[repository-quality] 🎯 Repository Quality Improvement Report - Custom Go Linter CI Enablement Gap (Second Follow-up) #62374

Analysis Date: 2026-09-21
Focus Area: Custom Go Linter CI Enablement Gap — Round 3
Strategy Type: Reused (highest-impact recurring finding)
Custom Area: Yes — third consecutive audit of pkg/linters/registry.go vs .github/workflows/cgo.yml's hand-typed LINTER_FLAGS allowlist, this time covering a different subset of the 72 registered analyzers than the 2026-09-07 and 2026-09-11 runs.

Executive Summary

This is the third audit of the same structural defect first identified on 2026-09-07: pkg/linters/registry.go registers 72 custom go/analysis linters via All(), but .github/workflows/cgo.yml only ever runs a fixed, hand-typed 57-flag -x -y -z allowlist inside make golint-custom. Any linter added to the registry is silently dark in CI unless someone remembers to also update the two multi-hundred-character LINTER_FLAGS strings in cgo.yml (lines 1487 and 1490). Prior runs closed the gap for manualpathconcat, packagelevelmutableslicemap, and seenmapbool — but this run built the linter binary fresh and confirmed 13 linters remain completely unwired, 7 of which produce real, actionable findings today: largefunc (493), manualpathconcat (47 — regressed back into the gap list), typeassertionokdiscarded (175), bufioscannererunchecked (9), packagelevelmutableslicemap (8 — also regressed), blankassigncomma (14), and bufferresetbeforereuse (2). Six others (errorfwrapv, excessivefuncparams, hardcodedfilepath, stringsconcatloop, sprintferrdot, lenstringzero) report zero findings today, meaning they are safe to enable immediately with no remediation burden.

Notably, manualpathconcat and packagelevelmutableslicemap were reported fixed/enabled in the 2026-09-11 follow-up but are not present in the current cgo.yml flag list, and both now have live findings again (47 and 8 respectively) — evidence that CI wiring for this registry silently regresses whenever registry.go or cgo.yml is touched without a keeping-in-sync check. This points to the same root cause repeatedly diagnosed: there is no automated test asserting that every linter in linters.All() appears in cgo.yml's flags, so drift is inevitable and undetected until the next manual audit.

The recommended fix is no longer "add missing flags" (a treadmill that keeps resetting) but a structural guard: a Go test that fails CI whenever registry.go's linter set and cgo.yml's LINTER_FLAGS diverge, closing the gap permanently instead of episodically.

pkg/workflow/cache_memory.go:419:20: buildUpdateCacheMemoryJob is 183 lines long (limit: 60); consider breaking it up
pkg/workflow/action_reference.go:71:16: manual "/" path concatenation; use filepath.Join(actionsOrgRepo, "setup") (or path.Join) instead
pkg/workflow/model_aliases.go:96:3: package-level slice/map variable builtinOnlyAliasMap is mutated via wholesale re-assignment; mutating shared package state risks data races and can leak state across calls
pkg/typeutil/lookup.go:14:11: type assertion ok value is explicitly discarded with blank identifier; use single-value form x.(bool) or check the ok value instead
pkg/console/spinner.go:208:4: assignment with 2 blank identifiers discards every result; consider removing the assignment or checking the results instead
pkg/parser/frontmatter_content.go:260:2: Scanner loop does not check Err() after completion; read errors may be silently dropped
pkg/cli/mcp_tools_readonly.go:550:4: current is reused without calling Reset() between writes, which can accumulate previous data
pkg/cli/experiments_analyze_statistics.go:445:2: map[string]bool "declared" used as a set; use map[string]struct{} to avoid allocating a bool per entry

🤖 Tasks for Copilot Agent

NOTE TO PLANNER AGENT: Split the following tasks into individual work items.

Improvement Tasks

Task 1: Add a registry/CI-flags parity guard test

Priority: High
Estimated Effort: Medium
Focus Area: CI/CD tooling reliability

Description: Write a Go test (e.g. pkg/linters/registry_ci_sync_test.go) that parses .github/workflows/cgo.yml's LINTER_FLAGS string(s) and asserts every analyzer name returned by linters.All() (excluding an explicit, documented allowlist for intentionally non-blocking linters like errormessage and ssljson) appears as a -<name> flag. Fail the test with a clear diff of missing/extra names. This closes the recurring gap permanently instead of requiring a manual audit every few days.

