[typist] Typist - Go Type Consistency Analysis

[github-actions[bot]]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🔤 Typist - Go Type Consistency Analysis

Analysis of repository: github/gh-aw

Executive Summary

I analyzed roughly 1,184 non-test .go files under pkg/, focusing on the safe-output config structs in pkg/workflow, the codemod/CLI layer in pkg/cli, and the frontmatter parsing pipeline in pkg/parser. The headline finding is a big one: the frontmatter map[string]any signature is repeated 290 times across 128 files — it's the parameter type for UpdateWorkflowFrontmatter, every one of the ~40 codemods in pkg/cli, and most of the Compiler.extract*FromOn helpers. A single named Frontmatter type with typed accessor methods would collapse dozens of hand-rolled .(string)/.([]any) type assertions into one well-tested place.

On the duplication side, the safe-output config family (CreateIssuesConfig, CreatePullRequestsConfig, CreateDiscussionsConfig, etc.) already has shared embeddable structs (SafeOutputTargetConfig, SafeOutputFilterConfig) — but 11 structs still redeclare TargetRepoSlug/AllowedRepos raw instead of embedding them, and 13 structs redeclare an identical Footer *string field. These are quick, low-risk wins since the shared struct already exists and a couple of structs (CloseJobConfig, ListJobConfig) already show the correct embedding pattern to copy. Fixing these two clusters alone removes ~24 duplicate field declarations with no behavior change.

Full Analysis Report

Duplicated Type Definitions

Summary Statistics

• Total type declarations sampled: ~1,137
• Duplicate clusters found: 10
• Exact duplicates: 3
• Near duplicates: 5
• Semantic duplicates: 2

Cluster 1: Footer *string field duplication

Type: Near duplicate
Occurrences: 13 (verified via grep)
Impact: High — identical field + tag repeated across the entire safe-output config family

Locations (representative):

1. pkg/workflow/create_pull_request.go:59
2. pkg/workflow/create_issue.go:28
3. pkg/workflow/create_discussion.go:28
4. pkg/workflow/update_issue.go:18
5. pkg/workflow/update_pull_request.go:20
6. pkg/workflow/update_discussion.go:19
7. pkg/workflow/update_release.go:12
8. pkg/workflow/add_comment.go:27
9. pkg/workflow/comment_memory.go:14
10. pkg/workflow/submit_pr_review.go:20
11. pkg/workflow/reply_to_pr_review_comment.go:15
12. (+2 more with the same yaml:"footer,omitempty" tag)

Definition Comparison:

// All 13 are structurally identical:
Footer *string `yaml:"footer,omitempty"` // Controls whether AI-generated footer is added

Recommendation:

• Extract into an embeddable FooterConfig struct (field: Footer *string with tag yaml:"footer,omitempty") next to the existing SafeOutputTargetConfig/SafeOutputFilterConfig pattern in pkg/workflow/safe_outputs_parser.go
• Embed via FooterConfig with tag yaml:",inline" in each of the 13 structs
• Estimated effort: 1-2 hours
• Benefits: Single source of truth for footer visibility behavior; one place to fix footer-related bugs instead of 13

---

Cluster 2: TargetRepoSlug/AllowedRepos not embedding SafeOutputTargetConfig

Type: Near duplicate
Occurrences: 11 structs redeclare raw fields (verified via grep) instead of embedding
Impact: High — the shared type already exists, this is a pure migration

Locations:

1. pkg/workflow/create_pull_request.go:47
2. pkg/workflow/create_issue.go:21
3. pkg/workflow/create_discussion.go:21
4. pkg/workflow/create_agent_session.go:13
5. pkg/workflow/push_to_pull_request_branch.go:24
6. pkg/workflow/create_code_scanning_alert.go:18
7. pkg/workflow/comment_memory.go:11
8. pkg/workflow/update_project.go:29
9. pkg/workflow/add_comment.go:19
10. pkg/workflow/create_pr_review_comment.go:15
11. pkg/workflow/dispatch_workflow.go:15

Canonical shared type (already exists): pkg/workflow/safe_outputs_parser.go:9 — SafeOutputTargetConfig { Target, TargetRepoSlug, AllowedRepos }

Recommendation:

• Replace each raw TargetRepoSlug string / AllowedRepos []string field pair by embedding SafeOutputTargetConfig (tag yaml:",inline") — the pattern CloseJobConfig/ListJobConfig already use correctly
• Estimated effort: 2-3 hours (mechanical, but touches marshal/unmarshal call sites — needs test run after each file)
• Benefits: Removes 11 duplicate field pairs; any future target-repo validation logic only needs to change in one place

---

Cluster 3: TitlePrefix reused for two different concepts

Type: Semantic duplicate
Occurrences: 8
Impact: Medium — same field name/tag means two different things depending on which struct you're in

