[repository-quality] 🎯 Repository Quality Improvement Report - Custom Go Linter CI Enablement Gap (2026-09-11)

[github-actions[bot]]

🎯 Repository Quality Improvement Report - Custom Go Linter CI Enablement Gap (Follow-up)

Analysis Date: 2026-09-11
Focus Area: Custom Go Linter CI Enablement Gap (re-visited from 2026-09-07)
Strategy Type: Reused
Custom Area: No — reused because the 2026-09-07 finding remains unresolved and new evidence sharpens the remediation scope

Executive Summary

On 2026-09-07 this agent found that pkg/linters/registry.go registers 68 custom go/analysis analyzers, but .github/workflows/cgo.yml's hand-typed LINTER_FLAGS allowlist omits 12 of them, so they never gate CI despite being built, registered, and documented. Four days later, that gap is still open: manualpathconcat, packagelevelmutableslicemap, and seenmapbool — three of the twelve omitted analyzers — are absent from both the native and WASM LINTER_FLAGS strings in cgo.yml (lines ~1459 and ~1462), and re-running them today surfaces 60 live findings in current production code that CI has never seen: 49 manualpathconcat, 8 packagelevelmutableslicemap (mutating shared package state without synchronization — a genuine data-race risk on caches shared across goroutines), and 3 seenmapbool (inefficient map[string]bool set idioms). This confirms the gap is not just cosmetic debt but is actively hiding real defects from every PR and merge-queue run.

The remaining nine gapped analyzers (errorfwrapv, errormessage, excessivefuncparams, hardcodedfilepath, largefunc, lenstringzero, sprintferrdot, ssljson, stringsconcatloop) either require dedicated invocation flags (e.g. errormessage needs -errormessage.full-repo to run outside the incremental changed-files mode, and surfaced 3,176 pre-existing findings when forced full-repo — too large to gate abruptly) or zero current findings, so this report narrows the actionable remediation to the three analyzers with concrete, CI-appropriate, non-zero, bounded finding counts. Recommended next steps: add the three flags to cgo.yml, fix the 8 packagelevelmutableslicemap race-risk sites first (highest severity), then the 49 manualpathconcat and 3 seenmapbool findings, and separately scope a phased enablement plan for errormessage given its 3,176-finding backlog.

Full Analysis Report

Focus Area: Custom Go Linter CI Enablement Gap (Follow-up)

Current State Assessment

pkg/linters/registry.go defines allAnalyzers (68 entries). .github/workflows/cgo.yml runs make golint-custom LINTER_FLAGS="..." -test=false twice (native + GOOS=js GOARCH=wasm), passing an explicit, hand-maintained list of -<analyzer> flags. Diffing the registry against both LINTER_FLAGS strings shows the same 12-analyzer gap identified on 2026-09-07 is unchanged today:

errorfwrapv, errormessage, excessivefuncparams, hardcodedfilepath, largefunc, lenstringzero, manualpathconcat, packagelevelmutableslicemap, seenmapbool, sprintferrdot, ssljson, stringsconcatloop

Running each gapped analyzer directly (via a locally built cmd/linters binary) against ./cmd/... ./pkg/... gives:

Metrics Collected:

Metric	Value	Status
Analyzers registered in pkg/linters/registry.go	68	✅
Analyzers present in cgo.yml LINTER_FLAGS	56	⚠️
Analyzers still gapped from CI (unchanged since 2026-09-07)	12	❌
manualpathconcat findings (production code)	49	❌
packagelevelmutableslicemap findings (data-race risk)	8	❌
seenmapbool findings	3	❌
errormessage -full-repo findings (not CI-gateable as-is)	3,176	⚠️
largefunc, excessivefuncparams, hardcodedfilepath, lenstringzero, sprintferrdot, ssljson, stringsconcatloop, errorfwrapv findings	518 / 0 / 0 / 0 / 0 / 0 / 0 / 0	⚠️/✅

Findings

Strengths

• The custom linter framework itself (pkg/linters/registry.go, cmd/linters) is sound and the All() function is the single source of truth other consumers could import from instead of hand-copied flag strings.
• Most previously-flagged categories (errormessage incremental mode, hardcodedfilepath, sprintferrdot, ssljson, stringsconcatloop, lenstringzero, excessivefuncparams) currently have zero findings in production code — safe to enable immediately with no remediation debt.

