From 17b47358a74051eaf6c8398a35222e1f6735dfd2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 7 Jul 2026 18:29:19 +0000
Subject: [PATCH 1/2] Initial plan


From d2a7eb007808b0c9db011fcd6a58ff96abb0710d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 7 Jul 2026 18:43:25 +0000
Subject: [PATCH 2/2] Add rationale to osgetenvlibrary suppressions

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/cli/add_interactive_orchestrator.go |  4 ++--
 pkg/cli/add_interactive_workflow.go     |  2 +-
 pkg/cli/add_wizard_command.go           |  2 +-
 pkg/cli/ci.go                           |  2 +-
 pkg/cli/codespace.go                    |  2 +-
 pkg/cli/compile_orchestrator.go         |  2 +-
 pkg/cli/compile_update_check.go         |  2 +-
 pkg/cli/engine_secrets.go               | 10 +++++-----
 pkg/cli/import_url_fetcher.go           |  2 +-
 pkg/cli/init.go                         |  4 ++--
 pkg/cli/interactive.go                  |  2 +-
 pkg/cli/logs_command.go                 |  2 +-
 pkg/cli/mcp_repository.go               |  2 +-
 pkg/cli/mcp_server_command.go           |  2 +-
 pkg/cli/mcp_tools_privileged.go         |  2 +-
 pkg/cli/mcp_validation.go               |  4 ++--
 pkg/cli/secret_set_command.go           |  2 +-
 pkg/cli/secrets.go                      |  2 +-
 pkg/cli/shell_completion.go             | 12 ++++++------
 pkg/cli/update_check.go                 |  2 +-
 pkg/console/accessibility.go            |  6 +++---
 pkg/constants/constants.go              |  2 +-
 pkg/envutil/envutil.go                  |  2 +-
 pkg/github/label_objective_mapping.go   |  2 +-
 pkg/logger/logger.go                    |  6 +++---
 pkg/parser/github.go                    |  6 +++---
 pkg/workflow/process_env_lookup.go      |  2 +-
 27 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/pkg/cli/add_interactive_orchestrator.go b/pkg/cli/add_interactive_orchestrator.go
index 8e22194c7ab..d610d4f5496 100644
--- a/pkg/cli/add_interactive_orchestrator.go
+++ b/pkg/cli/add_interactive_orchestrator.go
@@ -71,7 +71,7 @@ func RunAddInteractive(ctx context.Context, config *AddInteractiveConfig) error
 	addInteractiveLog.Print("Starting interactive add workflow")
 
 	// Assert this function is not running in automated unit tests or CI
-	if os.Getenv("GO_TEST_MODE") == "true" || os.Getenv("CI") != "" { //nolint:osgetenvlibrary
+	if os.Getenv("GO_TEST_MODE") == "true" || os.Getenv("CI") != "" { //nolint:osgetenvlibrary // interactive guards intentionally honor test and CI process-env markers.
 		return errors.New("interactive add cannot be used in automated tests or CI environments")
 	}
 
@@ -79,7 +79,7 @@ func RunAddInteractive(ctx context.Context, config *AddInteractiveConfig) error
 	config.Ctx = ctx
 
 	// Auto-detect GHES host from git remote if not already set
-	if os.Getenv("GH_HOST") == "" { //nolint:osgetenvlibrary
+	if os.Getenv("GH_HOST") == "" { //nolint:osgetenvlibrary // auto-detection only applies when the gh CLI host env is absent.
 		detectedHost := getHostFromOriginRemote()
 		if detectedHost != "github.com" {
 			addInteractiveLog.Printf("Auto-detected GHES host from git remote: %s", detectedHost)
diff --git a/pkg/cli/add_interactive_workflow.go b/pkg/cli/add_interactive_workflow.go
index 3d21d45448a..f302166eb0e 100644
--- a/pkg/cli/add_interactive_workflow.go
+++ b/pkg/cli/add_interactive_workflow.go
@@ -87,7 +87,7 @@ func (c *AddInteractiveConfig) checkStatusAndOfferRun(ctx context.Context) error
 	}
 
