[linter] Code Quality Report - 2026-10-16 - 1059 issues found #69387

🔍 Super Linter Analysis Summary

Date: 2026-10-16
Total Issues Found: 1059
Run ID: 38911928603

Analysis Coverage

• Super-linter outcome: failure
• Tool/configuration failures: The workflow failed in the GO_MODULES stage, and the log includes repeated [runner/nolint_filter] Found unknown linters in (nolint/redacted) directives warnings. This is configuration/tooling noise, not a direct source defect. No explicit context-loading failure was observed in this run.
• Intentional fixture noise: The pkg/linters/*/testdata/ fixtures emit analyzer test-data diagnostics, which are intentionally excluded from production triage. These are scope regressions for fixtures and are not evidence of a production bug unless the analyzer contract is intentionally failing on its own test corpus.
• Real source findings: 1,059 unique (file, line, linter, message) diagnostics across 7 Go linters.
• Unavailable coverage: This workflow only validates Go modules; other file types are handled by separate CI jobs. No additional linter coverage beyond this Go-module pass was available in the reported run.

📁 Issues by Category

errcheck

• File: cmd/gh-aw/main.go
  • Line 112: Error return value of (*github.com/spf13/pflag.FlagSet).GetBool is not checked
  • Impact: Ignoring command-flag parsing errors can silently bypass version/force flags and produce inconsistent CLI behavior in real-world execution.
  • Suggested fix: Check the returned error from GetBool, GetString, GetInt, and Set calls and handle it explicitly or fail with a clear message.
• File: pkg/cli/audit_report_render.go
  • Line 788: filepath.Abs error ignored.
  • Impact: Failures to resolve output paths may be hidden, which compromises generated reports and debugging.
  • Suggested fix: Capture and log the Abs error or abort the operation when path normalization fails.
• File: pkg/parser/frontmatter_merge_test.go
  • Line 369: json.Marshal error ignored in tests.
  • Impact: Serialization failures in tests hide malformed payload generation and can mask regressions.
  • Suggested fix: Assert the marshal error in test setup or handle it with a fatal test failure.
• Remaining count: 165 unique diagnostics in errcheck.

goconst

• File: cmd/gh-aw/main.go
  • Line 621: string help repeated multiple times; linter recommends a constant.
  • Impact: Repeated literal strings increase maintenance risk and are easy to drift across help output paths.
  • Suggested fix: Extract repeated help-group strings into package constants or shared definitions.
• File: pkg/console/render.go
  • Line 189: string time.Time repeated in render logic.
  • Impact: Duplication of type labels may create inconsistent user-facing output during formatting changes.
  • Suggested fix: Centralize repeated literal labels into constants used by the renderer.
• File: pkg/workqueue/policy.go
  • Line 263: string IssueComment repeated in policy classification.
  • Impact: Repetition makes policy mapping harder to review and easier to accidentally diverge.
  • Suggested fix: Replace repeated strings with typed constants or enumerated values.
• Remaining count: 186 unique diagnostics in goconst.

gocritic

• File: cmd/gh-aw/main.go
  • Line 975: exitAfterDefer: os.Exit will exit, and defer stop() will not run
  • Impact: Cleanup may be skipped during shutdown, leaving temp state or resources behind in CLI error paths.
  • Suggested fix: Return an exit-code error instead of calling os.Exit directly, or ensure the shutdown hook runs before exit.
• File: pkg/cli/actionlint.go
  • Line 135: ifElseChain: rewrite if-else to switch statement
  • Impact: Hard-to-read branching can hide logic errors in actionlint configuration checks.
  • Suggested fix: Simplify the conditional chain into a switch or clearer predicate structure.
• File: pkg/cli/enable.go
  • Line 377: elseif: can replace else { if cond {} } with else if cond {}
  • Impact: While stylistic, nested branch forms make control flow harder to maintain and review.
  • Suggested fix: Flatten the conditional structure to prefer else if patterns.
• Remaining count: 96 unique diagnostics in gocritic.

gocyclo

• File: .github/scripts/purelock/purity_scan.go
  • Line 112: func main complexity 20 exceeds the threshold.
  • Impact: Complex entry-point logic is harder to reason about and more fragile when adding new audit rules.
  • Suggested fix: Split the top-level analyzer into helper functions or smaller stages with clear responsibilities.
• File: .github/scripts/purelock/purity_scan.go
  • Line 298: (*analyzer).inspect complexity 27 exceeds the threshold.
  • Impact: Large inspection code paths increase the chance of logic drift in AST classification.
  • Suggested fix: Decompose the inspection routine into focused helper calls for package selection, declaration analysis, and call classification.
• File: cmd/gh-aw/help_examples_test.go
  • Line 117: validateExampleTokens complexity 16 exceeds the threshold.
  • Impact: More complex tests are harder to validate and maintain when CLI help text changes.
  • Suggested fix: Split validation into smaller helpers for argument parsing, token resolution, and error reporting.
• Remaining count: 195 unique diagnostics in gocyclo.