Areas for Improvement

• 🔴 HIGH: packagelevelmutableslicemap (8 findings) flags package-level slice/map globals mutated via re-assignment or index-assignment outside synchronization — e.g. pkg/cli/model_costs.go:50 (modelPriceRecords), pkg/cli/update_version_labels.go:73/86 (versionLabelCache), pkg/workflow/model_aliases.go:96 (builtinOnlyAliasMap). These are genuine concurrent-mutation risks in a compiler package that is exercised across parallel test/compile invocations.
• 🟠 MEDIUM: manualpathconcat (49 findings) — string-concatenation path building instead of filepath.Join/path.Join, concentrated in pkg/workflow (action_reference.go, compiler_github_actions_steps.go, safe_outputs_actions.go, engine_config_dir.go) and pkg/cli (dispatch.go, checks_command.go, devcontainer.go). Not gated in CI despite the analyzer being registered.
• 🟡 MEDIUM: seenmapbool (3 findings) — map[string]bool used purely as a set in pkg/cli/experiments_analyze_statistics.go:445 and pkg/cli/update_manifest.go:333,346; map[string]struct{} is the idiomatic zero-allocation alternative.
• ⚪ LOW: errormessage -full-repo backlog (3,176 findings) is too large to gate as a hard CI blocker today; needs a phased/baseline approach rather than a flat -errormessage flag add.

Detailed Analysis

The root cause is unchanged from 2026-09-07: cgo.yml's LINTER_FLAGS is a hand-typed string with no automated check that it stays in sync with pkg/linters/registry.go's All(). New evidence this run is that the drift is not benign — packagelevelmutableslicemap specifically targets data-race-prone code, and its 8 hits are in cache/label-lookup code paths (model_costs.go, update_version_labels.go, model_aliases.go, runtime_definitions.go, safe_outputs_tools_repo_params.go, samples_validation.go) that are plausibly invoked concurrently during gh aw compile/test runs. Because these three analyzers (manualpathconcat, packagelevelmutableslicemap, seenmapbool) have zero-to-moderate, immediately actionable finding counts (60 total, not thousands), they are the highest-leverage subset to close first, distinct from errormessage's 3,176-finding backlog which needs separate planning.

---

🤖 Tasks for Copilot Agent

NOTE TO PLANNER AGENT: Split the following tasks into individual work items.

Improvement Tasks

Task 1: Fix package-level mutable slice/map data-race risks flagged by packagelevelmutableslicemap

Priority: High
Estimated Effort: Medium
Focus Area: Custom Go Linter CI Enablement Gap

Description: Eight package-level slice/map variables are mutated via wholesale re-assignment, append, or index-assignment without synchronization: pkg/workflow/model_aliases.go:96 (builtinOnlyAliasMap), pkg/workflow/runtime_definitions.go:242 (allManifestFilesBaseCache), pkg/workflow/safe_outputs_tools_repo_params.go:23 (repoTargetAccessors), pkg/workflow/samples_validation.go:172 (sortedSafeOutputFieldNames), pkg/cli/model_costs.go:50,73 (modelPriceRecords), pkg/cli/update_version_labels.go:73,86 (versionLabelCache). Wrap each with a sync.Mutex/sync.RWMutex guarding all reads and writes, or convert to a sync.Once-initialized immutable value if the data is actually static after first computation. Verify with go test -race on affected packages.

Acceptance Criteria:

• All 8 flagged package-level variables are protected by a mutex or converted to safe lazy-init patterns
• go build -o /tmp/gh-aw-linters ./cmd/linters && /tmp/gh-aw-linters -packagelevelmutableslicemap ./cmd/... ./pkg/... reports zero findings
• go test -race ./pkg/workflow/... ./pkg/cli/... passes

Code Region: pkg/workflow/model_aliases.go, pkg/workflow/runtime_definitions.go, pkg/workflow/safe_outputs_tools_repo_params.go, pkg/workflow/samples_validation.go, pkg/cli/model_costs.go, pkg/cli/update_version_labels.go

