chore(ci): disable PGO in tests and exclude fixture-heavy files from GitGuardian

Author: s3loy

.gitguardian.yml

@@ -2,7 +2,12 @@ version: 2
 
 secret:
   ignored_paths:
+    - .env.example
+    - docker-compose.yml
+    - scripts/loadmix/
     - cmd/migrate/main_test.go
+    - internal/auth/password_schemes_test.go
+    - internal/auth/auth_test.go
   ignored_matches:
     - name: OAuth client secret used only in API documentation examples
       match: 3K7mDzX434GbFm9YAePJ9FXQNjT6MF0U

.github/workflows/ci.yml

@@ -46,7 +46,11 @@ jobs:
           cache: true
 
       - name: Run tests
-        run: go test -race -shuffle=on -coverprofile=coverage.out -covermode=atomic ./...
+        # -pgo=off: the test build must not pick up cmd/api/default.pgo. PGO +
+        # -race/-cover on the same package is a known source of linker
+        # "fingerprint mismatch" flake; tests don't need profile-guided
+        # optimization (it only shapes the production binary).
+        run: go test -race -shuffle=on -pgo=off -coverprofile=coverage.out -covermode=atomic ./...
 
   build:
     name: build