test: replace context.Background() with t.Context()/b.Context() in tests

Tests now use the testing.T/B/F context binding introduced in Go 1.24
instead of context.Background(). The bound context is cancelled when the
test finishes, so any goroutines or in-flight operations spawned by a
test get stopped automatically when the test exits or times out — this
avoids goroutine leaks and surfaces lifetime bugs that context.Background()
silently masks.

Mechanical replacement across 31 test files:
- ctx := context.Background()                  -> ctx := t.Context()
- context.WithCancel(context.Background())     -> context.WithCancel(t.Context())
- context.WithTimeout(context.Background(), …) -> context.WithTimeout(t.Context(), …)
- Inside *testing.B benchmarks                 -> b.Context()
- Inside helpers taking testing.TB             -> tb.Context()
- ratelimit doRequest helper now takes *testing.T so it can use t.Context()
- Removed now-unused "context" imports where no other context.* usage remained

Intentionally left as context.Background():
- t.Cleanup(...) callbacks: t.Context() is cancelled BEFORE cleanups run,
  so passing it to Close()/Terminate() would abort the cleanup operation.
- Helpers without a *testing.T/B in scope (e.g. proxy_test.go newTestBackend,
  uffd/userfaultfd/rpc_services_test.go subprocess harness).
- Unreachable defensive fallbacks of the form
  `if parentCtx == nil { parentCtx = context.Background() }`
  in placement_benchmark_test.go after b.Context() (which never returns nil).

Verified with `go vet` and `go test -run=NONE` (compile-only) across all
affected packages, including GOOS=linux for build-tagged orchestrator tests.

Author: tvi

packages/api/internal/handlers/proxy_grpc_test.go

@@ -1,7 +1,6 @@
 package handlers
 
 import (
-	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -61,7 +60,7 @@ func TestIsNonEnvdTrafficRequest(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			result := isNonEnvdTrafficRequest(context.Background(), tt.md, "test-sandbox")
+			result := isNonEnvdTrafficRequest(t.Context(), tt.md, "test-sandbox")
 			assert.Equal(t, tt.expected, result)
 		})
 	}

packages/api/internal/handlers/sandbox_create_test.go

@@ -280,7 +280,7 @@ func TestValidateNetworkConfig(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			mockFF := handlersmocks.NewMockFeatureFlagsClient(t)
-			err := validateNetworkConfig(context.Background(), mockFF, uuid.Nil, "", tt.network)
+			err := validateNetworkConfig(t.Context(), mockFF, uuid.Nil, "", tt.network)
 
 			if tt.wantErr {
 				if err == nil {
@@ -1038,7 +1038,7 @@ func TestValidateNetworkRules(t *testing.T) {
 			t.Parallel()
 
 			ff := tt.setupFF(t)
-			apiErr := validateNetworkRules(context.Background(), ff, teamID, tt.envdVersion, tt.rules)
+			apiErr := validateNetworkRules(t.Context(), ff, teamID, tt.envdVersion, tt.rules)
 
 			if tt.wantMsg == "" {
 				assert.Nil(t, apiErr)

packages/api/internal/middleware/ratelimit/ratelimit_test.go

@@ -1,7 +1,6 @@
 package ratelimit
 
 import (
-	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -55,9 +54,11 @@ func routeConfig(rate, burst int) map[string]map[string]int {
 }
 
 // doRequest performs a POST /sandboxes/test-sbx/connect.
-func doRequest(r *gin.Engine) *httptest.ResponseRecorder {
+func doRequest(t *testing.T, r *gin.Engine) *httptest.ResponseRecorder {
+	t.Helper()
+
 	w := httptest.NewRecorder()
-	req, _ := http.NewRequestWithContext(context.Background(), http.MethodPost, "/sandboxes/test-sbx/connect", nil)
+	req, _ := http.NewRequestWithContext(t.Context(), http.MethodPost, "/sandboxes/test-sbx/connect", nil)
 	r.ServeHTTP(w, req)
 
 	return w
@@ -99,7 +100,7 @@ func TestMiddleware_SkipsUnauthenticated(t *testing.T) {
 		c.JSON(http.StatusOK, gin.H{"status": "ok"})
 	})
 
-	w := doRequest(r)
+	w := doRequest(t, r)
 	assert.Equal(t, http.StatusOK, w.Code)
 }
 
@@ -117,7 +118,7 @@ func TestMiddleware_FailOpen(t *testing.T) {
 	limiter := redis_rate.NewLimiter(badClient)
 	r := newRouterWithTeam(limiter, Config{FailOpen: true}, ff, uuid.New())
 
-	w := doRequest(r)
+	w := doRequest(t, r)
 	assert.Equal(t, http.StatusOK, w.Code)
 }
 
@@ -134,7 +135,7 @@ func TestMiddleware_FailClosed(t *testing.T) {
 	limiter := redis_rate.NewLimiter(badClient)
 	r := newRouterWithTeam(limiter, Config{FailOpen: false}, ff, uuid.New())
 