In gh-aw, the custom `packagelevelmutableslicemap` go/analysis linter (pkg/linters/packagelevelmutableslicemap) flags 8 package-level slice/map variables mutated without synchronization:
- pkg/workflow/model_aliases.go:96 (builtinOnlyAliasMap)
- pkg/workflow/runtime_definitions.go:242 (allManifestFilesBaseCache)
- pkg/workflow/safe_outputs_tools_repo_params.go:23 (repoTargetAccessors)
- pkg/workflow/samples_validation.go:172 (sortedSafeOutputFieldNames)
- pkg/cli/model_costs.go:50 and :73 (modelPriceRecords, wholesale re-assign and append)
- pkg/cli/update_version_labels.go:73 and :86 (versionLabelCache, wholesale re-assign and index assign)

For each: inspect how the variable is populated (usually lazy-init-on-first-use caches) and add proper synchronization — a package-level sync.Mutex/sync.RWMutex guarding every read and write, or refactor to sync.Once + immutable value if data never changes after first computation. Do not change public API signatures. After fixing, build the linter with `go build -o /tmp/gh-aw-linters ./cmd/linters` and confirm `/tmp/gh-aw-linters -packagelevelmutableslicemap ./cmd/... ./pkg/...` reports zero findings, and run `go test -race ./pkg/workflow/... ./pkg/cli/...` to confirm no regressions.

---

Task 2: Replace manual path string-concatenation with filepath.Join/path.Join

Priority: Medium
Estimated Effort: Medium
Focus Area: Custom Go Linter CI Enablement Gap

Description: The manualpathconcat analyzer found 49 call sites across pkg/workflow and pkg/cli that build paths via "/"-concatenation instead of filepath.Join/path.Join, risking double-slash or platform-inconsistent paths. Representative sites: pkg/workflow/action_reference.go:71, pkg/workflow/compiler_github_actions_steps.go:27,79,83, pkg/workflow/safe_outputs_actions.go:144,290, pkg/workflow/engine_config_dir.go:45,59, pkg/cli/dispatch.go:447,563,761, pkg/cli/checks_command.go:282,304, pkg/cli/devcontainer.go:277. Replace each with the appropriate filepath.Join (local filesystem paths) or path.Join (URL/slash-only paths, e.g. GitHub API paths, repo slugs) per the analyzer's suggestion text.

Acceptance Criteria:

• All 49 findings resolved with filepath.Join/path.Join (verify URL vs filesystem context per call site so path.Join is used for GitHub API/slug construction, not filepath.Join)
• /tmp/gh-aw-linters -manualpathconcat ./cmd/... ./pkg/... reports zero findings
• go build ./... succeeds and go test ./pkg/workflow/... ./pkg/cli/... passes

Code Region: pkg/workflow/*.go, pkg/cli/*.go (49 sites; run /tmp/gh-aw-linters -manualpathconcat ./cmd/... ./pkg/... for the full list)

In gh-aw, run `go build -o /tmp/gh-aw-linters ./cmd/linters && /tmp/gh-aw-linters -manualpathconcat ./cmd/... ./pkg/...` to get the full, current list of 49 manual "/" path-concatenation findings in pkg/workflow and pkg/cli (e.g. pkg/workflow/action_reference.go:71, pkg/workflow/compiler_github_actions_steps.go:27/79/83, pkg/workflow/safe_outputs_actions.go:144/290, pkg/workflow/engine_config_dir.go:45/59, pkg/cli/dispatch.go:447/563/761, pkg/cli/checks_command.go:282/304, pkg/cli/devcontainer.go:277).

For each finding, replace the manual "path1" + "/" + "path2" concatenation with filepath.Join for real filesystem paths, or path.Join for URL/API-path/slug-style strings (e.g. GitHub repo slugs like "owner/repo", REST API paths) — use judgment per call site based on the linter's suggested replacement in its message. Do not alter behavior when a path already legitimately starts with an existing separator. After fixing, confirm `/tmp/gh-aw-linters -manualpathconcat ./cmd/... ./pkg/...` reports zero findings, run `go build ./...`, and run `go test ./pkg/workflow/... ./pkg/cli/...` to confirm no regressions.

