fix(ci): make NewRandPort thread-safe (#10921)

* chore: disable AutoTLS in TCP-only transport tests

Tests were failing intermittently. Disabling AutoTLS when WebSocket
transport is disabled appears to resolve the issue.

* fix: make NewRandPort thread-safe

Track allocated ports globally to prevent conflicts
when tests run in parallel.

test/cli/harness/peering.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"math/rand"
 	"net"
+	"sync"
 	"testing"
 
 	"github.com/ipfs/kubo/config"
@@ -14,16 +15,39 @@ type Peering struct {
 	To   int
 }
 
+var (
+	allocatedPorts = make(map[int]struct{})
+	portMutex      sync.Mutex
+)
+
 func NewRandPort() int {
-	if a, err := net.ResolveTCPAddr("tcp", "localhost:0"); err == nil {
-		var l *net.TCPListener
-		if l, err = net.ListenTCP("tcp", a); err == nil {
-			defer l.Close()
-			return l.Addr().(*net.TCPAddr).Port
+	portMutex.Lock()
+	defer portMutex.Unlock()
+
+	for i := 0; i < 100; i++ {
+		l, err := net.Listen("tcp", "localhost:0")
+		if err != nil {
+			continue
+		}
+		port := l.Addr().(*net.TCPAddr).Port
+		l.Close()
+
+		if _, used := allocatedPorts[port]; !used {
+			allocatedPorts[port] = struct{}{}
+			return port
 		}
 	}
-	n := rand.Int()
-	return 3000 + (n % 1000)
+
+	// Fallback to random port if we can't get a unique one from the OS
+	for i := 0; i < 1000; i++ {
+		port := 30000 + rand.Intn(10000)
+		if _, used := allocatedPorts[port]; !used {
+			allocatedPorts[port] = struct{}{}
+			return port
+		}
+	}
+
+	panic("failed to allocate unique port after 1100 attempts")
 }
 
 func CreatePeerNodes(t *testing.T, n int, peerings []Peering) (*Harness, Nodes) {

test/cli/transports_test.go

@@ -62,6 +62,8 @@ func TestTransports(t *testing.T) {
 				cfg.Swarm.Transports.Network.WebTransport = config.False
 				cfg.Swarm.Transports.Network.WebRTCDirect = config.False
 				cfg.Swarm.Transports.Network.Websocket = config.False
+				// Disable AutoTLS since we're disabling WebSocket transport
+				cfg.AutoTLS.Enabled = config.False
 			})
 		})
 		disableRouting(nodes)