fix: pin maps concurrency fix while retaining SafeMap

[matthyx]

Overview

Fix the first-write data race reported in the failing CI job by pinning the maps concurrency fix from goradd/maps#22.

Keep the existing SafeMap fields and APIs. A temporary go.mod replacement selects github.com/matthyx/maps at commit e9181ad404216d4e1523d9ac2790c3c91e8bdd7c. That fix protects backing-map access and uses an atomic initialization flag to preserve empty-map fast paths. The replacement also applies to transitive uses within operator's build. Remove it and upgrade the upstream dependency once a release includes the fix.

Add concurrent admission add/delete/list/refresh regression coverage. Join SBOM test handlers before restoring retry settings and verify retry entries are removed after success or exhaustion. Production Go source and the Go version are unchanged.

Validation

• Admission concurrency and SBOM late-WLID/retry-exhaustion tests: -race -count=20 passed.
• CGO_ENABLED=1 go test -race ./... passed.
• go vet ./..., go build ./..., formatting and diff checks passed.

Validated with Go 1.25.8. The separate Helm autoscaler tests (-tags=integration) were not run locally.

Follow-up

The pinned fix is currently an unmerged fork commit. Replace the temporary override with an upstream release containing goradd/maps#22 when available.

Sign-off

• Commits include a Signed-off-by trailer.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 7beb8803-476e-4118-bd1d-e926560202ac

📥 Commits

Reviewing files that changed from the base of the PR and between 31d25a1 and defd5c8.

📒 Files selected for processing (8)

• admission/rulebinding/cache/cache.go
• admission/rulebinding/cache/cache_test.go
• go.mod
• watcher/podwatcher.go
• watcher/podwatcher_test.go
• watcher/sbomwatcher.go
• watcher/sbomwatcher_test.go
• watcher/watchhandler.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request replaces SafeMap usage with standard Go maps and sync.Map. The rule-binding cache adds RWMutex protection and concurrent-access tests. Watcher code switches to Load and Store, with updated tests and dependency classification.

Changes

Synchronized map migration

Layer / File(s)	Summary
Rule-binding cache synchronization admission/rulebinding/cache/cache.go, admission/rulebinding/cache/cache_test.go	RBCache uses plain maps protected by sync.RWMutex. Snapshot iteration and synchronized updates cover refresh, listing, addition, and deletion. Tests cover concurrent cache operations and updated map access.
Watcher sync.Map migration watcher/watchhandler.go, watcher/podwatcher.go, watcher/sbomwatcher.go, watcher/*_test.go, go.mod	Watcher fields use sync.Map. Pod and SBOM handlers use Load and Store. Tests update map assertions and goroutine cleanup. github.com/goradd/maps is classified as an indirect dependency.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to defd5

The synchronized map migration has no confirmed merge-blocking issue.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 27.27% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 7 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	⚠️ Warning	The title is misleading because it says the change retains SafeMap, while the pull request replaces operator-owned SafeMap fields with sync.Map and mutex-protected Go maps.	Rename the title to describe the concurrency fix and the replacement of SafeMap, for example: "fix: replace SafeMap with synchronized caches".

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

Full details: Docstring Coverage

Explanation

Docstring coverage is 27.27% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 7 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/safemap-race-stdlib

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Summary:

• License scan: success
• Credentials scan: failure
• Vulnerabilities scan: failure
• Unit test: success
• Go linting: success

[github-actions]

Summary:

• License scan: success
• Credentials scan: failure
• Vulnerabilities scan: failure
• Unit test: success
• Go linting: success