[repository-quality] 🎯 Quality Report 2026-06-30: Unauthenticated API Fallback — Context, Timeout & Linter Blindspot

[github-actions[bot]]

🎯 Repository Quality Improvement Report - Unauthenticated API Fallback Call Chain

Analysis Date: 2026-06-30
Focus Area: Unauthenticated API Fallback Call Chain: Missing Context, Timeout & Linter Blindspot
Strategy Type: Custom
Custom Area: Yes — High-risk latency-sensitive area unique to this repo's compilation model

Executive Summary

Three unauthenticated GitHub API fallback functions bypass the established context/timeout patterns. resolveRefToSHAViaPublicAPI and fetchPublicGitHubContentsAPI (both in pkg/parser/remote_fetch.go) accept no context.Context, construct requests via http.NewRequest, and dispatch via http.DefaultClient — which has no timeout. A slow api.github.com silently hangs the calling goroutine indefinitely during compilation.

fetchPublicGitHubAPI (pkg/cli/update_workflows.go) correctly uses NewRequestWithContext but still uses http.DefaultClient; if the caller passes context.Background() with no deadline the socket can still block.

All three gaps are invisible to httpnoctx because it only intercepts .Get/.Head/.Post/.PostForm — not http.NewRequest + client.Do patterns.

Full Analysis Report

Current State Assessment

Metric	Value	Status
Functions using http.DefaultClient (no timeout)	3	❌
Functions missing context.Context parameter	2	❌
http.NewRequest (not NewRequestWithContext) calls	2	❌
httpnoctx coverage of NewRequest + .Do()	0%	⚠️
Other HTTP clients with proper Timeout	7	✅
constants.DefaultHTTPClientTimeout (30s) defined	Yes	✅

Findings

Strengths: 7 HTTP clients already use constants.DefaultHTTPClientTimeout; httpnoctx linter active; established fix pattern in logs_download.go and mcp_logs_guardrail.go.

Critical Issues:

• resolveRefToSHAViaPublicAPI (remote_fetch.go:562) — no ctx, http.NewRequest, http.DefaultClient; third-tier fallback during compilation; can hang indefinitely
• fetchPublicGitHubContentsAPI (remote_fetch.go:1314) — same triple failure; called by downloadFileViaPublicAPI (line 984), listDirAllFilesViaPublicAPI (line 1177), and a third caller (line 1436), all context-free
• fetchPublicGitHubAPI (update_workflows.go:367) — context attached but http.DefaultClient residual risk
• httpnoctx linter does not flag http.NewRequest in context-aware functions

---

🤖 Tasks for Copilot Agent

NOTE TO PLANNER AGENT: Split the following tasks into individual work items.

Improvement Tasks

Task 1: Add Context and Timeout to resolveRefToSHAViaPublicAPI

Priority: High
Estimated Effort: Small
Focus Area: Unauthenticated API Fallback Hardening

Description: Add ctx context.Context as first parameter to resolveRefToSHAViaPublicAPI in pkg/parser/remote_fetch.go. Replace http.NewRequest with http.NewRequestWithContext(ctx, ...) and http.DefaultClient with &http.Client{Timeout: constants.DefaultHTTPClientTimeout}. Update the caller at line ~530 to pass context.

Acceptance Criteria:

• Function accepts ctx context.Context as first parameter
• Request created with http.NewRequestWithContext(ctx, http.MethodGet, apiURL, nil)
• http.DefaultClient replaced with &http.Client{Timeout: constants.DefaultHTTPClientTimeout}
• Caller at line ~530 updated to pass context
• make lint and make test pass

Code Region: pkg/parser/remote_fetch.go (function resolveRefToSHAViaPublicAPI ~line 562)

In pkg/parser/remote_fetch.go, add ctx context.Context as first parameter to
resolveRefToSHAViaPublicAPI (~line 562). Change http.NewRequest to
http.NewRequestWithContext(ctx, ...) and http.DefaultClient to
&http.Client{Timeout: constants.DefaultHTTPClientTimeout}.
Update the caller at ~line 530 to pass context. Run `make lint` and `make test`.

---

Task 2: Add Context and Timeout to fetchPublicGitHubContentsAPI Call Chain

Priority: High
Estimated Effort: Medium
Focus Area: Unauthenticated API Fallback Hardening

Description: fetchPublicGitHubContentsAPI and its three callers (downloadFileViaPublicAPI, listDirAllFilesViaPublicAPI, and a third caller near line 1436) all lack context. Add ctx context.Context as first parameter throughout, use http.NewRequestWithContext, and replace http.DefaultClient with a timeout-bearing client. A package-level var fallbackAPIClient = &http.Client{Timeout: constants.DefaultHTTPClientTimeout} avoids repeated allocations.

