRE) {
 	var c <-chan time.Time
 	if u.subFn != nil {
 		updates, cancelSub = u.subFn(contexts.WithCRE(ctx, cre))
-		defer cancelSub()
+		defer func() { cancelSub() }() // extra func wrapper is required to ensure we get the final cancelSub value
 		// opt: poll now to initialize
 	} else {
 		t := services.TickerConfig{}.NewTicker(pollPeriod)