Description
The custom httpnoctx linter only intercepts the .Get/.Head/.Post/.PostForm helpers; it has 0% coverage of the http.NewRequest(...) + client.Do(req) pattern. That blind spot is exactly why the three context-free fallback calls in pkg/parser/remote_fetch.go and pkg/cli/update_workflows.go (see companion issue) were never flagged. Extend the linter to also flag http.NewRequest calls (vs http.NewRequestWithContext) in functions that have a context.Context in scope, and/or client.Do on a timeout-less client.
Expected Impact
Closes the detection gap so future context/timeout regressions on the NewRequest + Do path are caught at lint time rather than by a daily audit weeks later.
Suggested Agent
Static Analysis / Copilot SWE Agent.
Estimated Effort
Medium (1-4 hours).
Data Source
DeepReport 2026-06-30; repository-quality report #42486.
Generated by 🔬 Deep Report · 204.7 AIC · ⌖ 16.9 AIC · ⊞ 10.2K · ◷
Description
The custom
httpnoctxlinter only intercepts the.Get/.Head/.Post/.PostFormhelpers; it has 0% coverage of thehttp.NewRequest(...) + client.Do(req)pattern. That blind spot is exactly why the three context-free fallback calls inpkg/parser/remote_fetch.goandpkg/cli/update_workflows.go(see companion issue) were never flagged. Extend the linter to also flaghttp.NewRequestcalls (vshttp.NewRequestWithContext) in functions that have acontext.Contextin scope, and/orclient.Doon a timeout-less client.Expected Impact
Closes the detection gap so future context/timeout regressions on the
NewRequest + Dopath are caught at lint time rather than by a daily audit weeks later.Suggested Agent
Static Analysis / Copilot SWE Agent.
Estimated Effort
Medium (1-4 hours).
Data Source
DeepReport 2026-06-30; repository-quality report #42486.