bug: nil pointer dereference in GitHub release converter causes pipeline crashes

[zvika-finally]

Bug Description

The GitHub plugin's release converter crashes with a nil pointer dereference panic when processing certain releases, causing 100% failure rate for all pipelines processing repositories with releases.

Error Details

Error message:

runtime error: invalid memory address or nil pointer dereference
at github.com/apache/incubator-devlake/plugins/github/tasks.ConvertRelease.func1:79

Failure point: Step 30/30 - "Convert Releases" subtask

Root Cause

Commit 794f8ef added a SQL filter to exclude draft releases (published_at IS NOT NULL) but failed to add a defensive nil check before dereferencing the PublishedAt pointer in the converter function at line 79:

PublishedAt:  *githubRelease.PublishedAt,  // Panic if nil!

Impact

• Severity: Critical
• Affected plugin: github_graphql
• Affected operations: All pipelines processing GitHub repositories with releases
• Failure rate: 100% for affected repositories
• Number of observed failures: 10 pipeline tasks (9243, 9259, 9263, 9267, 9271, 9274, 9295, 9310, 9313, 9322)

Environment

• Version: main branch (after commit 794f8ef)
• OS: macOS (Darwin 24.4.0)
• Date observed: October 31, 2025

Reproduction

1. Configure a GitHub connection with repositories that have releases
2. Run a pipeline to collect data from those repositories
3. Observe the pipeline crash at "Convert Releases" step with nil pointer panic

Expected Behavior

The converter should safely handle releases with nil PublishedAt fields, either by:

• Skipping them gracefully (draft releases)
• Logging a warning about data inconsistency

Proposed Solution

Add a nil check before dereferencing the pointer:

if githubRelease.PublishedAt == nil {
    return nil, nil
}

Related

• Related commit: 794f8ef (fix: drafting releases should not be converted to domain layer)
• Pull request with fix: fix: add nil check for PublishedAt in release converter to prevent panic #8628

Additional Context

The SQL filter published_at IS NOT NULL was added to exclude draft releases, but in practice, some releases still have nil PublishedAt fields due to:

• Data inconsistency in the database
• GORM scanning issues
• Invalid timestamps that couldn't be parsed

[dosubot]

This is a confirmed critical bug: the GitHub plugin's release converter crashes with a nil pointer dereference when processing releases where PublishedAt is nil, typically for draft releases. The root cause is the absence of a nil check before dereferencing PublishedAt in the converter function, despite a SQL filter intended to exclude such cases. This leads to 100% pipeline failure for affected repositories.

The recommended and widely accepted fix is to add a nil check before dereferencing the pointer, skipping releases where PublishedAt is nil (i.e., draft releases) to prevent the panic and ensure pipeline stability. This approach is consistent with defensive programming best practices in Go and is supported by related issues and discussions in the project, which highlight similar patterns and fixes for nullable fields in other plugins as well (source, source, source).

There is no project documentation specifically covering best practices for handling nullable fields or defensive programming in Go, but the consensus in the codebase and issue tracker is to always check for nil before dereferencing pointers, especially when dealing with data from external APIs or databases that may be inconsistent.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[klesh]

Fixed by #8625

[zvika-finally]

Hi @klesh - I don't believe this is solving the issue. I am running this code as part of the latest beta version and my transformations are failing due to this issue.

Can you please reevaluate?

[klesh]

@zvika-finally It is included in this version: https://github.com/apache/incubator-devlake/releases/tag/v1.0.3-beta8

[zvika-finally]

I confirmed that this is the case.