[lint-monster] Replace loop string concatenation hotspots and set-like bool maps

[github-actions]

Summary

Custom lint scan found 42 non-largefunc performance/style findings that mostly share one root cause: repeated string concatenation with += inside loops.

Breakdown:

• 41x += string-in-loop findings that should become strings.Builder usage
• 1x map-set allocation finding (map[string]bool used as a set)

Hotspots:

• pkg/workflow/checkout_config_parser.go — 10 findings
• pkg/cli/audit_report_render.go — 8 findings
• pkg/cli/bootstrap_config.go — 4 findings
• several smaller occurrences across pkg/workflow and pkg/cli
• pkg/actionpins/actionpins_internal_test.go:173 — replace map[string]bool set usage with map[string]struct{}

Representative diagnostics:

• pkg/workflow/checkout_config_parser.go:316 — string concatenation with += inside a loop allocates O(n2) bytes; use strings.Builder
• pkg/cli/audit_report_render.go — multiple repeated loop concatenation findings
• pkg/actionpins/actionpins_internal_test.go:173 — use map[string]struct{} for a set

Expected outcome

Convert loop-based string building to strings.Builder (or equivalent minimal fix) and update the one set-like map allocation pattern.

Remediation checklist

• Group edits by file and keep each change minimal.
• Prefer strings.Builder for loop-accumulated strings; preserve exact output.
• Replace map[string]bool set usage with map[string]struct{} where no boolean state is needed.
• Avoid touching any largefunc refactors in this issue.
• Validate with make golint-custom.

Generated by 🧌 LintMonster · gpt54 · 35.3 AIC · ⌖ 7.93 AIC · ⊞ 5.3K · ◷

• expires on Aug 5, 2026, 7:41 PM UTC-08:00