Locations:

1. pkg/workflow/create_pull_request.go:36 (default-title-prefix semantics)
2. pkg/workflow/create_issue.go:14 (default-title-prefix semantics)
3. pkg/workflow/create_discussion.go:16 (default-title-prefix semantics)
4. pkg/workflow/create_project.go:12 (default-title-prefix semantics)
5. pkg/workflow/push_to_pull_request_branch.go:17 (required-title-prefix validation semantics)
6. pkg/workflow/missing_issue_reporting.go:20 (prefix-for-generated-titles semantics)
7. pkg/workflow/update_issue.go:19 (deprecated alias for required-title-prefix)
8. pkg/workflow/safe_outputs_parser.go:20 — SafeOutputFilterConfig.TitlePrefix (deprecated filter alias)

Recommendation:

• Rename the "default title for new content" variant (create_issue/create_discussion/create_pull_request/create_project) to DefaultTitlePrefix to disambiguate from the deprecated filter alias
• Have update_issue.go embed SafeOutputFilterConfig instead of redeclaring its own TitlePrefix
• Estimated effort: 2-3 hours
• Benefits: Removes name collision between two unrelated concepts; clarifies deprecated-vs-active fields

---

Cluster 4: AllowedLabels []string field duplication

Type: Near duplicate
Occurrences: 5
Impact: Medium

Locations:

1. pkg/workflow/create_pull_request.go:39
2. pkg/workflow/create_issue.go:17
3. pkg/workflow/create_discussion.go:20
4. pkg/workflow/update_discussion.go:18
5. pkg/workflow/merge_pull_request.go:14 (marked deprecated in favor of required-labels)

Recommendation:

• Add AllowedLabels []string to the existing SafeOutputFilterConfig shared struct (pkg/workflow/safe_outputs_parser.go:17) and embed it in these 5 structs
• Estimated effort: 1-2 hours

---

Cluster 5: AuditComparisonIntDelta / AuditComparisonStringDelta

Type: Near duplicate
Occurrences: 2 (+1 related slice-shaped variant)
Impact: Medium — same shape, different value type, in a Go 1.18+ codebase that could use generics

Locations:

1. pkg/cli/audit_comparison.go:45 — AuditComparisonIntDelta { Before int; After int; Changed bool }
2. pkg/cli/audit_comparison.go:51 — AuditComparisonStringDelta { Before string; After string; Changed bool }

Recommendation:

• Replace both with AuditComparisonDelta[T comparable] struct { Before, After T; Changed bool }
• Estimated effort: 1-2 hours
• Benefits: One generic type instead of two hand-duplicated ones; easy to extend to other comparable types later

---

Cluster 6: PRInfo vs PullRequest (pkg/cli)

Type: Semantic duplicate
Occurrences: 2
Impact: Medium — both represent a GitHub PR fetched via gh pr view, with non-overlapping fields

Locations:

1. pkg/cli/pr_command.go:28 — PRInfo { Number, Title, Body, State, HeadSHA, BaseBranch, HeadBranch, SourceRepo, TargetRepo, AuthorLogin }
2. pkg/cli/pr_automerge.go:21 — PullRequest { Number, Title, IsDraft, Mergeable, CreatedAt, UpdatedAt }

Recommendation: Consider one shared PullRequest struct with the union of fields both call sites need, rather than two overlapping representations of the same GitHub entity in the same package.

---

Cluster 7: RepositoryFeatures — exact duplicate across build tags

Type: Exact duplicate
Occurrences: 2
Impact: Low — fields are byte-identical

Locations:

1. pkg/workflow/repository_features_validation.go:73 (native build)
2. pkg/workflow/repository_features_validation_wasm.go:31 (//go:build js || wasm)

Recommendation: The struct itself (HasDiscussions bool; HasIssues bool) has no platform dependency — only the validation function differs between builds. Hoist the type declaration into a shared non-build-tagged file.

---

Clusters flagged but requiring no action

• SpinnerWrapper/ProgressBar (native vs. wasm) — deliberate build-tag split with an intentionally slimmer wasm implementation; not consolidatable without pulling terminal-only deps into wasm builds.
• Cross-package type aliases (ActionPin, InputDefinition, ToolCallInfo, SanitizeOptions) — these are type X = otherpkg.X re-exports, a deliberate and correctly-applied Go pattern, not real duplication.
• Worker/fakeOS in pkg/linters/*/testdata — required by the go/analysis testdata convention for custom golangci-lint analyzers; each lives in its own isolated fixture package.

