fix: Propagate app taints to the apps importers

[martinnaj]

Risk: low

Summary by CodeRabbit

• Bug Fixes

  • Improved taint propagation for affected applications by seeding taint across all entrypoint export symbols.
  • Ensures downstream consumers correctly detect tainted symbols through intermediate application boundaries, including dynamic and side-effect imports.
  • Side-effect-only entrypoints that export nothing now correctly trigger whole-package taint handling.

• Chores

  • Updated the release version to 0.24.1.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9a194bc7-d23c-4ae2-9e01-a9c5ee1125aa

📥 Commits

Reviewing files that changed from the base of the PR and between 6706672 and 914f708.

📒 Files selected for processing (3)

• CHANGELOG.md
• VERSION
• main.go

---

📝 Walkthrough

Walkthrough

App analysis now seeds taint for every export from each app entrypoint, including whole-package taint for side-effect-only entrypoints. Release metadata is updated to version 0.24.1.

Changes

App taint propagation

Layer / File(s)	Summary
Seed app entrypoint exports main.go, VERSION, CHANGELOG.md	Non-library apps collect entrypoint exports, seed corresponding names into allUpstreamTaint, use "*" for empty exports, log the total, and document the 0.24.1 fix.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit traced each export bright,
And planted taint from day to night.
Through app and stream the symbols hop,
Side effects join the carrot plot.
Version leaves a trail.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: propagating app taints to downstream importers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@main.go`:
- Around line 303-309: Update the taint propagation around
CollectEntrypointExports so an entrypoint with len(exports) == 0 seeds the
existing wildcard/whole-app marker in allUpstreamTaint rather than an empty set;
preserve per-export tainting for non-empty results, and add a regression test
covering bare or dynamic imports of a side-effect-only affected entrypoint.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e6b48b1c-0ee7-41c3-9e9d-338b091162c3

📥 Commits

Reviewing files that changed from the base of the PR and between dcf7086 and 6706672.

📒 Files selected for processing (3)

• CHANGELOG.md
• VERSION
• main.go