[sergo] Sergo Report: Registry-Detector-Migrated + Untouched-Linter-Audit - 2026-08-03

[github-actions[bot]]

Executive Summary

R61 followed a 26-day gap since the last recorded run (R60, 2026-07-08). In that window the custom-linter registry grew from 43 to 62 analyzers, and — per gh api reconciliation — 19 of those new linters were already fully audited and closed by other actors before this run started. Zero sergo issues were open pre-run. This run's job was to find what's genuinely still uncovered, and it found two: walkfuncerrshadow (61st) and uncheckedflushreturn (62nd), neither of which had ever appeared in a sergo issue. Both yielded strong, distinct, evidence-backed findings — 2 issues filed, 0 duplicates.

Tool & Registry Updates

• Serena MCP: 23 tools, stable (no change from R60).
• Linter registry detector changed: cmd/linters/main.go no longer enumerates analyzers directly — it now calls linters.All(). The canonical source of truth moved to pkg/linters/registry.go's allAnalyzers slice (62 entries, confirmed against pkg/linters/doc.go's "All 62 active analyzers" header).
• doc-sync bug class is now structurally fixed: pkg/linters/spec_test.go auto cross-checks the registry against documentedAnalyzers(), doc.go, and README.md. This was a recurring finding category in R42-R59 (7+ issues); it no longer needs manual probing.
• Registry delta: 43 → 62 (+19) since R60.

Strategy: 50/50 Split

Cached component (proven pattern, new target): applied the historically successful "enforce-readiness" pattern — grep production code for the exact pattern a linter targets, check CI enforcement status — to walkfuncerrshadow, the newest linter with an accompanying ADR.

New exploration component: examined uncheckedflushreturn's AST node-filter logic from scratch for structural coverage gaps, rather than reusing a known bug template.

Both targets were selected because they are the only two of the 62 registered linters that have never been mentioned in any sergo issue (verified via gh api ...issues?labels=sergo across all pages, all 19 recently-added linters otherwise already covered).

Findings

1. walkfuncerrshadow — 10 unmigrated production violation sites (issue #49901)

The linter (added via ADR-49633, still Draft, merged 2026-08-01) flags filepath.Walk/WalkDir calls where the outer result variable and the callback's third parameter are both literally named err. The ADR explicitly calls out that existing code needing this rename is a "one-time migration cost" — that migration never happened:

10 production sites with exact err/err shadow

pkg/cli/logs_download.go:192   err := filepath.Walk(sourceDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/logs_download.go:505   err := filepath.Walk(outputDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/compile_watch.go:82    err = filepath.Walk(workflowsDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/trial_support.go:58    err = filepath.Walk(tempDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/remove_command.go:222  err = filepath.Walk(workflowsDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/remove_command.go:342  err := filepath.Walk(workflowsDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/remove_command.go:370  err := filepath.Walk(workflowsDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/logs_metrics.go:188    err = filepath.Walk(logDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/logs_metrics.go:681    err := filepath.Walk(runDir, func(path string, info os.FileInfo, err error) error {
pkg/cli/dependency_graph.go:66 err := filepath.Walk(g.workflowsDir, func(path string, info os.FileInfo, err error) error {

Notably, most other filepath.Walk call sites in the same package already use walkErr for the outer variable (e.g. logs_utils.go, copilot_agent.go:113), confirming this is an inconsistency, not an accepted idiom. The linter is also absent from cgo.yml's LINTER_FLAGS — it can't be enforced in CI until these sites are cleaned up.

2. uncheckedflushreturn — DeferStmt missing from node filter entirely (issue #49902)

The analyzer's nodeFilter is []ast.Node{(*ast.ExprStmt)(nil), (*ast.AssignStmt)(nil)} — it catches bare w.Flush() and _ = w.Flush(), but ast.DeferStmt is a distinct AST node type and is never registered. defer w.Flush() — arguably the single most common way Go code silently drops a flush error, and the case this linter's own doc string most naturally implies it should catch — passes through completely undetected. testdata/src/uncheckedflushreturn/ has zero test cases exercising defer, confirming this is an untested gap rather than a documented scope decision. No current production hits in pkg/, so this is a latent coverage gap rather than an active false negative today.

Tasks Generated (2)

#	Linter	Type	Effort
1	walkfuncerrshadow	Production migration debt + CI enforcement gap	Small (6 files, 10 sites + 1 CI line)
2	uncheckedflushreturn	Node-filter coverage gap	Small (1 filter entry + 1 case fn + testdata)

Metrics

• Findings this run: 6 (evidence points across both linters)
• Issues created: 2 / 3 max (no third issue forced — no other finding met the same evidence bar)
• Duplicates skipped: 0
• Success score: 9/10
• Cumulative: 61 runs, 414 total findings, 111 total tasks, 8.75 avg success score

Historical Context

Recent run history

• R60 (2026-07-08): Registry stable-forced delta 42→43 (writebytestring). Found a SuggestedFix compile-correctness bug (named-string type mismatch with io.WriteString). 1 issue, score 9.
• R59 (2026-07-07): Registry stable at 42. Swept all linters for syntactic (name-only) stdlib package matching — found 5 holdouts not yet migrated to astutil.IsPkgSelector. 1 issue, score 9.
• R58 (2026-07-06): Registry stable at 42. Audited the ctx-family of linters for FuncLit scope-boundary bugs — found execcommandwithoutcontext over-attributing outer context across closure boundaries. 1 issue, score 9.
• R61 gap: Between R60 and this run, 19 new linters (44th–60th, e.g. bytescomparestring, sprintfbool, trimleftright, mapclearloop, mapdeletecheck, stringsconcatloop, stringbytesroundtrip) were added, audited, and fully closed out — all with issues already resolved by the time of this run's reconciliation.

Recommendations

1. Land #49901 and #49902 — both are small, mechanical fixes with clear validation checklists.
2. Once walkfuncerrshadow sites are cleaned up, wire it into cgo.yml LINTER_FLAGS so it stays enforced (it's currently one of the only recently-added linters without CI enforcement).
3. Consider a lightweight registry-wide sweep of "discard/unchecked-return" linters (Flush/Close/Sync-shaped APIs) for the same DeferStmt-omission pattern found in uncheckedflushreturn — this may not be isolated.

Next-Run Focus (R62)

• Verify sg61a1 and sg61a2 landed (gh api reconcile before selecting a strategy, per standard practice).
• Watch for the 63rd linter via pkg/linters/registry.go entry count (the old main.go grep detector is obsolete).
• Since linters 43–62 are now exhaustively covered by other actors, focus new-exploration effort on whichever linter is newest/least-audited, rather than re-sweeping the already-clean range.

References:

• §30785551074

Generated by 🤖 Sergo - Serena Go Expert · agent · 167.6 AIC · ⌖ 33.2 AIC · ⊞ 6K · ◷

• expires on Aug 3, 2026, 9:05 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #50179.