gosec

• File: .github/scripts/purelock/purity_scan.go
  • Line 784: G306: Expect WriteFile permissions to be 0600 or less
  • Impact: Files created with broad write permissions can expose data to unintended local users on shared systems.
  • Suggested fix: Use 0600 or stricter permissions when writing temporary or generated files; keep the file mode explicit.
• File: .github/scripts/purelock/purity_scan.go
  • Line 804: G306 for a second write path.
  • Impact: Same as above: file-permission hygiene matters for generated audit artifacts and temporary data.
  • Suggested fix: Update both file write sites to 0600 and verify the output path is not world-readable.
• File: pkg/cli/work_command_replay.go
  • Line 319: G115: integer overflow conversion int64 -> uint64
  • Impact: This is a real conversion-safety complaint that should be reviewed in context before ignoring; it may be benign but must be checked rather than treated as a false positive.
  • Suggested fix: Validate the range before conversion or use a checked conversion path that preserves safety expectations.
• Remaining count: 41 unique diagnostics in gosec.

govet

• File: pkg/workflow/compiler_jobs.go
  • Line 550: shadow: declaration of "err" shadows declaration at line 535
  • Impact: Shadowed variables make control-flow analysis harder and can hide logic mistakes in job compilation.
  • Suggested fix: Rename inner variables or reuse the outer result explicitly to avoid shadowing.
• File: pkg/agentdrain/miner_test.go
  • Line 321: shadow: declaration of "err" shadows declaration at line 312
  • Impact: Hard-to-read tests can conceal actual failure modes and complicate debugging.
  • Suggested fix: Rename the inner error variable or restructure the nested block.
• File: pkg/workflow/schedule_preprocessing.go
  • Line 247: shadow: declaration of "ok" shadows declaration at line 234
  • Impact: Shadowing reduces clarity in scheduling logic and can conceal subtle behavior changes.
  • Suggested fix: Rename the inner ok binding or refactor conditional branches for clarity.
• Remaining count: 198 unique diagnostics in govet.

revive

• File: cmd/gh-aw/main.go
  • Line 105: unused-parameter: parameter 'cmd' seems to be unused
  • Impact: Unused parameters often signal dead code or hidden assumptions in CLI lifecycle hooks.
  • Suggested fix: Rename the parameter to _ or remove it if not needed.
• File: pkg/cli/model_routing.go
  • Line 331: redefines-builtin-id: redefinition of the built-in function copy
  • Impact: Naming collisions with built-ins reduce readability and can create subtle bugs during future refactors.
  • Suggested fix: Rename the function or variable to avoid shadowing built-in identifiers.
• File: pkg/console/render.go
  • Line 444: redefines-builtin-id: redefinition of the built-in function len
  • Impact: Builtin shadowing is easy to misread and may cause accidental logic errors during future changes.
  • Suggested fix: Use a distinct identifier such as length or count.
• Remaining count: 178 unique diagnostics in revive.

🎯 Priority Recommendations

1. Address the GO_MODULES failures first: gocyclo, gosec, and govet findings are the most likely to produce maintenance and safety issues in a CLI tool.
2. Review the gosec findings before ignoring them, especially the G115 conversion and file-permission issues; these merit check-by-call-site validation rather than blanket suppression.
3. Clean up the repeated errcheck and revive violations in the CLI entry points (cmd/gh-aw/main.go) because they affect runtime behavior and readability in the most user-visible code path.

Linter Evidence

The full log is retained in the private super-linter-log run artifact for seven days. Do not copy it into the issue.

🔗 References

• Link to workflow run
• Super Linter Documentation
• Project CI Configuration

Running Super Linter Locally

To validate your fixes locally before committing, run super-linter using Docker:

# Run super-linter with the same configuration as the workflow
docker run --rm   -e DEFAULT_BRANCH=main   -e RUN_LOCAL=true   -e VALIDATE_GO_MODULES=true   -e DEFAULT_WORKSPACE=/tmp/gh-aw/agent   -e 'FILTER_REGEX_EXCLUDE=(^|.*/)(super-linter-output/.*|pkg/linters/[^/]+/testdata(/.*|$)|[.]github/workflows/go[.]mod$)'   -v "$(pwd):/tmp/gh-aw/agent"   ghcr.io/super-linter/super-linter:v9

Note: The Docker command uses the same super-linter configuration as this workflow. Files are mounted from your current directory to /tmp/gh-aw/agent in the container.

Generated by 🔍 Super Linter Report · pi · mai11 · 5.61 AIC · ⌖ 0.662 AIC · ⊞ 8.1K · ◷

• expires on Oct 18, 2026, 6:17 AM UTC-08:00