 	// In Codespaces, don't offer to trigger - provide link to Actions page instead
-	if os.Getenv("CODESPACES") == "true" { //nolint:osgetenvlibrary
+	if os.Getenv("CODESPACES") == "true" { //nolint:osgetenvlibrary // Codespaces UX detection intentionally uses GitHub's runtime env marker.
 		addInteractiveLog.Print("Running in Codespaces, skipping run offer and showing Actions link")
 		fmt.Fprintln(os.Stderr, "")
 		fmt.Fprintln(os.Stderr, console.FormatInfoMessage("Running in GitHub Codespaces - please trigger the workflow manually from the Actions page"))
diff --git a/pkg/cli/add_wizard_command.go b/pkg/cli/add_wizard_command.go
index 07fc827cce6..8d627876a6a 100644
--- a/pkg/cli/add_wizard_command.go
+++ b/pkg/cli/add_wizard_command.go
@@ -84,7 +84,7 @@ Note: To create a new workflow from scratch, use the 'new' command instead.`,
 
 			// add-wizard requires an interactive terminal
 			isTerminal := tty.IsStdoutTerminal()
-			isCIEnv := os.Getenv("CI") != "" //nolint:osgetenvlibrary
+			isCIEnv := os.Getenv("CI") != "" //nolint:osgetenvlibrary // wizard interactivity intentionally checks the standard CI environment marker.
 			addWizardLog.Printf("Terminal check: is_terminal=%v, is_ci=%v", isTerminal, isCIEnv)
 			if !isTerminal || isCIEnv {
 				return errors.New("add-wizard requires an interactive terminal; use 'add' for non-interactive environments")
diff --git a/pkg/cli/ci.go b/pkg/cli/ci.go
index 367d69eea9b..353cb0cdc66 100644
--- a/pkg/cli/ci.go
+++ b/pkg/cli/ci.go
@@ -18,7 +18,7 @@ func IsRunningInCI() bool {
 	}
 
 	for _, v := range ciVars {
-		if os.Getenv(v) != "" { //nolint:osgetenvlibrary
+		if os.Getenv(v) != "" { //nolint:osgetenvlibrary // CI detection intentionally checks conventional process-env markers.
 			ciLog.Printf("CI environment detected via %s", v)
 			return true
 		}
diff --git a/pkg/cli/codespace.go b/pkg/cli/codespace.go
index 5794a49121a..4f5d331882a 100644
--- a/pkg/cli/codespace.go
+++ b/pkg/cli/codespace.go
@@ -14,7 +14,7 @@ var codespaceLog = logger.New("cli:codespace")
 // by checking for the CODESPACES environment variable
 func isRunningInCodespace() bool {
 	// GitHub Codespaces sets CODESPACES=true environment variable
-	isCodespace := strings.EqualFold(os.Getenv("CODESPACES"), "true") //nolint:osgetenvlibrary
+	isCodespace := strings.EqualFold(os.Getenv("CODESPACES"), "true") //nolint:osgetenvlibrary // Codespaces detection intentionally uses GitHub's runtime env marker.
 	codespaceLog.Printf("Codespace detection: is_codespace=%v", isCodespace)
 	return isCodespace
 }
diff --git a/pkg/cli/compile_orchestrator.go b/pkg/cli/compile_orchestrator.go
index 411afcae16e..4b29aa844ab 100644
--- a/pkg/cli/compile_orchestrator.go
+++ b/pkg/cli/compile_orchestrator.go
@@ -27,7 +27,7 @@ func CompileWorkflows(ctx context.Context, config CompileConfig) ([]*workflow.Wo
 	default:
 	}
 
-	if os.Getenv("GH_HOST") == "" { //nolint:osgetenvlibrary
+	if os.Getenv("GH_HOST") == "" { //nolint:osgetenvlibrary // auto-detection only applies when the gh CLI host env is absent.
 		if detectedHost := getHostFromOriginRemote(); detectedHost != "github.com" && detectedHost != "" {
 			compileOrchestratorLog.Printf("Auto-detected GHES host from git remote: %s", detectedHost)
 			workflow.SetDefaultGHHost(detectedHost)
diff --git a/pkg/cli/compile_update_check.go b/pkg/cli/compile_update_check.go
index 166ac280421..a73f41d01bd 100644
--- a/pkg/cli/compile_update_check.go
+++ b/pkg/cli/compile_update_check.go
@@ -108,7 +108,7 @@ func shouldRunCompileUpdateCheck(noCheckUpdate bool) bool {
 		compileUpdateCheckLog.Print("Update check disabled via --no-check-update flag")
 		return false
 	}
-	if os.Getenv(compileUpdateCheckDisableEnv) != "" { //nolint:osgetenvlibrary
+	if os.Getenv(compileUpdateCheckDisableEnv) != "" { //nolint:osgetenvlibrary // update checks intentionally support an env-based opt-out for automation.
 		compileUpdateCheckLog.Printf("Update check disabled via %s", compileUpdateCheckDisableEnv)
 		return false
 	}
diff --git a/pkg/cli/engine_secrets.go b/pkg/cli/engine_secrets.go
index 922cecb1bce..45ac387b847 100644
--- a/pkg/cli/engine_secrets.go
+++ b/pkg/cli/engine_secrets.go
@@ -231,11 +231,11 @@ func ensureSecretAvailable(req SecretRequirement, config EngineSecretConfig) err
 	}
 