-	w := doRequest(r)
+	w := doRequest(t, r)
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
 }
 
@@ -149,7 +150,7 @@ func TestMiddleware_UnconfiguredRouteAllowsThrough(t *testing.T) {
 	limiter := redis_rate.NewLimiter(badClient)
 	r := newRouterWithTeam(limiter, Config{FailOpen: true}, ff, uuid.New())
 
-	w := doRequest(r)
+	w := doRequest(t, r)
 	assert.Equal(t, http.StatusOK, w.Code)
 	// No rate limit headers should be set for unconfigured routes.
 	assert.Empty(t, w.Header().Get("RateLimit-Limit"))
@@ -170,7 +171,7 @@ func TestIntegration_AllowedRequestSetsHeaders(t *testing.T) {
 
 	r := newRouterWithTeam(limiter, Config{FailOpen: true}, ff, uuid.New())
 
-	w := doRequest(r)
+	w := doRequest(t, r)
 
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Equal(t, "20", w.Header().Get("RateLimit-Limit"))
@@ -193,12 +194,12 @@ func TestIntegration_BurstThenDeny(t *testing.T) {
 
 	// First 3 requests should succeed (burst).
 	for i := range 3 {
-		w := doRequest(r)
+		w := doRequest(t, r)
 		assert.Equal(t, http.StatusOK, w.Code, "request %d should be allowed", i+1)
 	}
 
 	// 4th should be denied.
-	w := doRequest(r)
+	w := doRequest(t, r)
 	assert.Equal(t, http.StatusTooManyRequests, w.Code)
 	assert.NotEmpty(t, w.Header().Get("Retry-After"))
 
@@ -227,16 +228,16 @@ func TestIntegration_Refill(t *testing.T) {
 
 	// Exhaust burst.
 	for range 2 {
-		w := doRequest(r)
+		w := doRequest(t, r)
 		assert.Equal(t, http.StatusOK, w.Code)
 	}
-	w := doRequest(r)
+	w := doRequest(t, r)
 	assert.Equal(t, http.StatusTooManyRequests, w.Code)
 
 	// Wait for refill (rate=10/s → one token every 100ms).
 	time.Sleep(200 * time.Millisecond)
 
-	w = doRequest(r)
+	w = doRequest(t, r)
 	assert.Equal(t, http.StatusOK, w.Code)
 }
 
@@ -260,13 +261,13 @@ func TestIntegration_IndependentTeams(t *testing.T) {
 	rB := newRouterWithTeam(limiter, cfg, ff, teamB)
 
 	// Team A uses its quota.
-	w := doRequest(rA)
+	w := doRequest(t, rA)
 	assert.Equal(t, http.StatusOK, w.Code)
-	w = doRequest(rA)
+	w = doRequest(t, rA)
 	assert.Equal(t, http.StatusTooManyRequests, w.Code)
 
 	// Team B should still have quota.
-	w = doRequest(rB)
+	w = doRequest(t, rB)
 	assert.Equal(t, http.StatusOK, w.Code)
 }
 
@@ -295,7 +296,7 @@ func TestIntegration_ConcurrentAccess(t *testing.T) {
 		wg.Add(1)
 		go func(idx int) {
 			defer wg.Done()
-			w := doRequest(r)
+			w := doRequest(t, r)
 			results[idx] = w.Code
 		}(i)
 	}

packages/api/internal/oauth/oauth_test.go

@@ -34,7 +34,7 @@ func TestNewVerifierConfig(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			verifier, err := NewVerifier(context.Background(), tt.issuerURL)
+			verifier, err := NewVerifier(t.Context(), tt.issuerURL)
 			require.NoError(t, err)
 			require.NotNil(t, verifier)
 		})
@@ -44,10 +44,10 @@ func TestNewVerifierConfig(t *testing.T) {
 func TestNoopVerifierRejectsClaims(t *testing.T) {
 	t.Parallel()
 
-	verifier, err := NewVerifier(context.Background(), "")
+	verifier, err := NewVerifier(t.Context(), "")
 	require.NoError(t, err)
 
-	claims, err := verifier.VerifyClaims(context.Background(), "token")
+	claims, err := verifier.VerifyClaims(t.Context(), "token")
 	require.Error(t, err)
 	require.Empty(t, claims)
 }
@@ -72,7 +72,7 @@ func TestNewVerifierLoadsOIDCProvider(t *testing.T) {
 	t.Cleanup(server.Close)
 	issuerURL = server.URL
 
-	verifier, err := NewVerifier(context.Background(), server.URL)
+	verifier, err := NewVerifier(t.Context(), server.URL)
 	require.NoError(t, err)
 	require.NotNil(t, verifier)
 }
@@ -179,7 +179,7 @@ func TestRequireClaims(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			claims, err := RequireClaims(context.Background(), tt.md, tt.verifier)
+			claims, err := RequireClaims(t.Context(), tt.md, tt.verifier)
 			if tt.wantErr {
 				require.Error(t, err)
 

packages/api/internal/orchestrator/discovery/kubernetes_test.go

@@ -1,7 +1,6 @@
 package discovery
 
 import (
-	"context"
 	"net"
 	"strconv"
 	"testing"
@@ -59,7 +58,7 @@ func TestKubernetesDiscovery_PodsWithSharedPrefix(t *testing.T) {
 	client := fake.NewSimpleClientset(pod1, pod2)
 	d := NewKubernetes(client, testNamespace, testLabelSelector)
 