---

Untyped Usages

Summary Statistics

• interface{} usages (verified): 17 total in non-test pkg/ files
• any usages (verified, rough pattern match): ~3,076 total in non-test pkg/ files
• frontmatter map[string]any specifically: 290 occurrences across 128 files
• Untyped constants sampled: ~641

Category 1: frontmatter map[string]any — the dominant pattern

Impact: High — single highest-leverage fix in the codebase

Root type: pkg/parser/frontmatter_content.go:20 — FrontmatterResult.Frontmatter map[string]any

This shape propagates through:

• pkg/parser/workflow_update.go:22 — UpdateWorkflowFrontmatter(workflowPath string, updateFunc func(frontmatter map[string]any) error, verbose bool) error
• pkg/cli/fix_codemods.go:20 — every one of the ~40 codemods: Apply func(content string, frontmatter map[string]any) (string, bool, error)
• pkg/workflow/stop_after.go:19 and sibling Compiler.extract*FromOn methods (extractSkipIfMatchFromOn, extractSkipIfNoMatchFromOn, extractSkipIfCheckFailingFromOn) — same signature repeated per extraction helper

Suggested fix:

type Frontmatter map[string]any
func (f Frontmatter) GetString(key string) (string, bool) { ... }
// use Frontmatter instead of map[string]any in every signature above

Benefits: One named type with typed accessor methods replaces hundreds of duplicated .(string)/.([]any) assertions scattered across 128 files; parsing bugs get fixed in one place instead of wherever they happen to surface.

Estimated effort: 4-6 hours for the type + accessors + updating the ~40 codemod signatures (mostly mechanical, but needs a full test run)

---

Category 2: sync.Map caches storing exactly one concrete type

Impact: Medium — removes a live runtime-failure path, not just a style issue

Examples:

1. pkg/workflow/behavior_defined_engine.go:632 — engineDefinitionCache sync.Map documented as map[string]EngineDefinition, with defensive code at lines 640-647 to handle a failed type assertion ("cache corruption or concurrent Store with unexpected type")
2. pkg/workflow/repository_features_validation.go:80 — repositoryFeaturesCache sync.Map storing only *RepositoryFeatures, with a cache.Delete-on-mismatch fallback at line 202

Suggested fix: Wrap each in a small typed cache struct (or Go generics) so the type assertion — and its failure-handling branch — disappears entirely, since only one type is ever stored.

---

Category 3: engine.go's ~20 applyEngineXField(config, engineObj map[string]any) functions

Impact: High — a hand-rolled struct decoder

Location: pkg/workflow/engine.go:546 and ~19 sibling functions (applyEngineEnvField, applyEngineAuthField, applyEngineArgsField, applyEngineMCPField, applyEngineProviderFields, applyEnginePermissionMode, applyEngineTurnFields, applyEngineConcurrencyField, applyEngineStringFields, applyEngineDriverField, applyEngineHarnessField, applyEngineExtensionsField, applyEngineBooleanFields, applyEngineBareField)

Suggested fix: Define a struct with yaml tags for the engine: frontmatter object and unmarshal once via yaml.Unmarshal, instead of ~20 functions each independently re-probing the same map[string]any for fixed, known keys.

Estimated effort: 6-8 hours (higher risk — touches core engine parsing, needs thorough test coverage)

---

Category 4: []any → []*WorkflowStep → []any unneeded round-trip

Impact: High — the typed version already exists and is being discarded

Location: pkg/workflow/workflow_builder.go:790 (and 748/770/819)

The codebase already has a fully-typed WorkflowStep struct (pkg/workflow/step_types.go:18) with SliceToSteps/StepsToSlice converters. processAndMergeSteps converts typed steps back to []any (lines 764, 786, 810) purely to marshal them via a map[string]any wrapper (line 826) — defeating the type safety the conversion functions were built to provide.

Suggested fix: Keep mainSteps/copilotSetupSteps/otherImportedSteps/allSteps as []*WorkflowStep throughout; rely on WorkflowStep's existing yaml tags for marshaling.

---

Category 5: String fields that are really enums (pkg/workflow/engine_definition.go)

Impact: Medium — three separate instances of the same pattern in one struct family

Field	Location	Only recognized value	Compared against
SecretStrategy string	engine_definition.go:231	"universal-llm-consumer"	untyped const in behavior_defined_engine.go:19
ProviderEnvMode string	engine_definition.go:204	"universal-llm-consumer"	untyped const in behavior_defined_engine.go:20
MergeStrategy string	engine_definition.go:189	"json-merge"	untyped const in behavior_defined_engine.go:21

Suggested fix: Define named string types (SecretStrategy, ProviderEnvMode, ConfigMergeStrategy) with typed constants, replacing the untyped string comparisons.