 	// Check environment variable
-	envValue := os.Getenv(req.Name) //nolint:osgetenvlibrary
+	envValue := os.Getenv(req.Name) //nolint:osgetenvlibrary // secret setup intentionally checks inherited env values before prompting or uploading.
 	if envValue == "" {
 		// Check alternative environment variables
 		for _, alt := range req.AlternativeEnvVars {
-			envValue = os.Getenv(alt) //nolint:osgetenvlibrary
+			envValue = os.Getenv(alt) //nolint:osgetenvlibrary // secret setup intentionally checks inherited env aliases before prompting or uploading.
 			if envValue != "" {
 				engineSecretsLog.Printf("Found secret in alternative env var: %s", alt)
 				break
@@ -439,7 +439,7 @@ func checkOptionalSecret(req SecretRequirement, config EngineSecretConfig) error
 	}
 
 	// Check environment
-	if os.Getenv(req.Name) != "" { //nolint:osgetenvlibrary
+	if os.Getenv(req.Name) != "" { //nolint:osgetenvlibrary // optional secret discovery intentionally checks inherited env values.
 		if config.Verbose {
 			fmt.Fprintln(os.Stderr, console.FormatInfoMessage(fmt.Sprintf("Optional secret %s found in environment", req.Name)))
 		}
@@ -552,11 +552,11 @@ func GetEngineSecretNameAndValue(engine string, existingSecrets map[string]struc
 		envVar = opt.EnvVarName
 	}
 
-	value := os.Getenv(envVar) //nolint:osgetenvlibrary
+	value := os.Getenv(envVar) //nolint:osgetenvlibrary // engine secret export intentionally reads inherited env values for upload.
 	if value == "" {
 		// Check alternative environment variables
 		for _, alt := range opt.AlternativeSecrets {
-			value = os.Getenv(alt) //nolint:osgetenvlibrary
+			value = os.Getenv(alt) //nolint:osgetenvlibrary // engine secret export intentionally reads inherited env aliases for upload.
 			if value != "" {
 				engineSecretsLog.Printf("Found secret in alternative env var: %s", alt)
 				break
diff --git a/pkg/cli/import_url_fetcher.go b/pkg/cli/import_url_fetcher.go
index 6a09e6744a0..916d2d49dbc 100644
--- a/pkg/cli/import_url_fetcher.go
+++ b/pkg/cli/import_url_fetcher.go
@@ -305,7 +305,7 @@ func logResponseBodyVerbose(resp *http.Response) {
 }
 
 func importAuthGHHost() string {
-	ghHost := os.Getenv("GH_HOST") //nolint:osgetenvlibrary
+	ghHost := os.Getenv("GH_HOST") //nolint:osgetenvlibrary // import auth intentionally follows the gh CLI host environment.
 	if ghHost == "" {
 		return ""
 	}
diff --git a/pkg/cli/init.go b/pkg/cli/init.go
index 9f939ef37cc..e2ef567ab2e 100644
--- a/pkg/cli/init.go
+++ b/pkg/cli/init.go
@@ -338,7 +338,7 @@ func isGHESHost(host string) bool {
 //  3. The hostname extracted from the git origin remote URL
 func detectGHESDeployment() string {
 	// Check GITHUB_SERVER_URL first (set inside GitHub Actions runners)
-	if serverURL := os.Getenv("GITHUB_SERVER_URL"); serverURL != "" { //nolint:osgetenvlibrary
+	if serverURL := os.Getenv("GITHUB_SERVER_URL"); serverURL != "" { //nolint:osgetenvlibrary // GHES detection intentionally trusts GitHub Actions server env hints.
 		// serverURL is like "https://ghes.example.com", extract just the host.
 		host := serverURL
 		for _, scheme := range []string{"https://", "http://"} {
@@ -352,7 +352,7 @@ func detectGHESDeployment() string {
 	}
 
