[typist] Typist: Go Type Consistency Analysis - duplicated types and untyped usages in pkg/

[github-actions[bot]]

🔤 Typist - Go Type Consistency Analysis

Analysis of repository: github/gh-aw

Executive Summary

I scanned all 1,179 non-test .go files under pkg/ (roughly 1,089 top-level type declarations) for two things: types that are effectively defined more than once, and places where interface{}/any or untyped constants are hiding a concrete type that already exists in practice. The good news first: this codebase already has the right instincts — it defines named sum types like RunsOnValue, TemplatableBool, TemplatableBoolOrInt, ActionMode, and LockSchemaVersion for exactly this class of problem. The findings below are mostly places where that same pattern just hasn't been applied yet, plus a handful of genuine duplicate structs worth consolidating.

The most interesting finding: there's a recurring "legacy vs AWF" config duplication pattern — BoundedQueriesConfig/AWFBoundedQueriesConfig and SRTNetworkConfig/AWFNetworkConfig model the same sandbox concepts twice, with hand-written field-by-field copy functions bridging them. That's the highest-value consolidation target. On the untyped side, FrontmatterConfig.RunsOn, SafeJobConfig.RunsOn, Imports/Include, and ReportFailureAsIssue are all documented (in comments!) as accepting 2-3 known shapes but are typed any — each is a straightforward port of the existing RunsOnValue/TemplatableBool pattern. Fixing these removes several manual type assertions and closes off a class of "silent typo" bugs (e.g. CompilerError.Type accepting arbitrary strings like "error"/"warning"/"info" with no shared constants anywhere).

Full Analysis Report

Duplicated Type Definitions

Summary Statistics

• Total types analyzed: ~1,089
• Duplicate clusters found: 6
• Exact duplicates: 1
• Near duplicates: 2
• Semantic duplicates: 3

Cluster 1: RepositoryFeatures (exact duplicate)

Impact: Medium — same struct declared twice purely to satisfy build tags

Locations:

1. pkg/workflow/repository_features_validation.go:73 (//go:build !js && !wasm)
2. pkg/workflow/repository_features_validation_wasm.go:31 (//go:build js || wasm)

Identical field-for-field struct (HasDiscussions bool, HasIssues bool) declared twice so the WASM stub can compile against the same field names.

Recommendation: Move the struct to a shared, non-build-tagged file (e.g. repository_features_types.go) and keep only the validateRepositoryFeatures behavior split behind build tags. Effort: <1 hour.

---

Cluster 2: BoundedQueriesConfig vs AWFBoundedQueriesConfig (semantic duplicate)

Impact: High — part of a systemic "legacy vs AWF" split

Locations:

• pkg/workflow/tools_types.go:410 (BoundedQueryPrivateRepo{Repo, Sensitivity})
• pkg/workflow/tools_types.go:450 (BoundedQueriesConfig)
• pkg/workflow/awf_config.go:192 (AWFBoundedQueryPrivateRepo{Repo, Sensitivity})
• pkg/workflow/awf_config.go:224 (AWFBoundedQueriesConfig)

AWFBoundedQueryPrivateRepo is a verbatim copy of BoundedQueryPrivateRepo; AWFBoundedQueriesConfig mirrors BoundedQueriesConfig's Runtime/MemoryLimit/Interpreter/PrivateRepos fields exactly. extractBoundedQueriesConfig manually copies every field one-by-one with no transformation.

Recommendation: Since the AWF struct carries no extra fields, marshal AWFBoundedQueriesConfig directly from BoundedQueriesConfig (or embed it) instead of maintaining a hand-written 1:1 copy function. Effort: 2-3 hours.

---

Cluster 3: SRTNetworkConfig vs AWFNetworkConfig (semantic duplicate)

Impact: High — same "legacy vs AWF" pattern as Cluster 2, suggesting it's systemic

Locations:

• pkg/workflow/sandbox.go:147 (SRTNetworkConfig)
• pkg/workflow/awf_config.go:247 (AWFNetworkConfig)

Both model firewall/network egress policy for a workflow sandbox: AllowedDomains/BlockedDomains (SRT) vs AllowDomains/BlockDomains (AWF) are the same concept with only naming differences. SRT adds unix-socket options; AWF adds isolation/topology-attach options.