Acceptance Criteria:

• All four functions accept ctx context.Context as first parameter
• http.NewRequestWithContext(ctx, ...) used in fetchPublicGitHubContentsAPI
• http.DefaultClient replaced with fallbackAPIClient (or equivalent)
• All upstream callers thread context through
• make lint and make test pass

Code Region: pkg/parser/remote_fetch.go (lines ~984–1450, four functions)

In pkg/parser/remote_fetch.go, add ctx context.Context as first parameter to
fetchPublicGitHubContentsAPI (~line 1314), downloadFileViaPublicAPI (~line 984),
listDirAllFilesViaPublicAPI (~line 1177), and the third caller near line 1436.
In fetchPublicGitHubContentsAPI replace http.NewRequest with
http.NewRequestWithContext(ctx, ...) and http.DefaultClient with a package-level
var fallbackAPIClient = &http.Client{Timeout: constants.DefaultHTTPClientTimeout}.
Thread ctx through all callers. Run `make lint` and `make test`.

---

Task 3: Replace http.DefaultClient in fetchPublicGitHubAPI

Priority: Medium
Estimated Effort: Small
Focus Area: HTTP Client Timeout Hygiene

Description: fetchPublicGitHubAPI (pkg/cli/update_workflows.go:367) uses http.NewRequestWithContext correctly but dispatches via http.DefaultClient (no timeout). Replace with &http.Client{Timeout: constants.DefaultHTTPClientTimeout} or a file-level variable.

Acceptance Criteria:

• http.DefaultClient replaced with a timeout-bearing client
• Context threading unchanged (already correct)
• make lint and make test pass

Code Region: pkg/cli/update_workflows.go (function fetchPublicGitHubAPI ~line 367)

In pkg/cli/update_workflows.go, replace http.DefaultClient.Do(req) with
(&http.Client{Timeout: constants.DefaultHTTPClientTimeout}).Do(req) or add a
package-level var updateWorkflowsHTTPClient = &http.Client{Timeout: ...}.
Run `make lint` and `make test`.

---

Task 4: Extend httpnoctx to Flag http.NewRequest in Context-Aware Functions

Priority: Medium
Estimated Effort: Medium
Focus Area: Linter Coverage Gap

Description: httpnoctx misses http.NewRequest + client.Do when context is present in the enclosing function. Add a rule that flags http.NewRequest(...) calls inside functions that already have a context.Context parameter, recommending http.NewRequestWithContext. Add testdata and update pkg/linters/doc.go.

Acceptance Criteria:

• httpnoctx reports http.NewRequest calls inside context-aware functions
• Testdata in pkg/linters/httpnoctx/testdata/ covers true-positive and false-positive cases
• Functions without context param are NOT flagged
• pkg/linters/doc.go updated; make lint and make test pass

Code Region: pkg/linters/httpnoctx/ and pkg/linters/doc.go

In pkg/linters/httpnoctx/httpnoctx.go, add detection for http.NewRequest calls
(the non-context variant) inside functions that already have a context.Context
parameter. Walk up from the call's ast.CallExpr to the enclosing *ast.FuncDecl
and check for a context.Context-typed parameter. If found, report:
  "use http.NewRequestWithContext(ctx, ...) instead of http.NewRequest;
   context.Context already available as parameter <name>"
Add testdata covering: context-param + NewRequest (flag), no-context-param +
NewRequest (no flag), NewRequestWithContext (no flag).
Update pkg/linters/doc.go. Run `make lint` and `make test`.

---

📊 Historical Context

Previous Focus Areas (last 5)

Date	Focus Area	Type	Custom
2026-06-22	Context Propagation & Process Cancellability (reuse)	Standard	N
2026-06-23	AIC Attribution Completeness	Custom	Y
2026-06-24	Import Pipeline Reliability	Custom	Y
2026-06-26	Performance	Standard	N
2026-06-29	tolowerequalfold Linter False Positive Elimination	Custom	Y

---

🎯 Recommendations

Immediate Actions (This Week)

1. Fix resolveRefToSHAViaPublicAPI (Task 1) — Priority: High
2. Fix fetchPublicGitHubContentsAPI call chain (Task 2) — Priority: High

Short-term Actions (This Month)

1. Replace http.DefaultClient in fetchPublicGitHubAPI (Task 3) — Priority: Medium
2. Extend httpnoctx linter (Task 4) — Priority: Medium

Long-term Actions (This Quarter)

1. Audit all http.DefaultClient usage when adding new unauthenticated fallback paths

---

📈 Success Metrics

• http.DefaultClient uses in production code: 3 → 0
• Context-free unauthenticated API functions: 2 → 0
• httpnoctx coverage (convenience + NewRequest in ctx fns): 50% → 100%

---

Next Steps

1. Review and prioritise the tasks above
2. Assign Tasks 1–4 to Copilot coding agent via planner agent
3. Re-evaluate HTTP client hygiene in one month

---

References:

• §28447771831

Generated by ⚡ Repository Quality Improvement Agent · 139.4 AIC · ⌖ 8.35 AIC · ⊞ 6.7K · ◷

• expires on Jul 1, 2026, 5:39 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-01T13:39:44.218Z.

Closed by Workflow