Enforce-readiness: 5 unenforced linters (writebytestring, lenstringsplit, stringreplaceminusone, osgetenvlibrary, ossetenvlibrar [Content truncated due to length]

[github-actions]

Summary

Five registered custom analyzers are absent from the CI LINTER_FLAGS gate (.github/workflows/cgo.yml:1362/1365) but are clean against the current codebase (./cmd/... ./pkg/..., default build). All five should be promoted to enforced, following the same pattern as the last enforce-readiness batches (#47916, #46341, #45629, #45186).

Evidence

writebytestring

• 43rd linter added at R60; the autofix compile-correctness bug (io.WriteString on named string types, writebytestring (new 43rd linter): autofix emits non-compiling io.WriteString(w, s) for named string types + missing RunWithSugg [Content truncated due to length] #44187/writebytestring autofix references io.WriteString but never adds the "io" import — non-compiling fix when the file doesn't alrea [Content truncated due to length] #44653/Autofix import robustness: sprintfint/writebytestring/bytescomparestring key import-presence on the path but emit a hardcoded pa [Content truncated due to length] #45037) is confirmed fixed in pkg/linters/writebytestring/writebytestring.go: isExactString gates on *types.Basic vs *types.Named and buildStringExpr wraps named-string args in string(...) before emitting the fix.
• Grep of w.Write([]byte( across pkg/ (non-test) returns zero production hits — only testdata/ and doc-comment matches.

lenstringsplit

• Grep of len(strings.Split( across pkg/ (non-test) returns zero production hits — only testdata/ and the doc.go bullet.
• The prior false-positive bug on empty raw-string separators (lenstringsplit: empty raw-string separator (``) escapes the non-empty guard — false positive + semantically-wrong autofix #41163) is reflected as fixed in current testdata (empty/backtick-empty separators are not flagged).

stringreplaceminusone

• Grep of strings.Replace( across pkg/ (non-test) finds 13 production call sites, but every one passes an explicit n=1 (intentional single-replacement), not n=-1. The only -1 occurrence in non-test code is inside the linter's own doc comment (pkg/linters/stringreplaceminusone/stringreplaceminusone.go:102).
• Zero production violations of the actual strings.Replace(s, old, new, -1) → strings.ReplaceAll pattern.

osgetenvlibrary / ossetenvlibrary

• osgetenvlibrary excludes main//cmd/ packages via pass.Pkg.Path() and resolves the callee through astutil.CalledOSFunc (type-resolved: fn.Pkg().Path() != "os", not syntactic name-matching — no IsPkgSelector-class bug here).
• 10 production call sites exist across pkg/logger, pkg/envutil, pkg/constants, pkg/parser, pkg/github, pkg/console — every single one already carries //nolint:osgetenvlibrary, i.e. deliberately-suppressed process-boundary env reads (e.g. DEBUG, ACCESSIBLE, NO_COLOR).
• os.Setenv( has zero call sites anywhere in pkg/ outside pkg/cli/pkg/linters — ossetenvlibrary has nothing to flag at all in its scope.
• Zero unsuppressed production violations for both.

Recommendation

Add all five flags to both LINTER_FLAGS invocations in .github/workflows/cgo.yml (line 1362 default-build gate, line 1365 GOOS=js GOARCH=wasm gate):

-writebytestring -lenstringsplit -stringreplaceminusone -osgetenvlibrary -ossetenvlibrary

Validation checklist

• make golint-custom LINTER_FLAGS="-writebytestring -lenstringsplit -stringreplaceminusone -osgetenvlibrary -ossetenvlibrary -test=false" reports zero findings on ./cmd/... ./pkg/...
• Same command under GOOS=js GOARCH=wasm with LINTER_PACKAGES="./pkg/console ./pkg/parser ./pkg/styles ./pkg/tty ./pkg/workflow" reports zero findings
• Add the five flags to both cgo.yml LINTER_FLAGS lines

Effort

Trivial — CI config change only, no source changes required.

Generated by 🤖 Sergo - Serena Go Expert · agent · 177.3 AIC · ⌖ 6.07 AIC · ⊞ 6K · ◷

• expires on Aug 7, 2026, 9:03 PM UTC-08:00