upgrade ds9, add tests, move internal to pkg

[tstromberg]

No description provided.

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

While the dependency analysis shows positive changes with no security vulnerabilities and reduced attack surface, the code analysis identifies 6 critical nil pointer dereference issues in GitHub API calls that could cause runtime panics and service disruption. These medium-impact issues in core GitHub integration functionality pose immediate operational risk that outweighs the dependency improvements. The fixes are straightforward - adding nil checks before accessing resp.StatusCode - and should be implemented before merging to prevent potential service crashes.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Code Mitigations

Add nil check before accessing resp variable to prevent potential panic

• Location: pkg/github/github.go:291

• Potential Code Fix:

pr, resp, err = c.client.PullRequests.Get(ctx, owner, repo, number)
if err != nil {
    if resp != nil && resp.StatusCode == http.StatusNotFound {
        return retry.Unrecoverable(err)
    }
    slog.Warn("failed to get PR, retrying", "owner", owner, "repo", repo, "number", number, "error", err)
    return err
}

Add nil check before accessing resp variable to prevent potential panic

• Location: pkg/github/github.go:605

• Potential Code Fix:

allPRs, resp, err = c.client.PullRequests.ListPullRequestsWithCommit(ctx, owner, repo, sha, &github.PullRequestListOptions{State: "all"})
if err != nil {
    if resp != nil && resp.StatusCode == http.StatusNotFound {
        return retry.Unrecoverable(err)
    }
    return err
}

Add nil check before accessing resp variable to prevent potential panic

• Location: pkg/github/github.go:802

• Potential Code Fix:

installations, resp, err = appClient.Apps.ListInstallations(ctx, &github.ListOptions{PerPage: 100})
if err != nil {
    if resp != nil && resp.StatusCode == http.StatusUnauthorized {
        slog.Error("GitHub App authentication failed", "app_id", m.appID, "hint", "Check that your GitHub App ID and private key are correct")
        return retry.Unrecoverable(err)
    }
    slog.Warn("failed to list installations, retrying", "error", err)
    return err
}

Add nil check before accessing resp variable to prevent potential panic

• Location: pkg/github/github/github.go:291

• Potential Code Fix:

pr, resp, err = c.client.PullRequests.Get(ctx, owner, repo, number)
if err != nil {
    if resp != nil && resp.StatusCode == http.StatusNotFound {
        return retry.Unrecoverable(err)
    }
    slog.Warn("failed to get PR, retrying", "owner", owner, "repo", repo, "number", number, "error", err)
    return err
}

Add nil check before accessing resp variable to prevent potential panic

• Location: pkg/github/github/github.go:605

• Potential Code Fix:

allPRs, resp, err = c.client.PullRequests.ListPullRequestsWithCommit(ctx, owner, repo, sha, &github.PullRequestListOptions{State: "all"})
if err != nil {
    if resp != nil && resp.StatusCode == http.StatusNotFound {
        return retry.Unrecoverable(err)
    }
    return err
}

Add nil check before accessing resp variable to prevent potential panic

• Location: pkg/github/github/github.go:802

• Potential Code Fix:

installations, resp, err = appClient.Apps.ListInstallations(ctx, &github.ListOptions{PerPage: 100})
if err != nil {
    if resp != nil && resp.StatusCode == http.StatusUnauthorized {
        slog.Error("GitHub App authentication failed", "app_id", m.appID, "hint", "Check that your GitHub App ID and private key are correct")
        return retry.Unrecoverable(err)
    }
    slog.Warn("failed to list installations, retrying", "error", err)
    return err
}

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 677f723, performed at: 2025-10-29T17:35:34Z

Found this helpful? Give it a 👍 or 👎 reaction!