refactor(di): remove process-global singletons to enable t.Parallel() [IDE-2036]

.gitignore

@@ -103,3 +103,28 @@ brain/
 .verify-agent-progress
 .pr-review-*.md
 .verify-metrics-pending
+.verify-complete
+.verify-precommit-hash
+.verify-agents
+.verify-counts
+.verify-staged-hash
+*_????????_??????_*.log
+.snyk-sca-output.json
+.snyk-sca-output.err
+.snyk-code-output.json
+.snyk-code-output.err
+.verification-result.*
+.security-scan-progress
+.security-scan-scope
+.verify-staged-diff
+.verify-branch-diff
+.verify-pr-context
+.verify-oracle.json
+.verify-oracle.log
+.verify-oracle-scope.txt
+.verify-triage.json
+.verify-source-map.json
+.verify-dedup-findings.json
+.verify-oracle.pid
+.verify-reranked.json
+*_implementation_plan.md

.golangci.yaml

@@ -20,6 +20,7 @@ linters:
     - exhaustive
     - forbidigo
     - forcetypeassert
+    - gochecknoglobals
     - gocyclo
     - goprintffuncname
     - misspell
@@ -135,6 +136,15 @@ linters:
         path: internal/types/config_writers\.go
       - linters: [forbidigo]
         path: _test\.go
+      - linters: [gochecknoglobals]
+        path: _test\.go
+      - linters: [gochecknoglobals]
+        path: fake_.*\.go|mock_.*\.go|.*_mock\.go
+      # govet 'inline' analyzer false-positive on generic stdlib calls (slices.Contains/ContainsFunc);
+      # analyzer reports "not yet supported" with no available fix.
+      # Real inline findings (e.g. reflect.Ptr deprecation) are still enforced.
+      - linters: [govet]
+        text: "inline: cannot inline: type parameter inference is not yet supported"
     paths:
       - docs
       - licenses

Makefile

@@ -28,7 +28,7 @@ LDFLAGS_DEV := "-X 'github.com/snyk/snyk-ls/application/config.Development=true'
 
 TOOLS_BIN := $(shell pwd)/.bin
 
-OVERRIDE_GOCI_LINT_V := v2.10.1
+OVERRIDE_GOCI_LINT_V := v2.12.2
 GOLICENSES_V := v1.6.0
 PACT_V := 2.4.2
 

application/config/config.go

@@ -78,16 +78,16 @@ const (
 )
 
 var (
-	Version                        = "SNAPSHOT"
-	LsProtocolVersion              = "development"
-	Development                    = "true"
-	LicenseInformation             = "License information\n FILLED DURING BUILD"
-	analyticsPermittedEnvironments = map[string]bool{
+	Version                        = "SNAPSHOT"                                  //nolint:gochecknoglobals // package-level constant; cannot use const because it is set at link time
+	LsProtocolVersion              = "development"                               //nolint:gochecknoglobals // package-level constant; cannot use const because it is set at link time
+	Development                    = "true"                                      //nolint:gochecknoglobals // package-level constant; cannot use const because it is set at link time
+	LicenseInformation             = "License information\n FILLED DURING BUILD" //nolint:gochecknoglobals // package-level constant; cannot use const because it is set at link time
+	analyticsPermittedEnvironments = map[string]bool{                            //nolint:gochecknoglobals // effectively a package-level constant — immutable after init
 		"api.snyk.io":    true,
 		"api.us.snyk.io": true,
 	}
-	loggingMu      sync.Mutex
-	currentLogFile *os.File
+	loggingMu      sync.Mutex //nolint:gochecknoglobals // required guard for mutable package state
+	currentLogFile *os.File   //nolint:gochecknoglobals // legacy process-global state
 )
 
 // GetLogLevel returns the current zerolog global level as a string.

application/di/browser_noop_test.go

@@ -0,0 +1,27 @@
+/*
+ * © 2026 Snyk Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Package di — test-only init for DefaultOpenBrowserFunc.
+// This file is compiled only into test binaries (suffix _test.go, package di).
+// It sets DefaultOpenBrowserFunc to a no-op so that tests never open a real
+// browser window, without affecting the production binary.
+package di
+
+import "github.com/snyk/snyk-ls/internal/types"
+
+func init() {
+	types.DefaultOpenBrowserFunc = func(url string) {}
+}

application/di/init_test.go

@@ -17,10 +17,14 @@
 package di_test
 
 import (
+	"sync"
 	"testing"
 
+	"github.com/snyk/go-application-framework/pkg/workflow"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
+	"github.com/snyk/snyk-ls/application/config"
 	"github.com/snyk/snyk-ls/application/di"
 	"github.com/snyk/snyk-ls/internal/testutil"
 )
@@ -48,10 +52,9 @@ func TestDependencies_AllFieldsPopulated(t *testing.T) {
 	assert.NotNil(t, deps.ScanPersister, "ScanPersister must be set")
 	assert.NotNil(t, deps.ScanNotifier, "ScanNotifier must be set")
 	assert.NotNil(t, deps.CodeActionService, "CodeActionService must be set")
-	// Installer and Initializer are process-lifecycle deps not in di.Dependencies;
-	// verify their global accessors are still populated after Init.
-	assert.NotNil(t, di.Installer(), "di.Installer() must be non-nil after Init")
-	assert.NotNil(t, di.Initializer(), "di.Initializer() must be non-nil after Init")
+	assert.NotNil(t, deps.Installer, "Installer must be set")
+	// Initializer is a process-lifecycle dep intentionally absent from di.Dependencies;
+	// it is only set by di.Init() (production path), not di.TestInit().
 }
 
 // TestTestInit_ReturnedDepsAreIndependent verifies that two consecutive TestInit
@@ -75,3 +78,42 @@ func TestTestInit_ReturnedDepsAreIndependent(t *testing.T) {
 	assert.NotSame(t, deps1.ErrorReporter, deps2.ErrorReporter,
 		"each TestInit call must return an independent ErrorReporter, not a shared global")
 }
+
+// TestRealDependencies_ParallelSafe confirms that concurrent calls to
+// RealDependencies() with separate engines do not race on any shared global
+// state. Uses unit-test engines (no network required) because the test is
+// exercising constructor isolation, not end-to-end scanning.
+func TestRealDependencies_ParallelSafe(t *testing.T) {
+	t.Parallel()
+	const N = 3
+	type pair struct {
+		engine       workflow.Engine
+		tokenService *config.TokenServiceImpl
+	}
+	pairs := make([]pair, N)
+	for i := range pairs {
+		e, ts := testutil.UnitTestWithEngine(t)
+		pairs[i] = pair{engine: e, tokenService: ts}
+	}
+
+	var wg sync.WaitGroup
+	results := make([]di.Dependencies, N)
+	for i := 0; i < N; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			results[i] = di.RealDependencies(pairs[i].engine, pairs[i].tokenService)
+		}()
+	}
+	wg.Wait()
+
+	for i, deps := range results {
+		require.NotNil(t, deps.Scanner, "Scanner nil for instance %d", i)
+		require.NotNil(t, deps.Notifier, "Notifier nil for instance %d", i)
+		require.NotNil(t, deps.AuthenticationService, "AuthService nil for instance %d", i)
+		for j := i + 1; j < N; j++ {
+			require.NotSame(t, deps.Notifier, results[j].Notifier,
+				"instances %d and %d share the same Notifier — global state leak", i, j)
+		}
+	}
+}