Acceptance Criteria:

• Test reads .github/workflows/cgo.yml and extracts both LINTER_FLAGS strings
• Test fails listing any registered linter absent from either flag string, except an explicit exempt list
• Test passes after Task 2/3 close the current gap
• make test-unit includes the new test in default runs

Code Region: pkg/linters/registry.go, .github/workflows/cgo.yml (lines 1487, 1490)

Add a Go test in pkg/linters/ that keeps .github/workflows/cgo.yml's LINTER_FLAGS in sync with pkg/linters/registry.go's All() analyzer list, failing CI on future drift. See the analysis in this discussion for full context and the current list of 13 gapped linters (largefunc, typeassertionokdiscarded, manualpathconcat, blankassigncomma, bufioscannererunchecked, packagelevelmutableslicemap, bufferresetbeforereuse, seenmapbool, errorfwrapv, excessivefuncparams, hardcodedfilepath, stringsconcatloop, sprintferrdot, lenstringzero). Exempt errormessage and ssljson (intentionally non-blocking, run via `make audit-error-messages`). Read the flag lists directly from cgo.yml at test time so the check stays accurate as the workflow evolves.

Task 2: Enable the six zero-finding linters immediately

Priority: High
Estimated Effort: Small

Description: Add -errorfwrapv -excessivefuncparams -hardcodedfilepath -stringsconcatloop -sprintferrdot -lenstringzero to both LINTER_FLAGS strings in .github/workflows/cgo.yml (lines 1487 and 1490). These linters report zero findings against current code, so enabling them carries zero remediation cost and immediately prevents regression.

Acceptance Criteria:

• Both LINTER_FLAGS strings updated with the six new flags
• make golint-custom LINTER_FLAGS="..." run locally confirms zero new findings
• CI cgo.yml run passes cleanly

Code Region: .github/workflows/cgo.yml:1487,1490

In .github/workflows/cgo.yml, add these six flags to both LINTER_FLAGS strings (line ~1487 native build and line ~1490 WASM cross-build): -errorfwrapv -excessivefuncparams -hardcodedfilepath -stringsconcatloop -sprintferrdot -lenstringzero. Verify locally with `env -u GOOS -u GOARCH go build -o /tmp/gh-aw-linters ./cmd/linters && /tmp/gh-aw-linters -errorfwrapv -excessivefuncparams -hardcodedfilepath -stringsconcatloop -sprintferrdot -lenstringzero -test=false ./cmd/... ./pkg/...` before committing — it must produce no output. Do not add flags that report findings without also fixing them (see Task 3).

Task 3: Fix and re-enable manualpathconcat and packagelevelmutableslicemap (regression)

Priority: Medium
Estimated Effort: Medium

Description: These two linters were reported as fixed and enabled in the 2026-09-11 follow-up but are absent from the current cgo.yml flags and have live findings again (47 and 8 respectively). Fix the 55 combined findings (convert manual "/" concatenation to filepath.Join/path.Join; convert wholesale package-level slice/map re-assignment to safer patterns, e.g. sync.Once-guarded read-only access or mutex-protected accessors) and add both flags back to cgo.yml.

Acceptance Criteria:

• All 47 manualpathconcat findings resolved with filepath.Join/path.Join
• All 8 packagelevelmutableslicemap findings resolved or justified with (nolint/redacted):packagelevelmutableslicemap + reason
• -manualpathconcat -packagelevelmutableslicemap added to both cgo.yml LINTER_FLAGS strings
• Task 1's parity test passes for these two linters

Code Region: pkg/workflow/action_reference.go, pkg/workflow/model_aliases.go, pkg/workflow/runtime_definitions.go, pkg/cli/model_costs.go, pkg/cli/update_version_labels.go, .github/workflows/cgo.yml

Fix the 47 manualpathconcat findings (manual "/" string concatenation instead of filepath.Join/path.Join) and the 8 packagelevelmutableslicemap findings (package-level slice/map variables mutated via wholesale re-assignment, e.g. builtinOnlyAliasMap in pkg/workflow/model_aliases.go:96, modelPriceRecords in pkg/cli/model_costs.go:50/73, versionLabelCache in pkg/cli/update_version_labels.go:73/86) across pkg/workflow and pkg/cli. Build the linter with `env -u GOOS -u GOARCH go build -o /tmp/gh-aw-linters ./cmd/linters` then run `/tmp/gh-aw-linters -manualpathconcat -packagelevelmutableslicemap -test=false ./cmd/... ./pkg/...` to enumerate exact locations. After fixing, add both flags to .github/workflows/cgo.yml's two LINTER_FLAGS strings (lines ~1487, ~1490) so this gap cannot silently regress a third time.