---

Category 6: Discriminated unions currently typed any

Impact: Medium

• pkg/workflow/safe_outputs_config_types.go:109 — ReportFailureAsIssue any — doc comment says it's one of bool | templatable string | []interface{} categories, and the struct already carries two derived yaml:"-" fields populated by manually parsing this any. A custom UnmarshalYAML dispatching on shape would remove the derived-field workaround entirely.
• pkg/workflow/safe_outputs_config_types.go:115 — Steps []any — should be []*WorkflowStep (same established pattern as SliceToSteps/StepsToSlice elsewhere), consumed as GH Actions step objects at compiler_safe_outputs_job.go:238-240.
• pkg/workflow/step_types.go:28 — ContinueOnError any (bool or expression string) — lowest priority; it's the one untyped field in an otherwise fully-typed WorkflowStep.

---

Category 7: Untyped duration/size constants

Impact: Low-Medium — clarity, not correctness bugs (no confirmed runtime failures)

• pkg/workflow/compiler.go:25 — MaxLockFileSize, MaxExpressionSize, MaxPromptChunkSize are untyped byte-count ints, distinguished only by comments. Suggested: type ByteSize int.
• pkg/cli/mcp_tools_privileged.go:40 — defaultMCPAuditTimeoutMinutes, defaultMCPAuditDiffTimeoutMinutes, etc. are untyped int "minutes" constants manually converted at each call site via time.Duration(x)*time.Minute. Declaring them directly as time.Duration removes the repeated conversion and the risk of a call site forgetting the multiplier.

---

Recommendations by Priority

Priority 1: Quick wins — safe-output config field consolidation (Clusters 1, 2, 4)

Steps:

1. Add FooterConfig and extend SafeOutputFilterConfig with AllowedLabels in pkg/workflow/safe_outputs_parser.go
2. Migrate the 11 structs with raw TargetRepoSlug/AllowedRepos to embed SafeOutputTargetConfig
3. Run the full test suite (go test ./pkg/workflow/...) after each mechanical migration

Estimated effort: 4-6 hours total
Impact: High — removes ~29 duplicate field declarations with minimal risk

---

Priority 2: High-value type safety — Frontmatter named type

Steps:

1. Define type Frontmatter map[string]any with typed getters in pkg/parser
2. Update UpdateWorkflowFrontmatter and the codemod Apply signature to use it
3. Update the Compiler.extract*FromOn family in pkg/workflow
4. Run tests across pkg/parser, pkg/cli (codemods), and pkg/workflow

Estimated effort: 4-6 hours
Impact: High — touches 128 files' worth of untyped map assertions, but is additive (map[string]any is still the underlying type, so it's a low-risk rename+method-add, not a breaking change)

---

Priority 3: Structural cleanups — engine parsing and step round-trips

Steps:

1. Design a struct for the engine: frontmatter object to replace the ~20 applyEngineXField functions in engine.go
2. Fix the []any → []*WorkflowStep → []any round-trip in workflow_builder.go to stay typed throughout
3. Add named enum types for SecretStrategy/ProviderEnvMode/MergeStrategy in engine_definition.go

Estimated effort: 8-12 hours (higher risk, needs careful test coverage on core engine/workflow compilation)
Impact: High — but higher risk since it touches core compilation logic

---

Implementation Checklist

• Add FooterConfig + AllowedLabels to SafeOutputFilterConfig; embed in 13 + 5 structs
• Migrate 11 structs to embed SafeOutputTargetConfig
• Disambiguate TitlePrefix into DefaultTitlePrefix vs. deprecated filter alias
• Introduce generic AuditComparisonDelta[T] replacing AuditComparisonIntDelta/StringDelta
• Hoist RepositoryFeatures struct out of build-tagged files into a shared file
• Define Frontmatter named type with typed accessors; migrate UpdateWorkflowFrontmatter, codemods, Compiler.extract*FromOn
• Wrap engineDefinitionCache/repositoryFeaturesCache sync.Maps in typed accessors
• Replace applyEngineXField(..., map[string]any) family with a single struct + yaml.Unmarshal
• Fix []any round-trip in workflow_builder.go to stay []*WorkflowStep
• Add enum types for SecretStrategy/ProviderEnvMode/MergeStrategy
• Run full test suite after each change; verify no YAML marshal/unmarshal regressions

Analysis Metadata

• Total Go Files Under pkg/ (non-test): 1,184
• Type Declarations Sampled: ~1,137
• Duplicate Clusters Identified: 10 (7 actionable, 3 flagged as intentional/no-action)
• Untyped Usage Findings: 17 categorized examples (from ~3,076 raw any/interface{} hits)
• Detection Method: grep/pattern-based sampling across pkg/, cross-verified with direct file reads and count verification
• Analysis Date: 2026-08-06

Generated by ✍️ Typist - Go Type Analysis · agent · 411.9 AIC · ⊞ 8.8K · ◷

• expires on Aug 7, 2026, 4:18 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-07T12:18:03.032Z.

Closed by Workflow