From 6cafa2e0d76a9bc83c8c401d5dd27c9cf31c6be9 Mon Sep 17 00:00:00 2001
From: BUG-Fly <1252811289@qq.com>
Date: Sun, 6 Sep 2026 08:46:57 +0800
Subject: [PATCH] Add a godebug input so a caller can set GODEBUG for go test

leakcheck's leak detection (upstream gotrace) panics unless
GODEBUG=tracebackancestors=N is set, //go:debug rejects runtime settings
such as this one, and upstream's own CI set the variable in the workflow
env. A called workflow does not inherit the caller's env, so the reusable
workflow takes the value as an input and applies it to the go test step
only. Found while writing the satellites' callers (wand #38).
---
 .github/workflows/go.yml | 9 +++++++++
 README.md                | 2 ++
 2 files changed, 11 insertions(+)

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 1d784b2..3739865 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -30,6 +30,13 @@ on:
         description: Directory of the Go module, relative to the repository root.
         type: string
         default: .
+      godebug:
+        description: >-
+          GODEBUG for the test binaries, e.g. tracebackancestors=1000 for a
+          suite built on leakcheck. Empty leaves it unset. A called workflow
+          does not inherit the caller's env, hence an input.
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -81,6 +88,8 @@ jobs:
       - run: go vet ./...
 
       - run: go test -race -count=1 -covermode=atomic -coverprofile=coverage.out ./...
+        env:
+          GODEBUG: ${{ inputs.godebug }}
 
       - name: Coverage ratchet
         if: matrix.os == 'ubuntu-latest' && matrix.go == 'stable'
diff --git a/README.md b/README.md
index 792aae0..bc05be3 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,7 @@ Organisation-wide defaults for [headlesslab](https://github.com/headlesslab) rep
 | `coverage-threshold` | number | required | Minimum total statement coverage in percent, measured on the `ubuntu-latest` / `stable` job. Set it to the module's current coverage (for a snapshot-imported Satellite, the level it was imported at) and only ever raise it. |
 | `cross-platform` | boolean | `false` | Also run the `test` job on `windows-latest` and `macos-latest`, on Go `stable`. |
 | `working-directory` | string | `.` | Directory of the Go module, relative to the repository root. |
+| `godebug` | string | empty | `GODEBUG` for the test binaries on every `test` cell, e.g. `tracebackancestors=1000` for a suite built on [leakcheck](https://github.com/headlesslab/leakcheck). A called workflow does not inherit the caller's `env`, so the variable travels as an input. |
 
 ### Calling it
 
@@ -56,6 +57,7 @@ jobs:
     with:
       coverage-threshold: 90
       # cross-platform: true   # only where OS behaviour matters (file locks, renames)
+      # godebug: tracebackancestors=1000   # only for a suite built on leakcheck
 ```
 
 The resulting check names are `go / test (ubuntu-latest, floor)`, `go / test (ubuntu-latest, stable)`, `go / lint` and `go / govulncheck`, plus `go / test (windows-latest, stable)` and `go / test (macos-latest, stable)` with `cross-platform: true`. Those are the Gates a Satellite's `main` ruleset requires.