[sergo] Sergo Report: cached-syntactic-stdlib-match-reverify+new-neveraudited-linter-sweep - 2026-08-19

[github-actions[bot]]

Executive summary

Ran Sergo R61 after a large gap since the last memorized run (R60, 2026-07-08). The linter registry has grown substantially in the interim — from 43 to 66 analyzers — with 60+ runs' worth of issues already filed and closed by the team in that window. This run reconciled state, retired one fully-resolved probe class, and surfaced one new, previously-unaudited finding.

Tool & registry updates

• Serena LSP tool surface: stable, 23 tools.
• Registry detector changed upstream: cmd/linters/main.go now just calls linters.All() — the old grep -c Analyzer main.go detector reads 0. New detector: grep -c '\.Analyzer,' pkg/linters/registry.go, cross-checked against pkg/linters/doc.go's "N active analyzers" header (both agree: 66, doc-sync currently clean).
• Reconciled open issues via gh api repos/github/gh-aw/issues?labels=sergo&state=open: only one open item, #52229 probe3-DELETE-ME — a stray non-substantive artifact, not a real finding, left untouched.
• All previously-filed sergo issues in the historical corpus are closed, including several I could reconstruct from memory (writebytestring naming bug, syntactic-pkg-match holdouts, ctx-family FuncLit-boundary bugs).

Strategy split (50/50)

Cached component — re-verify syntactic_stdlib_match: Previously (R59/R60) 5 linters were known to compare ident.Name == "pkg" instead of using astutil.IsPkgSelector, a pattern prone to false positives (shadowed identifiers) and false negatives (import aliases). Re-ran the grep across all 66 linters: zero hits. This vein is now fully migrated and closed — retiring it as an active probe (recorded in memory; only worth re-checking if a brand-new linter reintroduces raw .Name comparisons).

New-exploration component — never-audited-linter sweep: Extracted every linter name ever mentioned across the full sergo issue title corpus (100+ issues) and diffed it against all 66 registered analyzer names. Exactly one linter, generatedyamlheredoc, had zero mentions in 60+ prior runs — a genuine blind spot. Deep-read its logic with Serena/Grep and found a real correctness gap (below).

Findings

generatedyamlheredoc — bare (( ... )) arithmetic with << misreported as a heredoc

• lineContainsShellHeredoc (pkg/linters/generatedyamlheredoc/generatedyamlheredoc.go:89) guards against false-flagging shell arithmetic shifts by checking for the literal substring "$((". It does not recognize bash's other arithmetic spelling, the bare (( expr )) compound command/conditional ((( count << 1 )), if (( retries << 1 > max )); then).
• For that spelling, the guard never triggers, so the code falls through to the delimiter check — and isShellWordByte accepts digits 0-9, so any numeric right-hand operand of << (<< 1, << 2, ...) is misread as a heredoc delimiter.
• The existing test suite only exercises the $((1 << 2)) spelling (correctly unflagged); there is no test for the bare-(( spelling, so the gap is untested.
• Impact: currently latent — no production .go string literal combines bare (( with << today, and the linter isn't wired into any CI LINTER_FLAGS enforcement list. But it's aimed squarely at generated-workflow shell strings, exactly where arithmetic idioms (retry backoff, bitmask flags) are likely to appear as generator logic grows, with no legitimate fix available once it fires (there's no heredoc to remove).
• Filed as issue (#53901), labeled sergo, with reproduction steps and a suggested fix (broaden the guard to also match bare "((", add a testdata case).

Repository context gathered this run

• pkg/: 66 registered analyzers (pkg/linters/registry.go:83-150), doc-sync clean against pkg/linters/doc.go.
• Registry detector migrated from cmd/linters/main.go grep to pkg/linters/registry.go grep — noted in memory for future runs.
• No new syntactic_stdlib_match, scope_boundary_funclit, or suppression-wiring gaps found on spot-checked linters (hardcodedfilepath ancestor walks are GenDecl/CallExpr-scoped, not the loop/goroutine-boundary pattern that historically caused bugs).

Generated tasks

1. Fix generatedyamlheredoc's arithmetic guard to recognize bare (( ... )) in addition to $(( ... )), with a regression test case (#53901).

Metrics

• Findings this run: 4 (1 filed as issue, 3 confirmatory/negative — vein retirement + 2 clean spot-checks)
• Issues created: 1 / 3 max
• Success score: 8/10 (solid, evidence-backed, reproducible finding on genuinely fresh territory; capped below 9 because the bulk of this run was catch-up/reconciliation rather than deep new analysis given the long gap)

Historical context

• Total runs: 61. Total findings: 412. Total tasks: 110. Average success score: 8.75.
• Team merges/closes sergo issues fast and reliably — reconciling against live GitHub state before selecting targets remains essential (memory alone is a snapshot, not current truth).

Next-run focus (R62)

• Re-verify #53901 landed.
• Re-grep the registry count (66 as of this run — may have grown again).
• Prioritize any linter with zero prior issue history first (the technique that surfaced this run's finding).
• Probe other string-literal-based context guards for "matches one spelling of a construct but not a sibling spelling" bugs — this appears to be a reusable bug class beyond just this one linter.

Generated by 🤖 Sergo - Serena Go Expert · agent · 131.1 AIC · ⌖ 4.82 AIC · ⊞ 6.3K · ◷

• expires on Aug 19, 2026, 8:06 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-20T04:06:36.340Z.

Closed by Workflow