Recommendation: Consolidate SRT and AWF network/filesystem config schemas into one canonical internal representation with format-specific marshalers, rather than two independently-evolving schemas for the same sandboxing concern. Effort: 4-6 hours (larger, cross-cutting).

---

Cluster 4: AuditComparisonIntDelta vs AuditComparisonStringDelta (near duplicate)

Impact: Medium — textbook case for Go generics

Locations: pkg/cli/audit_comparison.go:45, pkg/cli/audit_comparison.go:51

Identical shape except value type: {Before T, After T, Changed bool} for T=int and T=string, defined back-to-back in the same file.

Recommendation: Replace both with type Delta[T any] struct { Before, After T; Changed bool } — generics are already used elsewhere in this module. Effort: <1 hour.

---

Cluster 5: Delta-value representation inconsistency (near duplicate, same package)

Impact: Medium — same concept modeled two different ways in one package

Locations: pkg/cli/audit_comparison.go:45,51, pkg/cli/audit_diff.go:276,346,366

audit_comparison.go models "value that changed between two points" as {Before, After, Changed}, but audit_diff.go's TokenUsageDiff, RunMetricsDiff, and GitHubRateLimitDiff model the exact same concept as inline field triples repeated 4-10+ times per struct (e.g. Run1InputTokens/Run2InputTokens/InputTokensChange), never reusing a shared delta type.

Recommendation: Introduce one shared Delta[T] type in pkg/cli (see Cluster 4) and use it consistently in both files. Effort: 2-3 hours.

---

Cluster 6: FirewallLogEntry / AccessLogEntry / AuditLogEntry (semantic duplicate)

Impact: Medium

Locations: pkg/cli/firewall_log.go:118, pkg/cli/access_log.go:21, pkg/cli/firewall_policy.go:50

All three represent a proxied network request log line with overlapping fields (Timestamp, Method, Status, URL common to all three; Decision shared between FirewallLogEntry and AuditLogEntry). They differ mainly in incidental details — plain-text parser structs (Squid access log vs firewall text log) vs a JSON-tagged struct for the Squid audit log format.

Recommendation: Extract a common LogRequestCore{Timestamp, Method, Status, URL} embeddable type, keeping format-specific fields (Decision, UserAgent, Hierarchy, Schema, etc.) in each source-specific struct. Effort: 2-3 hours.

---

Untyped Usages

Summary Statistics (approximate — see notes)

• interface{}/any locations (all forms): ~3,400, dominated by map[string]any (2,399 hits) and []any (449 hits)
• Untyped constants: ~500 (roughly 414 single-line const X = ... plus ~122 const() blocks)
• Bare old-style interface{}: nearly extinct — only 2 real (non-testdata) occurrences

Context: the large majority of any/map[string]any usage is legitimate — this codebase's core job is compiling dynamic YAML/JSON workflow frontmatter, and map[string]any is the idiomatic Go decode target for that boundary. The examples below were filtered down from thousands of hits to cases with a knowable concrete type and low risk of being a stdlib/decode-boundary requirement.

Category 1: interface{}/any in function parameters — Medium impact

renderRunsOnSnippet(value any) string — pkg/workflow/runs_on_snippet.go:19
Called from 5 sites; body only ever branches on map[string]any or "everything else" (string/[]any) — same shape the codebase already solved with RunsOnValue (repo_config.go:69).
→ Define a RunsOnSpec sum type (string | []string | map[string]any) with UnmarshalJSON.

ParseCheckoutConfigs(raw any) ([]*CheckoutConfig, error) — pkg/workflow/checkout_config_parser.go:17
Only caller (frontmatter_parsing.go:68-73) already asserts .(bool) first; body only ever handles map[string]any or []any — all 3 shapes are documented in FrontmatterConfig.Checkout's own comment.
→ Introduce a CheckoutSpec type resolving directly to []*CheckoutConfig.

getFeatureValueCaseInsensitive(features map[string]any, flagName string) (any, bool) — pkg/workflow/sandbox_validation.go:497
Single caller immediately does .(string) and errors if it isn't. The any return is never used for anything but a string.
→ Return (string, bool, error) directly; move the type check inside.

