ci: fix sync-upstream.sh, again again

Author: miparnisari

.github/workflows/sync-upstream.sh

@@ -119,9 +119,19 @@ verify() {
   done
   if [[ "${NO_TEST:-0}" == "1" ]]; then
     echo "  go test skipped (NO_TEST=1)"
-  else
-    go test ./... >/dev/null || die "go test failed in the root module"
+    return 0
+  fi
+
+  # Quiet while passing, but print everything on failure. Swallowing this
+  # output leaves a red CI run with no way to tell what broke.
+  local out
+  out="$(mktemp)"
+  if go test ./... >"$out" 2>&1; then
     echo "  go test OK    ."
+  else
+    warn "go test failed in the root module:"
+    grep -vE '^(ok|\?)' "$out" || true
+    die "go test failed in the root module"
   fi
 }
 

.github/workflows/sync-upstream.yaml

@@ -38,6 +38,13 @@ jobs:
           # future upstream bump past `stable` fetches what go.mod asks for
           # rather than failing.
           GOTOOLCHAIN: auto
+          # Build here, but leave testing to ci.yaml, which runs on the PR this
+          # job opens and does it better (`-race -count=1`). Testing in both
+          # places means a single flaky test aborts the job before the PR
+          # exists, so nobody can see what failed or decide what to do about
+          # it. A red check on an open PR is the better outcome: the human who
+          # has to approve it sees the failure and judges it.
+          NO_TEST: "1"
         run: .github/workflows/sync-upstream.sh
 
       - name: Record upstream revision
@@ -62,7 +69,9 @@ jobs:
             1. Reverted the `authzed` import rename
             2. Merged `upstream/master`
             3. Re-applied the rename
-            4. Verified `go build` in every Go module and `go test ./...` in the root
+            4. Verified `go build` in every Go module
+
+            Tests are not run by the sync job; CI runs them on this PR.
 
             The result is upstream plus the import-path rename and nothing else.