refactor: semantic function clustering — dedup linter helpers, drop stub files, rename outliers

[Copilot]

Semantic analysis of pkg/ surfaced seven actionable cleanup categories: near-identical duplicated helpers across two linter packages, comment-only stub files, a misnamed validation file, stale doc-comment file lists, trivial wrapper duplicates, a same-name collision across packages, and a single-function util.go.

Shared linter helpers

Extracted pkg/linters/internal/nolint with three functions used identically by both errstringmatch and errormessage:

// Before: each linter had its own copy of these ~40 lines
func hasNoLintDirective(position token.Position, ...) bool { ... }
func buildNoLintLineIndex(pass *analysis.Pass) ... { ... }
func implementsError(t types.Type) bool { ... }

// After: single source of truth
nolint.HasDirective(pos, idx)
nolint.BuildLineIndex(pass, "errstringmatch")
nolint.ImplementsError(t)

Deleted 6 comment-only stub files

All contained zero Go declarations — only stale redirect comments:

• pkg/cli/{list_command,verify_command,compile_batch_operations,gateway_logs,run_command}.go
• pkg/workflow/scripts.go

Renamed update_check_validation.go → strict_mode_update_check_validation.go

Despite the update_* prefix, the file validates the check-for-updates: false strict-mode flag, not the safe-output update-entity cluster. Aligns with strict_mode_{permissions,network,env,steps,sandbox}_validation.go.

Fixed stale file-list comments

• validation.go: removed nonexistent bundler_* and gateway_validation.go entries; fixed expression_safety.go → expression_safety_validation.go
• strict_mode_validation.go: added missing steps, sandbox, and update_check variants to the sibling-file list

Inlined gitutil.IsValidFullSHA wrappers

Removed the two trivial 1-line wrappers in features_validation.go and actionpins.go; updated safe_outputs_actions.go to call gitutil.IsValidFullSHA directly.

Resolved resolveContainerDigest name collision

The same name existed in two packages with completely different semantics:

• pkg/cli/update_container_pins.go → fetchContainerDigest (queries Docker buildx / crane / docker pull)
• pkg/workflow/awf_helpers.go → lookupContainerDigest (pure pin-cache lookup, returns "" on miss)

Moved boolPtr into mcp_helpers.go; deleted util.go

pkg/cli/util.go was 4 lines with a single helper used only by MCP tool files. Moved to mcp_helpers.go — its natural home — and deleted the file.

[Copilot]

Pull request overview

Refactors and consolidates scattered helpers and stub files, adds strict-mode validation for check-for-updates, and resolves a few naming/collision inconsistencies uncovered by semantic clustering.

Changes:

• Extract shared nolint directive + error-interface helpers into pkg/linters/internal/nolint and update linters to use them.
• Add strict-mode policy validation (error in strict, warning otherwise) for check-for-updates: false, with tests and activation-job step coverage.
• Cleanup/housekeeping: delete comment-only stubs, rename digest helpers to avoid collisions, and inline trivial SHA-validation wrappers.

Show a summary per file

File	Description
pkg/workflow/validation.go	Updates the validator file-list comment to match current files.
pkg/workflow/strict_mode_validation.go	Updates strict-mode validator file-list comment to include new/omitted validators.
pkg/workflow/strict_mode_update_check_validation.go	Adds compiler validation enforcing strict-mode policy for check-for-updates: false.
pkg/workflow/strict_mode_update_check_validation_test.go	Adds unit + compile-output tests for the update-check policy and activation step inclusion.
pkg/workflow/scripts.go	Deletes a comment-only stub file.
pkg/workflow/safe_outputs_actions.go	Switches SHA detection to gitutil.IsValidFullSHA directly.
pkg/workflow/features_validation.go	Removes local SHA wrapper usage in favor of gitutil.IsValidFullSHA.
pkg/workflow/features_validation_test.go	Updates SHA-validation test to call gitutil.IsValidFullSHA directly.
pkg/workflow/awf_helpers.go	Renames digest lookup helper to avoid cross-package name collision.
pkg/linters/internal/nolint/nolint.go	Adds shared nolint directive indexing and error-interface helpers for linters.
pkg/linters/errstringmatch/errstringmatch.go	Uses shared nolint helpers; removes duplicated local implementations.
pkg/linters/errormessage/errormessage.go	Uses shared nolint helpers; removes duplicated local implementations.
pkg/cli/verify_command.go	Deletes a comment-only stub file.
pkg/cli/util.go	Deletes single-function util file after moving helper.
pkg/cli/update_container_pins.go	Renames digest resolver function to fetchContainerDigest for clarity/uniqueness.
pkg/cli/run_command.go	Deletes a comment-only stub file.
pkg/cli/mcp_helpers.go	Moves boolPtr helper here from deleted util file.
pkg/cli/list_command.go	Deletes a stub file containing only a package declaration.
pkg/cli/gateway_logs.go	Deletes a comment-only stub file.
pkg/cli/compile_batch_operations.go	Deletes a comment-only stub file.
pkg/actionpins/actionpins.go	Inlines SHA validation via gitutil.IsValidFullSHA (removes trivial wrapper).
.github/workflows/mcp-inspector.lock.yml	Updates Datadog header env-var mapping in the workflow lock file.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 20/22 changed files
• Comments generated: 2