Category 2: interface{}/any in struct fields — High impact

FrontmatterConfig.RunsOn any / RunsOnSlim any — pkg/workflow/frontmatter_types.go:356-357
Comment: "Supports string, array, or object". Sibling SafeOutputsConfig.RunsOn already solves this via UnmarshalJSON + renderRunsOnSnippet, normalizing to a plain string.
→ Give FrontmatterConfig the same UnmarshalJSON treatment.

SafeJobConfig.RunsOn any, RawPermissions any — pkg/workflow/safe_jobs.go:21,27
Immediately type-switched into exactly two shapes (string / []any) right after parsing (safe_jobs.go:236-238).
→ Reuse the RunsOnSpec/RunsOnValue sum type instead of any + inline type switch.

FrontmatterConfig.Imports any, Include any — pkg/workflow/frontmatter_types.go:369,371
Comments already document "Can be string or array" — identical problem already solved elsewhere via RunsOnValue.
→ Add a StringOrStringSlice []string type with 2-branch UnmarshalJSON.

SafeOutputsConfig.ReportFailureAsIssue any — pkg/workflow/safe_outputs_config_types.go:109
Comment enumerates exactly 3 shapes (bool / templatable expression string / string list). The package already has TemplatableBool/TemplatableBoolOrInt for this exact ambiguity pattern.
→ Add a TemplatableBoolOrStringList type following the existing pattern.

AwInfo.RunID any, RunNumber any — pkg/cli/logs_models.go:337-338
No call site anywhere in pkg/cli actually reads these fields; sibling AwContext.RunID is already a plain string.
→ Declare as string to match, or flag as currently-dead data.

Category 3: interface{}/any in map/slice values — Medium impact

FrontmatterConfig.MCPServers map[string]any — pkg/workflow/frontmatter_types.go:330
Comment marks it "Legacy field, use Tools instead" — superseded by the already strongly-typed *ToolsConfig field two lines above.
→ Move to a dedicated legacy/compat shim struct rather than keeping it on the primary config type.

parseGitHubAllowedToolsAndLimits(allowedSetting any) — pkg/workflow/mcp_github_config.go:266
Per-item map[string]any{name, max-calls} lookup could be a small struct.
→ Keep the outer any (YAML boundary unavoidable) but add an AllowedToolEntry{Name string; MaxCalls int} for the inner shape.

Category 4: Untyped constants (numeric) — Medium impact

workflowCompletionWaitTimeoutMinutes = 6 * 60 — pkg/cli/run_workflow_execution.go:26
Passed as a bare int into a timeoutMinutes int parameter; the very next constant in the same file correctly uses time.Duration, highlighting the inconsistency.
→ const workflowCompletionWaitTimeout = 6 * time.Hour and change the parameter to time.Duration.

Five *TimeoutMinutes constants — pkg/cli/mcp_tools_privileged.go:21,28,34,40,44
Unit ("minutes") lives only in the name/comment, not the type.
→ Type directly as time.Duration (e.g. 1 * time.Minute).

defaultSafeOutputsTimeoutMinutes = 45 — pkg/workflow/compiler_safe_outputs_job.go:539
Same "Minutes-suffix-as-unit" pattern repeated across the codebase.
→ Same time.Duration fix.

Category 5: Untyped constants (string, enum-like) — High impact

CompilerError.Type string — pkg/console/console_types.go:13 (values: "error", "warning", "info")
Raw literals duplicated ad hoc across pkg/parser/schema_compiler.go:466, pkg/parser/import_error.go:135, pkg/cli/grant.go:276, plus a switch in console.go:97. No shared constants exist anywhere — a typo like "eror" would silently fall through to a switch's default case.
→ type ErrorSeverity string with named constants, used at every construction site.

FormField.Type string — pkg/console/console_types.go:46 (values: "input", "password", "confirm", "select")
A test already asserts against this hardcoded value list, implying it's fixed but not encoded as a type.
→ type FormFieldType string with named constants.

