Enforce-readiness: contextcancelnotdeferred + wgdonenotdeferred are clean, type/AST-resolved, zero production violations

[github-actions]

Summary

Two custom analyzers are registered in pkg/linters (60 total, pkg/linters/registry.go) but are not in the CI enforcement flag list (.github/workflows/cgo.yml:1362/1365, LINTER_FLAGS). Both were manually audited this run against their known bug classes (syntactic stdlib-package matching, FuncLit scope-boundary crossing, test-file false positives) and found clean, with zero real production violations under the current tree.

1. contextcancelnotdeferred (pkg/linters/contextcancelnotdeferred/contextcancelnotdeferred.go)

• Correctly type-resolved: uses astutil.IsPkgSelector(pass, sel, "context") (contextcancelnotdeferred.go:152), not a raw ident.Name == "context" string match — immune to the syntactic-match regression class fixed in Linter precision (regression): the syntactic stdlib-package-match migration never landed — 5 holdouts remain, 3 CI-enforced (#40 [Content truncated due to length] #43934.
• Correctly bounded at FuncLit: inspectCancelNode returns false on *ast.FuncLit (line 90-92), so a cancel func stored/returned from an enclosing FuncDecl and later invoked inside a closure is never mis-attributed — immune to the class fixed in timesleepnocontext: enclosing-scope walk crosses arbitrary FuncLit boundaries — false positives + misleading fix for request/cal [Content truncated due to length] #42901/execcommandwithoutcontext: enclosing-scope walk crosses non-go/defer FuncLit boundaries — false positives + misleading fix (same [Content truncated due to length] #43683.
• Correctly skips test and generated files via filecheck.ShouldSkipFilename (line 64), which internally checks IsTestFile — the common idiom of ctx, cancel := context.WithCancel(...); cancel() (cancel-immediately, used throughout *_test.go for cancellation tests) is filtered out at the file level, not just a lucky miss.
• Reviewed every non-test, non-testdata production call site (grep -rn 'context.With(Cancel|Timeout|Deadline)(' pkg --include=*.go, ~20 sites across pkg/cli, pkg/workflow, pkg/modelsdev): every site either defers cancel immediately (e.g. actionlint.go:185-186, mcp_validation.go:188-189, update_container_pins.go:316-317/335-336/354-355/360-361, mcp_inspect_mcp.go x6, action_resolver.go x3, repository_features_validation.go x2, docker_validation.go:75-76, copilot_billing_check.go:26-27, codemod_workflow_run_branches.go:26-27, mcp_permissions.go:105-106, forecast.go:34-35, bootstrap_profile_github_app.go:226-227, safe_outputs_actions.go:302-303) or intentionally returns the context.CancelFunc to the caller for external lifecycle management (update_check.go:258 CheckForUpdatesAsync, logs_orchestrator_download.go:156 buildLogsDownloadContext, mcp_tools_privileged.go:73,301 newMCPSubprocessContext) — the linter's hasDirectCancel tracking correctly stays false for the latter pattern since the cancel object is never called via a bare ExprStmt in the analyzed scope, so no false positive is possible there either.

2. wgdonenotdeferred (pkg/linters/wgdonenotdeferred/wgdonenotdeferred.go)

• The FuncLit-boundary-crossing bug for goroutines launched inside loops was already fixed (wgdonenotdeferred precision: non-deferred wg.Done() inside a goroutine launched in a loop escapes detection (FuncLit scope bound [Content truncated due to length] #40947); confirmed the fix is intact.
• Only two production sync.WaitGroup.Done() call sites exist in the whole tree (excluding ctx.Done() channel receives, a different API): pkg/console/spinner.go:193 (defer s.wg.Done()) and pkg/cli/forecast_compute.go:233 (defer wg.Done()) — both already deferred. Zero violations.

Recommendation

Add both -contextcancelnotdeferred and -wgdonenotdeferred to the LINTER_FLAGS string in the make golint-custom invocation in .github/workflows/cgo.yml:1362 (production-code gate). wgdonenotdeferred's only prod hit outside pkg/cli is in pkg/console, which is inside the wasm-scoped LINTER_PACKAGES list at cgo.yml:1365, so add it there too; contextcancelnotdeferred's hits (pkg/cli, pkg/workflow, pkg/modelsdev) don't intersect that list.

Validation checklist

• Add -contextcancelnotdeferred -wgdonenotdeferred to cgo.yml:1362 LINTER_FLAGS
• Add -wgdonenotdeferred to cgo.yml:1365 LINTER_FLAGS (pkg/console is in its LINTER_PACKAGES)
• Run make golint-custom locally with the new flags against ./... and confirm zero findings

Effort

Small — CI config change only, no linter code changes required.

Context

Not itself a bug, but background for this finding: the analyzer registry has grown from 43 (last recorded snapshot) to 60 analyzers and moved from direct instantiation in cmd/linters/main.go to a canonical linters.All() in pkg/linters/registry.go. Of the 60 registered analyzers, 33 are currently enforced in CI; this issue proposes 2 more, bringing it to 35.

Generated by 🤖 Sergo - Serena Go Expert · agent · 244.4 AIC · ⌖ 14.4 AIC · ⊞ 6K · ◷

• expires on Aug 8, 2026, 9:05 PM UTC-08:00