[sergo] Sergo Report: New-Linter Audit + Pattern-Too-Narrow Heuristic Critique - 2026-07-19

[github-actions[bot]]

Executive Summary

Run 61 (11-day gap since R60). The linter registry took a big jump: 43 → 53 analyzers (+10). The team filed and closed sergo issues for nearly all of them at high velocity, leaving zero open sergo issues at run start. Two of the ten new linters had never been touched by any issue — appendoneelement and trimleftright — so this run audited both.

• appendoneelement → audited clean (no issue): its append(s, []T{x}...) → append(s, x) autofix is type-safe, with correct guards for keyed literals and type-elided nested literals, and it adds no import (so it dodges the import-robustness class that bit its siblings).
• trimleftright → 1 issue (#46526): the trigger heuristic requires a repeated rune, an axis uncorrelated with the actual bug, causing it to miss the most common TrimPrefix/TrimSuffix confusions.
• doc-sync drift → 1 issue (#46527): doc.go says 52 analyzers but 53 are registered.

2 issues created, both distinct and non-duplicate.

Tool / Registry Updates

Signal	R60	R61
Serena LSP tools	23	23 (stable)
Registered analyzers (grep -c Analyzer main.go)	43	53 (+10)
Open sergo issues (pre-run)	0	0
CI-enforced linters	~14	24

R60's sg60a1 landed and closed as #44187 (writebytestring). The 10 new linters since R60: appendoneelement, bytesbufferstring, bytescomparestring, ioutildeprecated, logfatallibrary, mapclearloop, mapdeletecheck, nilctxpassed, stringscountcontains, trimleftright. All except appendoneelement/trimleftright already had team-filed+closed issues.

Strategy: 50/50 Split

Cached reuse (50%) — pattern-too-narrow vein (previously productive: #40244 errstringmatch, #40434 sprintferrdot, #40581 lenstringzero). Re-applied to critique a new linter's trigger heuristic on the correct axis.

New exploration (50%) — systematic audit of the two never-audited new linters (appendoneelement, trimleftright), including SuggestedFix compile-correctness (my carried-over R61 probe target) and doc/registry reconciliation.

Findings

Finding 1 — trimleftright: repeated-rune heuristic misses distinct-char prefixes (issue #46526)

pkg/linters/trimleftright/trimleftright.go:125-146 — looksSuspiciousCutset fires only when the alphanumeric cutset contains a repeated rune. So TrimLeft(s, "foo") (o repeats) is flagged, but TrimLeft(s, "http"), "bar", "abc", "0x", "prefix" — all distinct-char — are not, even though they are the highest-frequency real instances of the exact bug the linter targets.

The package's own testdata encodes this as intended: goodNoRepeatedAlnum (testdata/.../trimleftright.go:46-49) treats TrimLeft(s, "abc") as good.

The stated rationale (avoid FPs on whitespace character classes) is already satisfied by the all-alphanumeric guard — so the repeated-rune requirement adds nothing to FP-avoidance and only removes true positives. "Has a repeated rune" does not separate word-prefixes from character classes (aeiou, abcdef, 0123456789 are all distinct too). Latent — not CI-enforced.

Recommendation: invert to flag all multi-rune alphanumeric cutsets except recognized class idioms (contiguous ranges, hex, digit/vowel sets), or document the narrow scope explicitly.

Finding 2 — doc-sync: doc.go says 52, registry has 53 (issue #46527)

pkg/linters/doc.go:3 header + 52 bullets vs 53 registered in cmd/linters/main.go:76-128. Omitted linter: trimleftright. Same recurring drift class as #46131 / #45185 / #40436. Recommend adding the bullet, bumping the header, and adding a go test guard asserting len(bullets) == len(registered).

Audited clean — appendoneelement (no issue filed)

pkg/linters/appendoneelement/appendoneelement.go autofix append(s, []T{x}...) → append(s, x) is type-safe: append's element args receive element-type context identical to the composite literal. Guards are correct: KeyValueExpr skipped (keyed []int{5:x} = length-6 slice), type-elided nested composite literals skipped (would produce invalid Go), universe-append check prevents shadowing FPs, and named-slice-type literals (Bytes{x}) are a safe false-negative (not *ast.ArrayType). No new import referenced, so it avoids the import-robustness class (#45037) that affected its siblings.

Generated Tasks

1. Fix trimleftright heuristic axis — replace repeated-rune trigger with a class-aware discriminator; add testdata for http/abc/txt (expect diagnostic) and aeiou/0123456789/abcdef (expect none). Effort: small–medium.
2. Sync doc.go — add trimleftright bullet, bump count to 53, add a count-parity test guard. Effort: trivial.

Metrics

Metric	Value
Findings	6
Issues created	2 (#46526, #46527)
Clean audits	1 (appendoneelement)
Duplicates skipped	0 (zero open sergo)
Self-scored success	9/10

Historical Context

Run 61 of the Sergo series (410+ cumulative findings, ~110 tasks, avg success 8.7). The team's fast close cadence continues — the discipline of reconciling via gh api ...issues?labels=sergo before selecting a strategy again paid off (avoided re-filing 10 already-handled new linters). The pattern-too-narrow vein remains reliably productive against freshly-added heuristic linters.

Recommendations & Next-Run Focus (R62)

• Watch for the 54th analyzer (grep -c Analyzer cmd/linters/main.go vs 53).
• Re-verify sg61a1/sg61a2 landed.
• Probe SuggestedFix fix-bodies of any newer autofix linters for compile-correctness (exact-type-param vs underlying-match).
• Check nolint + test-skip + enforce parity on the newest linters now that the enforce list is 24.

References: §29673838676

Generated by 🤖 Sergo - Serena Go Expert · 326.4 AIC · ⌖ 11.1 AIC · ⊞ 5.8K · ◷

• expires on Jul 19, 2026, 9:04 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #46709.