fix(test): flaky and unrunnable test suites

[alexluong]

Test-only changes. Four suites failed on state they did not create, or could not start at all.

1. S3 — parallel subtests shared a map

Subtests in TestAWSS3Destination_Validate all run t.Parallel() and share one Config map. The storage-class subtest wrote INVALID into it, which could fail the valid-destination case. Each subtest now gets its own map.

2. Kinesis — the consumer assumed deliver-once

A stream is an at-least-once log. GetRecords can return a record it already returned — seen against localstack with no error reported and the iterator advanced normally. Every test in a provider suite reads one channel, so a single redelivered record shifted every later read by one and each test then verified another test's event: a missing message_id panicked the concurrent tests, a stale event mismatched event-id in the sequential one.

• The consumer drops anything at or before the last sequence number it delivered.
• Each test gets its own stream and consumer instead of sharing one per suite.

3. Readiness — Ensure* returned endpoints unchecked

Neither docker compose up -d returning nor a wait strategy seeing an open port proves a service will complete a handshake, and both surface inside a test rather than at startup — seen as a RabbitMQ connection reset in SetupSuite, and as a Kafka SASL EOF.

Every Ensure* now waits up to 30s before the first test, speaking the protocol rather than dialing the port: authenticate to Kafka, connect to Postgres, query ClickHouse, AMQP dial for RabbitMQ, health endpoint for LocalStack.

4. Running without TESTINFRA=1 was broken

Without TESTINFRA=1 the tests start their own containers. That path had rotted — six of nine infrastructure-dependent packages failed before a single assertion. All four causes sit in code the TESTINFRA=1 path never executes, so nothing surfaced them:

• Floating image tags. localstack:latest had become a licensed build that exits during startup; postgres:latest and clickhouse:latest had drifted past what the code assumes. Tags are now pinned in .env.test, which compose reads via --env-file and the tests read via viper, so both ways of providing infrastructure run the same versions. The compose stack was pinned only loosely (:3, 16-alpine) with one floating tag; those are exact now too.
• Kafka's host port used a mapping syntax testcontainers has rejected since v0.42, so the package had been unrunnable across two dependency bumps. It now binds through HostConfigModifier on an OS-assigned port rather than a hardcoded 19092 that two test binaries would contend for.
• Kafka's broker config needs a JAAS file, and needs its controller listener on the address the image's quorum voters name. Without the latter it starts, fails to register with the quorum, and shuts down — after the port-listening wait strategy has already called it ready.
• Shared containers were torn down mid-run. They were terminated when the first suite in a binary finished, by which point the sync.Once guarding each had already fired, so every later suite in that binary connected to an endpoint with nothing behind it. They now live for the process; the testcontainers reaper removes them at exit.

Note for reviewers: make up/test and make down/test now pass --env-file .env.test. Running docker-compose -f build/test/compose.yml up -d directly fails with a message pointing at the Makefile, rather than silently substituting an empty image name.

Verification

Kinesis suite, cold start (docker compose restart test-aws immediately before each run):

	Failures
before	10 / 20
after	0 / 20

Per-package, both paths:

	before	after
no TESTINFRA	3 / 9	15 / 15
TESTINFRA=1	—	16 / 16 (incl. cmd/e2e)

S3 fix verified with -count=20 and -race. go vet ./... and the -short suite CI runs are clean.

Not addressed: mqinfra's should_create_dlq_queue waits for 6 SQS redeliveries inside a fixed 10s budget and fails under load on both paths (1 failure, then 3/3 clean). Pre-existing, and a property of the test's design rather than of the infrastructure.

🤖 Generated with Claude Code