fix(logs): protect PublicJSON from racing with SetTailingMode

PublicJSON was called on *LogsConfig directly without the LogSource
lock, while SetTailingMode writes Config.TailingMode under the lock.
Add a PublicJSON method to *LogSource that takes the lock before
delegating to Config.PublicJSON, and update the caller in
inventorychecks to use it.

Found via a race-detector-enabled build in staging (see #54333).

Author: pgimalac

comp/metadata/inventorychecks/impl/inventorychecks.go

@@ -222,7 +222,7 @@ func (ic *inventorychecksImpl) getPayload(withConfigs bool) marshaler.JSONMarsha
 					logsMetadata[logSource.Name] = []metadata{}
 				}
 
-				parsedJSON, err := logSource.Config.PublicJSON()
+				parsedJSON, err := logSource.PublicJSON()
 				if err != nil {
 					ic.log.Debugf("could not parse log configuration for source metadata %s: %v", logSource.Name, err)
 					continue

pkg/logs/sources/source.go

@@ -121,6 +121,15 @@ func (s *LogSource) GetTailingMode() string {
 	return s.Config.TailingMode
 }
 
+// PublicJSON returns the public JSON representation of the source's logs config.
+// The lock is held because Config.TailingMode can be mutated at runtime by
+// SetTailingMode on another goroutine.
+func (s *LogSource) PublicJSON() ([]byte, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+	return s.Config.PublicJSON()
+}
+
 // SetTailingMode sets the tailing mode configured for this source. This is mutated after
 // creation when a tailing mode is inferred at launch time, so it must go through the lock.
 func (s *LogSource) SetTailingMode(mode string) {

pkg/logs/sources/source_test.go

@@ -8,6 +8,7 @@ package sources
 import (
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
@@ -104,3 +105,51 @@ func TestConcurrentTailingModeAndStatusAccess(t *testing.T) {
 	close(stop)
 	wg.Wait()
 }
+
+// TestConcurrentPublicJSONAndSetTailingMode verifies that PublicJSON (which reads
+// Config.TailingMode) does not race with SetTailingMode (which writes it).
+// Before the fix, PublicJSON was called on Config directly without the LogSource
+// lock, racing with SetTailingMode on another goroutine.
+func TestConcurrentPublicJSONAndSetTailingMode(t *testing.T) {
+	source := NewLogSource("test", &config.LogsConfig{
+		Type:        "file",
+		Path:        "/var/log/test.log",
+		TailingMode: "end",
+	})
+
+	var wg sync.WaitGroup
+	stop := make(chan struct{})
+
+	// writer: mimics (*Launcher).launchTailers mutating TailingMode concurrently.
+	wg.Go(func() {
+		for i := 0; ; i++ {
+			select {
+			case <-stop:
+				return
+			default:
+			}
+			if i%2 == 0 {
+				source.SetTailingMode("beginning")
+			} else {
+				source.SetTailingMode("end")
+			}
+		}
+	})
+
+	// reader: mimics inventorychecksImpl.getPayload calling PublicJSON concurrently.
+	wg.Go(func() {
+		for {
+			select {
+			case <-stop:
+				return
+			default:
+			}
+			_, _ = source.PublicJSON()
+		}
+	})
+
+	// Let the race detector observe the overlap.
+	time.Sleep(50 * time.Millisecond)
+	close(stop)
+	wg.Wait()
+}