test: speed up two tests (#37905)

Two test-only changes that cut the `-race` backend unit job's critical
path, with no behavior change.

- **`modules/auth/password/hash`** — `TestHashing`/`TestVectors`
exercised the CPU-bound KDFs (scrypt `N=65536`, pbkdf2, bcrypt, argon2)
serially on one core. Marking the subtests `t.Parallel()` fans them
across cores. The hasher registry they read is only mutated by the
non-parallel `Test_registerHasher`, so this is race-free.
- **`services/release`** — `TestRelease_Update`/`TestRelease_createTag`
slept `6x time.Sleep(2s)` only to cross the 1-second `CreatedUnix`
boundary. Replaced with an advancing mocked clock (`timeutil.MockSet`),
making the timestamp assertions deterministic and removing the real
waits.

---
This PR was written with the help of Claude Opus 4.8

Co-authored-by: Claude (Opus 4.8) <noreply@anthropic.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

modules/auth/password/hash/hash_test.go

@@ -74,6 +74,7 @@ func TestHashing(t *testing.T) {
 	runTests := func(password, salt string, shouldPass bool) {
 		for _, algorithmName := range hashAlgorithmsToTest {
 			t.Run(algorithmName, func(t *testing.T) {
+				t.Parallel() // CPU-bound; these subtests only read the shared hasher registry
 				output, err := Parse(algorithmName).Hash(password, salt)
 				if shouldPass {
 					assert.NoError(t, err)
@@ -182,6 +183,7 @@ func TestVectors(t *testing.T) {
 	for i, vector := range vectors {
 		for _, algorithm := range vector.algorithms {
 			t.Run(strconv.Itoa(i)+": "+algorithm, func(t *testing.T) {
+				t.Parallel() // CPU-bound; these subtests only read the shared hasher registry
 				pa := Parse(algorithm)
 				assert.Equal(t, !vector.shouldfail, pa.VerifyPassword(vector.password, vector.output, vector.salt))
 			})

services/release/release_test.go

@@ -12,6 +12,7 @@ import (
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/timeutil"
 	"gitea.dev/services/attachment"
 
 	_ "gitea.dev/models/actions"
@@ -138,6 +139,12 @@ func TestRelease_Update(t *testing.T) {
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
+	// Advance a mocked clock between create and update instead of sleeping, so the
+	// timestamp-sensitive assertions below stay deterministic.
+	fakeNow := time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+	defer timeutil.MockSet(fakeNow)()
+	advance := func() { fakeNow = fakeNow.Add(time.Second); timeutil.MockSet(fakeNow) }
+
 	// Test a changed release
 	assert.NoError(t, CreateRelease(gitRepo, &repo_model.Release{
 		RepoID:       repo.ID,
@@ -155,7 +162,7 @@ func TestRelease_Update(t *testing.T) {
 	release, err := repo_model.GetRelease(t.Context(), repo.ID, "v1.1.1")
 	assert.NoError(t, err)
 	releaseCreatedUnix := release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Note = "Changed note"
 	assert.NoError(t, UpdateRelease(t.Context(), user, gitRepo, release, nil, nil, nil))
 	release, err = repo_model.GetReleaseByID(t.Context(), release.ID)
@@ -179,7 +186,7 @@ func TestRelease_Update(t *testing.T) {
 	release, err = repo_model.GetRelease(t.Context(), repo.ID, "v1.2.1")
 	assert.NoError(t, err)
 	releaseCreatedUnix = release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Title = "Changed title"
 	assert.NoError(t, UpdateRelease(t.Context(), user, gitRepo, release, nil, nil, nil))
 	release, err = repo_model.GetReleaseByID(t.Context(), release.ID)
@@ -203,7 +210,7 @@ func TestRelease_Update(t *testing.T) {
 	release, err = repo_model.GetRelease(t.Context(), repo.ID, "v1.3.1")
 	assert.NoError(t, err)
 	releaseCreatedUnix = release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Title = "Changed title"
 	release.Note = "Changed note"
 	assert.NoError(t, UpdateRelease(t.Context(), user, gitRepo, release, nil, nil, nil))
@@ -280,6 +287,12 @@ func TestRelease_createTag(t *testing.T) {
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
+	// Advance a mocked clock between create and update instead of sleeping, so the
+	// timestamp-sensitive assertions below stay deterministic.
+	fakeNow := time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+	defer timeutil.MockSet(fakeNow)()
+	advance := func() { fakeNow = fakeNow.Add(time.Second); timeutil.MockSet(fakeNow) }
+
 	// Test a changed release
 	release := &repo_model.Release{
 		RepoID:       repo.ID,
@@ -298,7 +311,7 @@ func TestRelease_createTag(t *testing.T) {
 	assert.NoError(t, err)
 	assert.NotEmpty(t, release.CreatedUnix)
 	releaseCreatedUnix := release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Note = "Changed note"
 	_, err = createTag(t.Context(), gitRepo, release, "")
 	assert.NoError(t, err)
@@ -321,7 +334,7 @@ func TestRelease_createTag(t *testing.T) {
 	_, err = createTag(t.Context(), gitRepo, release, "")
 	assert.NoError(t, err)
 	releaseCreatedUnix = release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Title = "Changed title"
 	_, err = createTag(t.Context(), gitRepo, release, "")
 	assert.NoError(t, err)
@@ -344,7 +357,7 @@ func TestRelease_createTag(t *testing.T) {
 	_, err = createTag(t.Context(), gitRepo, release, "")
 	assert.NoError(t, err)
 	releaseCreatedUnix = release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Title = "Changed title"
 	release.Note = "Changed note"
 	_, err = createTag(t.Context(), gitRepo, release, "")