---

Task 3: Convert map[string]bool sets to map[string]struct{}

Priority: Low
Estimated Effort: Small
Focus Area: Custom Go Linter CI Enablement Gap

Description: The seenmapbool analyzer found 3 sites using map[string]bool purely as a membership set (values always true, never read as false): pkg/cli/experiments_analyze_statistics.go:445 (declared), pkg/cli/update_manifest.go:333 (latestSkillSources), pkg/cli/update_manifest.go:346 (latestAgentSources). Convert each to map[string]struct{} with _, ok := m[k] membership checks, saving one byte of allocation per entry and clarifying set-vs-map intent.

Acceptance Criteria:

• All 3 maps converted to map[string]struct{} with corresponding membership-check call sites updated
• /tmp/gh-aw-linters -seenmapbool ./cmd/... ./pkg/... reports zero findings
• go test ./pkg/cli/... passes

Code Region: pkg/cli/experiments_analyze_statistics.go:445, pkg/cli/update_manifest.go:333,346

In gh-aw, convert these 3 map[string]bool set-usage sites (flagged by the custom `seenmapbool` go/analysis linter) to map[string]struct{}:
- pkg/cli/experiments_analyze_statistics.go:445 (declared)
- pkg/cli/update_manifest.go:333 (latestSkillSources)
- pkg/cli/update_manifest.go:346 (latestAgentSources)

Change the declaration to map[string]struct{}, change assignment sites (`m[k] = true`) to `m[k] = struct{}{}`, and change membership reads (`if m[k]` or `if v, ok := m[k]; ok && v`) to `if _, ok := m[k]; ok`. After fixing, build the linter with `go build -o /tmp/gh-aw-linters ./cmd/linters` and confirm `/tmp/gh-aw-linters -seenmapbool ./cmd/... ./pkg/...` reports zero findings, then run `go test ./pkg/cli/...`.

---

Task 4: Add the 3 remediated analyzers (manualpathconcat, packagelevelmutableslicemap, seenmapbool) to cgo.yml's CI gate

Priority: High
Estimated Effort: Small
Focus Area: Custom Go Linter CI Enablement Gap

Description: Once Tasks 1–3 land (zero findings for all three analyzers), add -manualpathconcat -packagelevelmutableslicemap -seenmapbool to both LINTER_FLAGS strings in .github/workflows/cgo.yml (the native "Run custom linters" step around line 1459 and the WASM "Run custom linters (wasm)" step around line 1462, matching the packages already scoped there), so these three analyzers gate every future PR instead of silently bit-rotting. This closes 3 of the 12 analyzers gapped since 2026-09-07; the remaining 9 (errorfwrapv, errormessage, excessivefuncparams, hardcodedfilepath, largefunc, lenstringzero, sprintferrdot, ssljson, stringsconcatloop) should be tracked separately since most have zero current findings (safe to add without remediation) except errormessage (3,176-finding backlog needing a phased plan) and largefunc (518 findings, likely needs a raised -largefunc.max-lines threshold or baseline exemption list rather than a flat enable).

Acceptance Criteria:

• LINTER_FLAGS in both cgo.yml steps includes -manualpathconcat -packagelevelmutableslicemap -seenmapbool
• CI run of .github/workflows/cgo.yml passes with the new flags on a clean (Task 1–3 complete) codebase
• PR description or changeset notes documents which analyzers were newly enabled and why the other 9 remain pending

Code Region: .github/workflows/cgo.yml (LINTER_FLAGS strings, ~lines 1459 and 1462)

In gh-aw's .github/workflows/cgo.yml, the "Run custom linters" step (~line 1459) and "Run custom linters (wasm)" step (~line 1462) each pass a hand-typed LINTER_FLAGS string to `make golint-custom`. This string is missing 12 analyzers that are registered in pkg/linters/registry.go's All() function: errorfwrapv, errormessage, excessivefuncparams, hardcodedfilepath, largefunc, lenstringzero, manualpathconcat, packagelevelmutableslicemap, seenmapbool, sprintferrdot, ssljson, stringsconcatloop.