-	nodes, err := d.ListNodes(context.Background())
+	nodes, err := d.ListNodes(t.Context())
 	require.NoError(t, err)
 	require.Len(t, nodes, 2)
 
@@ -96,7 +95,7 @@ func TestKubernetesDiscovery_FiltersNotReady(t *testing.T) {
 	client := fake.NewSimpleClientset(ready, notReady)
 	d := NewKubernetes(client, testNamespace, testLabelSelector)
 
-	nodes, err := d.ListNodes(context.Background())
+	nodes, err := d.ListNodes(t.Context())
 	require.NoError(t, err)
 	require.Len(t, nodes, 1)
 	assert.Equal(t, ready.Name, nodes[0].ShortID)
@@ -122,7 +121,7 @@ func TestKubernetesDiscovery_FiltersPending(t *testing.T) {
 	client := fake.NewSimpleClientset(pending)
 	d := NewKubernetes(client, testNamespace, testLabelSelector)
 
-	nodes, err := d.ListNodes(context.Background())
+	nodes, err := d.ListNodes(t.Context())
 	require.NoError(t, err)
 	assert.Empty(t, nodes)
 }
@@ -149,7 +148,7 @@ func TestKubernetesDiscovery_FiltersMissingIP(t *testing.T) {
 	client := fake.NewSimpleClientset(noIP)
 	d := NewKubernetes(client, testNamespace, testLabelSelector)
 
-	nodes, err := d.ListNodes(context.Background())
+	nodes, err := d.ListNodes(t.Context())
 	require.NoError(t, err)
 	assert.Empty(t, nodes)
 }

packages/api/internal/orchestrator/nodemanager/node_test.go

@@ -1,7 +1,6 @@
 package nodemanager_test
 
 import (
-	"context"
 	"testing"
 
 	"github.com/launchdarkly/go-server-sdk/v7/testhelpers/ldtestdata"
@@ -35,7 +34,7 @@ func TestNode_OptimisticAdd_FlagEnabled(t *testing.T) {
 		CPUs:      2,
 		MiBMemory: 1024,
 	}
-	node.OptimisticAdd(context.Background(), res)
+	node.OptimisticAdd(t.Context(), res)
 
 	// 6. Assert: When flag is enabled, resources should be successfully accumulated
 	newMetrics := node.Metrics()
@@ -65,7 +64,7 @@ func TestNode_OptimisticAdd_FlagDisabled(t *testing.T) {
 		CPUs:      2,
 		MiBMemory: 1024,
 	}
-	node.OptimisticAdd(context.Background(), res)
+	node.OptimisticAdd(t.Context(), res)
 
 	// 6. Assert: When flag is disabled, return early, resources should not be accumulated
 	newMetrics := node.Metrics()
@@ -95,7 +94,7 @@ func TestNode_OptimisticRemove_FlagEnabled(t *testing.T) {
 		CPUs:      2,
 		MiBMemory: 1024,
 	}
-	node.OptimisticRemove(context.Background(), res)
+	node.OptimisticRemove(t.Context(), res)
 
 	// 6. Assert: When flag is enabled, resources should be successfully deducted
 	newMetrics := node.Metrics()
@@ -125,7 +124,7 @@ func TestNode_OptimisticRemove_FlagDisabled(t *testing.T) {
 		CPUs:      2,
 		MiBMemory: 1024,
 	}
-	node.OptimisticRemove(context.Background(), res)
+	node.OptimisticRemove(t.Context(), res)
 
 	// 6. Assert: When flag is disabled, return early, resources should remain unchanged
 	newMetrics := node.Metrics()

packages/api/internal/sandbox/storage/memory/operations_benchmark_test.go

@@ -1,7 +1,6 @@
 package memory
 
 import (
-	"context"
 	"fmt"
 	"testing"
 	"time"
@@ -105,7 +104,7 @@ func BenchmarkStorageGetItemsRunningByTeam(b *testing.B) {
 }
 
 func BenchmarkStorageExpiredItems(b *testing.B) {
-	ctx := context.Background()
+	ctx := b.Context()
 	benchmarkSizes(b, func(b *testing.B, f benchFixture) {
 		b.Helper()
 
@@ -116,7 +115,7 @@ func BenchmarkStorageExpiredItems(b *testing.B) {
 }
 
 func BenchmarkStorageTeamsWithSandboxCount(b *testing.B) {
-	ctx := context.Background()
+	ctx := b.Context()
 	benchmarkSizes(b, func(b *testing.B, f benchFixture) {
 		b.Helper()