Task 4: Remediate largefunc and typeassertionokdiscarded, the two largest gapped linters

Priority: Medium
Estimated Effort: Large

Description: largefunc (493 findings) and typeassertionokdiscarded (175 findings) are the highest-volume unenforced linters. Rather than a single massive PR, break remediation into per-package batches (prioritize pkg/workflow and pkg/cli, the largest offenders) and land -largefunc.max-lines=60 -typeassertionokdiscarded in cgo.yml once each batch is clear, using (nolint/redacted) with justification for functions that are legitimately hard to split (e.g. generated code, large switch dispatchers).

Acceptance Criteria:

• pkg/workflow and pkg/cli largefunc findings reduced by at least 50% or justified with (nolint/redacted):largefunc
• pkg/typeutil, pkg/parser typeassertionokdiscarded findings fixed (convert _ := x.(T) to checked form)
• Both flags added to cgo.yml LINTER_FLAGS once each package batch is clean
• Task 1's parity test passes for these two linters

Code Region: pkg/workflow/cache_memory.go, pkg/typeutil/lookup.go, pkg/parser/import_observability.go, .github/workflows/cgo.yml

Reduce the 493 largefunc findings (functions over 60 lines, e.g. buildUpdateCacheMemoryJob at pkg/workflow/cache_memory.go:419 is 183 lines) and 175 typeassertionokdiscarded findings (x, _ := y.(T) discarding the ok result, e.g. pkg/typeutil/lookup.go:14) by extracting helper functions and converting discarded type assertions to checked form. Build via `env -u GOOS -u GOARCH go build -o /tmp/gh-aw-linters ./cmd/linters`, enumerate findings with `/tmp/gh-aw-linters -largefunc -typeassertionokdiscarded -test=false ./cmd/... ./pkg/...`, prioritize pkg/workflow and pkg/cli first. Add -largefunc.max-lines=60 -typeassertionokdiscarded to .github/workflows/cgo.yml's LINTER_FLAGS once clean, and use (nolint/redacted):largefunc with a justification comment for functions that are legitimately hard to split.

📊 Historical Context

🎯 Recommendations

Immediate Actions (This Week)

1. Add the 6 zero-finding linter flags to cgo.yml (Task 2) — Priority: High
2. Write the registry/CI parity guard test (Task 1) — Priority: High

Short-term Actions (This Month)

1. Fix and re-enable manualpathconcat and packagelevelmutableslicemap (Task 3) — Priority: Medium
2. Begin batched remediation of largefunc and typeassertionokdiscarded (Task 4) — Priority: Medium

Long-term Actions (This Quarter)

1. Consider auto-generating cgo.yml's LINTER_FLAGS from registry.go at compile/CI time instead of hand-maintaining two multi-hundred-character strings — Priority: Low

📈 Success Metrics

• Registered-but-unwired linters: 13 → 0
• Total live findings across gapped linters: 748 → 0 (or explicitly (nolint/redacted)-justified)
• Regression incidents on previously "fixed" linters: 2 (this round) → 0, enforced by the new parity test

Next Steps

1. Review and prioritise the tasks above
2. Assign tasks to Copilot coding agent via planner agent
3. Track progress on improvement items
4. Re-evaluate this focus area only if the new parity test (Task 1) is not merged — otherwise this gap should no longer recur

Generated by Repository Quality Improvement Agent
Next analysis: 2026-09-22 — Focus area selected by diversity algorithm

Generated by ⚡ Repository Quality Improvement Agent · copilot · auto · 94.3 AIC · ⌖ 9.49 AIC · ⊞ 9.8K · ◷

• expires on Sep 22, 2026, 5:05 AM UTC-08:00