 	// Check GH_HOST (set when using the gh CLI against an enterprise instance)
-	if ghHost := os.Getenv("GH_HOST"); ghHost != "" { //nolint:osgetenvlibrary
+	if ghHost := os.Getenv("GH_HOST"); ghHost != "" { //nolint:osgetenvlibrary // GHES detection intentionally honors the gh CLI host environment.
 		if isGHESHost(ghHost) {
 			initLog.Printf("Detected GHES deployment from GH_HOST: %s", ghHost)
 			return ghHost
diff --git a/pkg/cli/interactive.go b/pkg/cli/interactive.go
index c4b967a2b76..118bccb1be2 100644
--- a/pkg/cli/interactive.go
+++ b/pkg/cli/interactive.go
@@ -64,7 +64,7 @@ func CreateWorkflowInteractively(ctx context.Context, workflowName string, verbo
 	interactiveLog.Printf("Starting interactive workflow creation: workflowName=%s, force=%v", workflowName, force)
 
 	// Assert this function is not running in automated unit tests
-	if os.Getenv("GO_TEST_MODE") == "true" || os.Getenv("CI") != "" { //nolint:osgetenvlibrary
+	if os.Getenv("GO_TEST_MODE") == "true" || os.Getenv("CI") != "" { //nolint:osgetenvlibrary // interactive guards intentionally honor test and CI process-env markers.
 		return errors.New("interactive workflow creation cannot be used in automated tests or CI environments")
 	}
 
diff --git a/pkg/cli/logs_command.go b/pkg/cli/logs_command.go
index d18bd832a04..caaa8a1588b 100644
--- a/pkg/cli/logs_command.go
+++ b/pkg/cli/logs_command.go
@@ -452,7 +452,7 @@ func repoIsLocal(repo string) bool {
 	ownerRepo, _ := repoutil.NormalizeRepoForAPI(repo)
 
 	// Fast path: GITHUB_REPOSITORY is always the current repo in MCP server containers.
-	if envRepo := os.Getenv("GITHUB_REPOSITORY"); envRepo != "" { //nolint:osgetenvlibrary
+	if envRepo := os.Getenv("GITHUB_REPOSITORY"); envRepo != "" { //nolint:osgetenvlibrary // MCP containers intentionally trust GitHub's repository env for fast-path matching.
 		return strings.EqualFold(ownerRepo, envRepo)
 	}
 
diff --git a/pkg/cli/mcp_repository.go b/pkg/cli/mcp_repository.go
index 7a5c258c56c..aa6e533babf 100644
--- a/pkg/cli/mcp_repository.go
+++ b/pkg/cli/mcp_repository.go
@@ -21,7 +21,7 @@ func getRepository(ctx context.Context) (string, error) {
 	}
 
 	// Try GITHUB_REPOSITORY environment variable first
-	repo := os.Getenv("GITHUB_REPOSITORY") //nolint:osgetenvlibrary
+	repo := os.Getenv("GITHUB_REPOSITORY") //nolint:osgetenvlibrary // MCP repository resolution intentionally prefers GitHub's runtime env.
 	if repo != "" {
 		mcpLog.Printf("Got repository from GITHUB_REPOSITORY: %s", repo)
 		mcpCache.SetRepo(repo)
diff --git a/pkg/cli/mcp_server_command.go b/pkg/cli/mcp_server_command.go
index d712aa38aba..6c746337aa7 100644
--- a/pkg/cli/mcp_server_command.go
+++ b/pkg/cli/mcp_server_command.go
@@ -72,7 +72,7 @@ func runMCPServer(ctx context.Context, port int, cmdPath string, validateActor b
 	mcpServerEnv := withNonInteractiveCIEnv(nil)
 
 	// Get actor from environment variable
-	actor := os.Getenv("GITHUB_ACTOR") //nolint:osgetenvlibrary
+	actor := os.Getenv("GITHUB_ACTOR") //nolint:osgetenvlibrary // actor validation intentionally uses the GitHub Actions runtime environment.
 