After the corresponding remediation PRs (fixing all manualpathconcat, packagelevelmutableslicemap, and seenmapbool findings) have merged, add `-manualpathconcat -packagelevelmutableslicemap -seenmapbool` to both LINTER_FLAGS strings in this file (do not remove -test=false or any existing flags). Verify by running `make golint-custom LINTER_FLAGS="...<updated flags>... -test=false"` locally and confirming it reports zero findings, matching what CI will now enforce. Leave the remaining 9 gapped analyzers out of scope for this task — file a follow-up note (e.g. a changeset or issue comment) listing them and the fact that errormessage has 3,176 pre-existing findings and largefunc has 518, both needing a phased enablement plan rather than a flat flag addition.

---

📊 Historical Context

Previous Focus Areas

Date	Focus Area	Type	Custom	Key Outcomes
2026-08-24	Large File Decomposition Debt	Custom	Y	32 Go files over 800 lines
2026-08-25	Dependency Health & Vulnerability Posture	Standard	N	100/116 deps outdated
2026-08-26	Error Message Actionability Debt	Custom	Y	2,631 non-actionable error messages
2026-08-28	Custom-Linter Auto-Fix Coverage Gap	Custom	Y	46/67 linters lack SuggestedFixes
2026-08-31	Skill Documentation Drift	Custom	Y	Stale JS architecture references in 2 skills
2026-09-01	Vacuous & Permanently-Skipped Test Debt	Custom	Y	14 unconditional t.Skip sites
2026-09-02	Test Parallelism Debt	Custom	Y	pkg/workflow 2.9% t.Parallel() adoption
2026-09-03	CLI Help Text Consistency	Custom	Y	19/20 examples hardcode "gh aw"
2026-09-04	Stale CLI Command References in Docs	Custom	Y	7 stale command references found
2026-09-07	Custom Go Linter CI Enablement Gap	Custom	Y	12/68 analyzers gapped from cgo.yml
2026-09-08	Slash-Command Trigger Centralization Gap	Custom	Y	2/65 workflows bypass central dispatcher
2026-09-09	Framework-Job Timeout Coverage Gap	Custom	Y	80/299 lock files missing job timeout
2026-09-10	Security Scan Pipeline Reliability	Standard	N	477 unsuppressed gosec findings, 41/41 failed runs
2026-09-11	Custom Go Linter CI Enablement Gap (Follow-up)	Reused	N	60 live findings across 3 still-gapped analyzers, confirmed via direct re-run

---

🎯 Recommendations

Immediate Actions (This Week)

1. Fix the 8 packagelevelmutableslicemap data-race-risk findings — Priority: High
2. Add manualpathconcat, packagelevelmutableslicemap, seenmapbool to cgo.yml's LINTER_FLAGS once remediated — Priority: High

Short-term Actions (This Month)

1. Resolve the 49 manualpathconcat findings — Priority: Medium
2. Convert the 3 seenmapbool sites to map[string]struct{} — Priority: Medium
3. Scope a phased enablement plan for errormessage -full-repo (3,176 findings) and largefunc (518 findings) — Priority: Medium

Long-term Actions (This Quarter)

1. Add an automated CI check that diffs pkg/linters/registry.go's All() against cgo.yml's LINTER_FLAGS so future analyzer additions can't silently bit-rot again — Priority: Low

---

📈 Success Metrics

• Gapped analyzers with zero findings enabled in CI: 0/3 → 3/3 (manualpathconcat, packagelevelmutableslicemap, seenmapbool)
• Live packagelevelmutableslicemap race-risk findings: 8 → 0
• Live manualpathconcat findings: 49 → 0
• Live seenmapbool findings: 3 → 0

---

Next Steps

1. Review and prioritise the tasks above
2. Assign tasks to Copilot coding agent via planner agent
3. Track progress on improvement items
4. Re-evaluate this focus area in 2 weeks to confirm the registry/CI drift stays closed, and to scope errormessage/largefunc phased enablement

---

Generated by Repository Quality Improvement Agent
Next analysis: 2026-09-12 — Focus area selected by diversity algorithm

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by ⚡ Repository Quality Improvement Agent · copilot · auto · 138.6 AIC · ⌖ 10.7 AIC · ⊞ 10K · ◷

• expires on Sep 12, 2026, 5:13 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-12T13:13:16.164Z.

Closed by Workflow