integration/test.sh:33

• If test discovery fails or produces zero tests, the script currently exits successfully (loop runs zero times) and also may terminate early because grep returns exit code 1 when there are no matches. It would be safer to handle the -test.list pipeline explicitly (|| true) and then fail with a clear message when tests is empty.

# Discover tests from the binary (respects build tags).
readarray -t tests < <(../_output/integration.test -test.list '.*' 2>/dev/null | grep '^Test')

integration/test.sh:60

• The -run filtering uses Bash regex matching ([[ ... =~ ... ]]), which doesn’t match Go’s -run/-test.list regexp semantics (RE2). To keep behavior consistent with go test -run, consider passing the pattern to integration.test -test.list <pattern> and using that output as the filtered test list instead of re-implementing matching in Bash.

if [ -n "$run_pattern" ]; then
    filtered=()
    for test in "${tests[@]}"; do
        [[ "$test" =~ $run_pattern ]] && filtered+=("$test")
    done
    tests=("${filtered[@]}")

integration/test.ps1:29

• When the test binary can’t be executed or -test.list returns nothing, $tests becomes empty and the script will currently report success (no loop iterations). Consider treating an empty test list as an error with a helpful message so CI/local runs don’t silently skip integration tests.

# Discover tests from the binary (respects build tags).
# Pass flags as an array to prevent PowerShell splitting on dots.
$tests = & $testBin @('-test.list', '.*') 2>$null | Where-Object { $_ -match '^Test' }

integration/test.ps1:52

• The -run filtering uses PowerShell/.NET regex via -match, which can differ from Go’s -run regexp semantics (RE2). For consistency with go test -run, consider discovering tests with -test.list <pattern> (using the provided pattern) instead of filtering the full list with a different regex engine.

# Parse TESTFLAGS forwarded from the task invocation.
#   -run <pattern>  filters which discovered tests to run (not passed to binary)
#   -v              changes gotestsum output format (handled in Taskfile; skip here)
#   anything else   is normalised to -test.<flag> and forwarded to the binary
$runPattern = $null
$binaryFlags = @()
if ($env:TESTFLAGS) {
    $tokens = ($env:TESTFLAGS -split '\s+') | Where-Object { $_ }
    for ($i = 0; $i -lt $tokens.Count; $i++) {
        switch -Regex ($tokens[$i]) {
            '^-run$'     { $runPattern = $tokens[++$i]; break }
            '^-run=(.+)' { $runPattern = $Matches[1];  break }
            '^-v$'       { break } # handled by gotestsum format in Taskfile
            '^-test\.'   { $binaryFlags += $tokens[$i]; break }
            '^-(.+)'     { $binaryFlags += "-test.$($Matches[1])"; break }
        }
    }
}
if ($runPattern) { $tests = $tests | Where-Object { $_ -match $runPattern } }

.github/workflows/ci.yml:68

• GitHub Actions best practice is to pin third-party actions to a full commit SHA for supply-chain safety. arduino/setup-task@v2 is referenced by tag here; consider pinning it to a specific commit SHA.

      - uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml:103

• GitHub Actions best practice is to pin third-party actions to a full commit SHA for supply-chain safety. arduino/setup-task@v2 is referenced by tag here; consider pinning it to a specific commit SHA.

      - uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml:144

• GitHub Actions best practice is to pin third-party actions to a full commit SHA for supply-chain safety. arduino/setup-task@v2 is referenced by tag here; consider pinning it to a specific commit SHA.

      - uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml:283

• GitHub Actions best practice is to pin third-party actions to a full commit SHA for supply-chain safety. arduino/setup-task@v2 is referenced by tag here; consider pinning it to a specific commit SHA.

      - uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}