Recognize deferred named recover helpers in goroutinemissingrecover

[Copilot]

goroutinemissingrecover only accepted a defer whose target is a function literal, so a goroutine deferring a named helper that calls recover() directly was flagged as unprotected — even though the Go spec counts any function called directly by defer as a valid recovery point.

func recoverAndLog() {
	if r := recover(); r != nil {
		log.Printf("recovered: %v", r)
	}
}

go func() {
	defer recoverAndLog() // was flagged; now accepted
	risky()
}()

Changes

• hasTopLevelRecoverDefer: when the deferred target is not an *ast.FuncLit, resolve it to a *types.Func and run the existing containsRecoverCall check against its body.
• resolveFuncBody (new): resolves *ast.Ident via TypesInfo.Uses, methods via TypesInfo.Selections, and unwraps generic instantiations (f[T], f[T1, T2]). Returns false for anything not statically resolvable.
• indexFuncBodies (new): one pass over pass.Files building *types.Func → body (keyed by Origin() so generic instantiations map back to the declaration).
• Unchanged conservatism: func-valued variables, out-of-package targets, and recover() buried in a nested closure inside the helper are still flagged.
• Package doc: notes that a deferred named function/method qualifies.

Test fixtures

Added to testdata/src/a/a.go: named helper with recover() and method with recover() (no diagnostic); named helper without recover(), deferred func value, and helper whose recover() is nested in a closure (still flagged).

Note: the fixture package reports pre-existing unused lint findings (every fixture function, old and new, is unreferenced); these are not introduced here.

• Fixes goroutinemissingrecover: defer of a named recover-helper function is misreported as "missing recover" #50763

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

[github-actions]

❌ Design Decision Gate 🏗️ failed during design decision gate check.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

[Copilot]

🟡 Changes recommended

The analyzer can incorrectly accept helpers where recover() executes through a nested go or defer statement.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Extends goroutinemissingrecover to recognize same-package named recovery helpers and methods.

Changes:

• Resolves deferred named functions, methods, and generic instantiations.
• Indexes function bodies for recovery analysis.
• Adds positive and conservative negative fixtures.

File summaries

File	Description
goroutinemissingrecover.go	Implements named-helper resolution and analysis.
testdata/src/a/a.go	Adds named-helper and method fixtures.

Review details

Suppressed comments (1)

pkg/linters/goroutinemissingrecover/goroutinemissingrecover.go:178

• The new generic-instantiation paths are not exercised by the fixture: all added accepted calls are non-generic. Please add cases for defer helper[T]() (and preferably a generic-receiver method) so the IndexExpr/IndexListExpr unwrapping and Origin() lookup cannot regress unnoticed.

	case *ast.IndexExpr:
		// Explicit instantiation of a generic function: f[T].
		return resolveFuncBody(unwrapParens(target.X), typesInfo, funcBodies)
	case *ast.IndexListExpr:
		return resolveFuncBody(unwrapParens(target.X), typesInfo, funcBodies)

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[github-actions]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 32 AIC · ⊞ 7.1K
_{Comment /matt to run again}

[github-actions]

[/tdd] The *ast.IndexExpr and *ast.IndexListExpr branches (generic function instantiations like defer f[T]()) are not covered by any test fixture — a regression here would go undetected.

💡 Suggested test fixture

Add to testdata/src/a/a.go:

func genericRecoverHelper[T any]() {
	if r := recover(); r != nil {
		_ = r
	}
}

func genericRecoverDeferGoroutine() {
	go func() {
		defer genericRecoverHelper[int]()
		panic("oops")
	}()
}

Include a parallel case without recover() to cover the negative path too.

@copilot please address this.

[pelikhan]

@copilot merge main and recompile

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.0