From 6dfb8b0bf536020b867566a877e509318777c40d Mon Sep 17 00:00:00 2001
From: omartelo <meopedevts@proton.me>
Date: Sat, 17 Oct 2026 14:41:58 -0300
Subject: [PATCH 1/2] ci: report the slowest Go packages and tests, and turn
 off Defender scanning on the Windows suite

---
 .github/scripts/go-test-summary.sh | 23 +++++++++++++++++++++++
 .github/workflows/ci.yml           |  7 +++++++
 2 files changed, 30 insertions(+)

diff --git a/.github/scripts/go-test-summary.sh b/.github/scripts/go-test-summary.sh
index f9e298b7..31634399 100755
--- a/.github/scripts/go-test-summary.sh
+++ b/.github/scripts/go-test-summary.sh
@@ -9,8 +9,10 @@ label="${1:+ — $1}"
 json="$(mktemp)"
 cover="$(mktemp)"
 
+started=$SECONDS
 go test -json -coverprofile="$cover" ./... >"$json"
 code=$?
+wall=$((SECONDS - started))
 
 read -r pass fail skip < <(jq -rs '
   map(select(.Test != null and (.Action == "pass" or .Action == "fail" or .Action == "skip")))
@@ -42,6 +44,7 @@ grep -v '^github.com/omartelo/lich/[^/]*\.go:' "$cover" >"$cover.gated"
 total="$(go tool cover -func="$cover.gated" | awk '/^total:/ {print $3}')"
 
 min=80
+slowest=15
 if ! awk -v t="${total%\%}" -v m="$min" 'BEGIN { exit !(t != "" && t + 0 >= m) }'; then
   echo "::error::backend coverage ${total:-n/a} is below the ${min}% bar (CLAUDE.md invariant 1)"
   [ "$code" = "0" ] && code=1
@@ -62,6 +65,26 @@ summary="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
     echo ""
     echo "</details>"
   fi
+  # Elapsed is run time only: the gap between the wall time and the slowest
+  # package is compiling and linking the test binaries, which is where one OS
+  # can lose minutes to another without any test getting slower.
+  echo "<details><summary>Timings: ${wall}s wall</summary>"
+  echo ""
+  echo "| Package | Seconds |"
+  echo "|:--|--:|"
+  jq -rs --argjson n "$slowest" '
+    map(select(.Test == null and .Elapsed != null and (.Action == "pass" or .Action == "fail")))
+    | sort_by(-.Elapsed) | .[:$n][] | "| `\(.Package)` | \(.Elapsed) |"
+  ' "$json"
+  echo ""
+  echo "| Test | Seconds |"
+  echo "|:--|--:|"
+  jq -rs --argjson n "$slowest" '
+    map(select(.Test != null and (.Test | contains("/") | not) and .Elapsed != null and (.Action == "pass" or .Action == "fail")))
+    | sort_by(-.Elapsed) | .[:$n][] | "| `\(.Package | sub(".*/"; "")).\(.Test)` | \(.Elapsed) |"
+  ' "$json"
+  echo ""
+  echo "</details>"
 } >>"$summary"
 
 exit "$code"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 41dcd3f1..bb1af602 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -164,6 +164,13 @@ jobs:
         # git-bash on Windows keeps these steps byte-identical to the linux job's.
         shell: bash
     steps:
+      # Real-time scanning inspects every test binary go test links and runs;
+      # nothing on a throwaway runner needs it.
+      - name: Disable Defender real-time scanning
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: Set-MpPreference -DisableRealtimeMonitoring $true
+
       - uses: actions/checkout@v7
 
       - name: Set up Go

From 466334331071a7fea11bb1ba9fefb4c5d08908b6 Mon Sep 17 00:00:00 2001
From: omartelo <meopedevts@proton.me>
Date: Sat, 17 Oct 2026 14:53:05 -0300
Subject: [PATCH 2/2] ci: drop the Defender step, it bought nothing measurable

---
 .github/workflows/ci.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bb1af602..41dcd3f1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -164,13 +164,6 @@ jobs:
         # git-bash on Windows keeps these steps byte-identical to the linux job's.
         shell: bash
     steps:
-      # Real-time scanning inspects every test binary go test links and runs;
-      # nothing on a throwaway runner needs it.
-      - name: Disable Defender real-time scanning
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: Set-MpPreference -DisableRealtimeMonitoring $true
-
       - uses: actions/checkout@v7
 
       - name: Set up Go