test(evaluation): stop mutating version.Version from parallel tests

withVersion wrote the global version.Version from a t.Parallel() test
while sibling parallel tests read it through DefaultAgentImage(), which
the race detector flagged. Extract the pure defaultAgentImageFor helper
and table-test it with explicit versions instead.

pkg/evaluation/agent_image.go

@@ -29,7 +29,14 @@ const NoAgentImage = "none"
 // Falls back to the rolling :edge image when the host binary isn't a release
 // build (version.Version isn't a valid semantic version, e.g. "dev" or "pr").
 func DefaultAgentImage() string {
-	v, err := semver.NewVersion(version.Version)
+	return defaultAgentImageFor(version.Version)
+}
+
+// defaultAgentImageFor is the pure core of DefaultAgentImage, taking the host
+// CLI version explicitly so tests can cover it without mutating the global
+// version.Version (which races with parallel tests reading it).
+func defaultAgentImageFor(hostVersion string) string {
+	v, err := semver.NewVersion(hostVersion)
 	if err != nil {
 		return edgeAgentImage
 	}

pkg/evaluation/agent_image_test.go

@@ -4,22 +4,11 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-
-	"github.com/docker/docker-agent/pkg/version"
 )
 
-// withVersion temporarily overrides version.Version for the duration of the
-// test, restoring it afterwards. version.Version is a package-level var (set
-// via -ldflags at release build time), so tests mutate it directly rather
-// than plumbing it through as a parameter.
-func withVersion(t *testing.T, v string) {
-	t.Helper()
-	original := version.Version
-	version.Version = v
-	t.Cleanup(func() { version.Version = original })
-}
-
 func TestDefaultAgentImage(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		version string
@@ -35,21 +24,21 @@ func TestDefaultAgentImage(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			withVersion(t, tt.version)
-			assert.Equal(t, tt.want, DefaultAgentImage())
+			t.Parallel()
+			assert.Equal(t, tt.want, defaultAgentImageFor(tt.version))
 		})
 	}
 }
 
 func TestResolvedAgentImage(t *testing.T) {
-	withVersion(t, "v1.133.0")
+	t.Parallel()
 
 	tests := []struct {
 		name       string
 		agentImage string
 		want       string
 	}{
-		{name: "default", agentImage: "", want: "docker/docker-agent:1.133.0"},
+		{name: "default", agentImage: "", want: DefaultAgentImage()},
 		{name: "skip injection", agentImage: NoAgentImage, want: ""},
 		{name: "explicit override", agentImage: "docker/docker-agent:1.100.0", want: "docker/docker-agent:1.100.0"},
 		{name: "explicit override, different registry", agentImage: "myregistry.example.com/docker-agent:custom", want: "myregistry.example.com/docker-agent:custom"},
@@ -57,6 +46,7 @@ func TestResolvedAgentImage(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
 			cfg := Config{AgentImage: tt.agentImage}
 			assert.Equal(t, tt.want, ResolvedAgentImage(cfg))
 		})

pkg/evaluation/save_test.go

@@ -341,8 +341,6 @@ func TestSaveRunSessionsJSONContainerRuntime(t *testing.T) {
 func TestSaveRunSessionsJSONAgentImage(t *testing.T) {
 	t.Parallel()
 
-	withVersion(t, "v1.133.0")
-
 	save := func(t *testing.T, cfg Config) []byte {
 		t.Helper()
 		run := &EvalRun{
@@ -366,7 +364,7 @@ func TestSaveRunSessionsJSONAgentImage(t *testing.T) {
 
 		var output RunOutput
 		require.NoError(t, json.Unmarshal(data, &output))
-		assert.Equal(t, "docker/docker-agent:1.133.0", output.Config.AgentImage)
+		assert.Equal(t, DefaultAgentImage(), output.Config.AgentImage)
 	})
 
 	t.Run("records an explicit override", func(t *testing.T) {