Description
Three safe-output config structs in pkg/workflow embed BaseSafeOutputConfig (which already has a GitHubToken field) but also hand-declare their own GitHubToken string field, verified at:
pkg/workflow/create_project.go:10 (CreateProjectsConfig)pkg/workflow/update_project.go:27 (presumed UpdateProjectConfig)pkg/workflow/create_project_status_update.go:12
Because Go field-shadowing makes the outer (hand-declared) field win, and each struct's parser calls parseBaseSafeOutputConfig (filling the embedded copy) and then separately re-parses "github-token" into the outer field (e.g. create_project.go:29-32), the embedded BaseSafeOutputConfig.GitHubToken is set but never read in all three structs. Currently harmless since both copies receive the same value, but it's dead code masking a latent divergence risk if either parse path is edited independently in the future (e.g. a future change to parseBaseSafeOutputConfig silently stops taking effect for these three outputs).
Expected Impact
Removes a latent divergence bug and ~3 lines of redundant per-struct parsing; aligns all three structs with the already-established BaseSafeOutputConfig DRY convention used elsewhere in the same package.
Suggested Agent
General refactor agent — delete the hand-declared GitHubToken field and its separate parse block in each of the 3 structs, relying solely on the embedded BaseSafeOutputConfig.GitHubToken; verify no external code references the field by its shadowed (outer) form specifically.
Estimated Effort
Quick (< 1 hour)
Data Source
DeepReport Intelligence Briefing 2026-08-12, mined from Typist Report #52283 (Cluster A finding, verified directly against source).
Generated by 🔬 Deep Report · agent · 198.4 AIC · ⌖ 54.5 AIC · ⊞ 11.4K · ◷
Description
Three safe-output config structs in
pkg/workflowembedBaseSafeOutputConfig(which already has aGitHubTokenfield) but also hand-declare their ownGitHubToken stringfield, verified at:pkg/workflow/create_project.go:10(CreateProjectsConfig)pkg/workflow/update_project.go:27(presumedUpdateProjectConfig)pkg/workflow/create_project_status_update.go:12Because Go field-shadowing makes the outer (hand-declared) field win, and each struct's parser calls
parseBaseSafeOutputConfig(filling the embedded copy) and then separately re-parses"github-token"into the outer field (e.g.create_project.go:29-32), the embeddedBaseSafeOutputConfig.GitHubTokenis set but never read in all three structs. Currently harmless since both copies receive the same value, but it's dead code masking a latent divergence risk if either parse path is edited independently in the future (e.g. a future change toparseBaseSafeOutputConfigsilently stops taking effect for these three outputs).Expected Impact
Removes a latent divergence bug and ~3 lines of redundant per-struct parsing; aligns all three structs with the already-established
BaseSafeOutputConfigDRY convention used elsewhere in the same package.Suggested Agent
General refactor agent — delete the hand-declared
GitHubTokenfield and its separate parse block in each of the 3 structs, relying solely on the embeddedBaseSafeOutputConfig.GitHubToken; verify no external code references the field by its shadowed (outer) form specifically.Estimated Effort
Quick (< 1 hour)
Data Source
DeepReport Intelligence Briefing 2026-08-12, mined from Typist Report #52283 (Cluster A finding, verified directly against source).