ExperimentsStorage string — pkg/workflow/workflow_data.go:187, constants at pkg/workflow/compiler_experiments.go:25,29 (values: "cache", "repo")
Exactly 2 valid values, already gated by a switch/case — precisely the enum shape the codebase solves elsewhere with named types (ActionMode, LockSchemaVersion), but left untyped here.
→ type ExperimentsStorageMode string with ExperimentsStorageCache/ExperimentsStorageRepo constants.

---

🎯 What Should We Do About This?

Priority 1: Consolidate the "legacy vs AWF" sandbox config duplication

Recommendation: Merge BoundedQueriesConfig/AWFBoundedQueriesConfig and SRTNetworkConfig/AWFNetworkConfig into single canonical types with format-specific marshaling instead of hand-written field-copy functions.

Steps: 1) Confirm the AWF variants carry no fields beyond the legacy type. 2) Replace copy functions with direct marshal/embed. 3) Run compiler + sandbox tests.
Estimated effort: 6-9 hours combined. Impact: High — removes a whole class of copy-paste-drift risk in sandbox security config.

Priority 2: Apply the existing RunsOnValue/TemplatableBool pattern to remaining any fields

Recommendation: FrontmatterConfig.RunsOn/RunsOnSlim/Imports/Include, SafeJobConfig.RunsOn, and SafeOutputsConfig.ReportFailureAsIssue all have comments documenting 2-3 known shapes — port each to a small sum-type with UnmarshalJSON/UnmarshalYAML, exactly like RunsOnValue and TemplatableBoolOrInt already do elsewhere in this package.

Steps: 1) Add RunsOnSpec/StringOrStringSlice/TemplatableBoolOrStringList types. 2) Swap field types and remove now-redundant inline type assertions/switches. 3) Run frontmatter parsing tests.
Estimated effort: 4-6 hours. Impact: High — removes manual type assertions at every call site.

Priority 3: Turn string-literal enums into named types

Recommendation: CompilerError.Type, FormField.Type, and ExperimentsStorage are all fixed small value sets currently passed around as bare string. Add named types + constants (matching ActionMode/LockSchemaVersion precedent) and update construction/comparison sites.

Steps: 1) Define the type + constants next to the struct. 2) Update literal construction sites to use the constants. 3) Update switch/comparison sites (no behavior change). 4) Run affected package tests.
Estimated effort: 3-4 hours. Impact: Medium — prevents silent typo bugs in string comparisons.

Priority 4 (smaller/opportunistic):

• Consolidate RepositoryFeatures struct duplication across build-tag files (<1 hour).
• Replace AuditComparisonIntDelta/AuditComparisonStringDelta with a generic Delta[T], and reuse it in audit_diff.go's repeated Run1X/Run2X/XChange field triples (2-3 hours).
• Type the several *TimeoutMinutes int constants as time.Duration (1-2 hours).

---

Implementation Checklist

• Consolidate BoundedQueriesConfig/AWFBoundedQueriesConfig and SRTNetworkConfig/AWFNetworkConfig
• Add sum types for RunsOn/Imports/Include/ReportFailureAsIssue and drop the any fields
• Add ErrorSeverity, FormFieldType, ExperimentsStorageMode named types
• Deduplicate RepositoryFeatures build-tag struct
• Introduce generic Delta[T] in pkg/cli and apply to audit_comparison.go/audit_diff.go
• Type *TimeoutMinutes constants as time.Duration
• Run full test suite after each change group

Analysis Metadata

• Total Go Files Analyzed: 1,179 non-test files under pkg/
• Total Type Definitions (approx.): 1,089
• Duplicate Clusters: 6 (1 exact, 2 near, 3 semantic)
• Untyped Usage Locations (approx.): ~3,400 interface{}/any, ~500 untyped constants (majority legitimate; ~20 flagged as real opportunities)
• Detection Method: ripgrep-based structural scan + manual call-site verification (Serena's language server did not initialize in this sandbox run, so semantic reference tracing fell back to grep-based call-site analysis)
• Analysis Date: 2026-08-03

Generated by ✍️ Typist - Go Type Analysis · agent · 442.2 AIC · ⌖ 43.2 AIC · ⊞ 8.8K · ◷

• expires on Aug 4, 2026, 4:44 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-04T12:44:41.876Z.

Closed by Workflow