 	if validateActor {
 		mcpLog.Printf("Actor validation enabled (--validate-actor flag)")
diff --git a/pkg/cli/mcp_tools_privileged.go b/pkg/cli/mcp_tools_privileged.go
index a8c59175494..b5485bf4e9a 100644
--- a/pkg/cli/mcp_tools_privileged.go
+++ b/pkg/cli/mcp_tools_privileged.go
@@ -28,7 +28,7 @@ const (
 // GITHUB_REPOSITORY is forwarded to the agentic-workflows MCP server container via
 // env_vars in the MCP configuration and inherited by spawned subprocesses.
 func appendRepoFlagFromEnv(args []string) []string {
-	if repo := os.Getenv("GITHUB_REPOSITORY"); repo != "" { //nolint:osgetenvlibrary
+	if repo := os.Getenv("GITHUB_REPOSITORY"); repo != "" { //nolint:osgetenvlibrary // privileged MCP tools intentionally inherit the GitHub repository env.
 		return append(args, "--repo", repo)
 	}
 	return args
diff --git a/pkg/cli/mcp_validation.go b/pkg/cli/mcp_validation.go
index 05c46c8ec91..db7137400fb 100644
--- a/pkg/cli/mcp_validation.go
+++ b/pkg/cli/mcp_validation.go
@@ -103,7 +103,7 @@ func validateServerSecrets(config parser.RegistryMCPServerConfig, verbose bool,
 				} else {
 					// Automatically try to get GitHub token for GitHub-related environment variables
 					if key == "GITHUB_PERSONAL_ACCESS_TOKEN" || key == "GITHUB_TOKEN" || key == "GH_TOKEN" {
-						if actualValue := os.Getenv(key); actualValue == "" { //nolint:osgetenvlibrary
+						if actualValue := os.Getenv(key); actualValue == "" { //nolint:osgetenvlibrary // validation intentionally checks the current process env before token fallback.
 							// Try to automatically get the GitHub token
 							if token, err := parser.GetGitHubToken(); err == nil {
 								config.Env[key] = token
@@ -114,7 +114,7 @@ func validateServerSecrets(config parser.RegistryMCPServerConfig, verbose bool,
 					} else {
 						// For backward compatibility: check if environment variable with this name exists
 						// This preserves the original behavior for existing tests
-						if actualValue := os.Getenv(key); actualValue == "" { //nolint:osgetenvlibrary
+						if actualValue := os.Getenv(key); actualValue == "" { //nolint:osgetenvlibrary // validation intentionally checks inherited env vars for backward compatibility.
 							return fmt.Errorf("environment variable '%s' not set", key)
 						}
 					}
diff --git a/pkg/cli/secret_set_command.go b/pkg/cli/secret_set_command.go
index f1ea43c6f4d..7019b29ab24 100644
--- a/pkg/cli/secret_set_command.go
+++ b/pkg/cli/secret_set_command.go
@@ -162,7 +162,7 @@ func normalizeSecretSetAPIHost(apiBase string) string {
 
 func resolveSecretValueForSet(fromEnv, fromFlag string) (string, error) {
 	if fromEnv != "" {
-		v := os.Getenv(fromEnv) //nolint:osgetenvlibrary
+		v := os.Getenv(fromEnv) //nolint:osgetenvlibrary // --from-env intentionally copies a user-selected process-env secret.
 		if v == "" {
 			return "", fmt.Errorf("environment variable %s is not set or empty", fromEnv)
 		}
diff --git a/pkg/cli/secrets.go b/pkg/cli/secrets.go
index af794177e6f..f88a01a7a02 100644
--- a/pkg/cli/secrets.go
+++ b/pkg/cli/secrets.go
@@ -103,7 +103,7 @@ func extractSecretsFromConfig(config parser.RegistryMCPServerConfig) []SecretInf
 func checkSecretsAvailability(secrets []SecretInfo, useActionsSecrets bool) []SecretInfo {
 	for i := range secrets {
 		// First check if it's in environment variables
-		if value := os.Getenv(secrets[i].Name); value != "" { //nolint:osgetenvlibrary
+		if value := os.Getenv(secrets[i].Name); value != "" { //nolint:osgetenvlibrary // secret discovery intentionally checks inherited env vars before prompting.
 			secrets[i].Available = true
 			secrets[i].Source = "env"
 			secrets[i].Value = value
diff --git a/pkg/cli/shell_completion.go b/pkg/cli/shell_completion.go
index 67e128ca12a..54b96e0ee6c 100644
--- a/pkg/cli/shell_completion.go
+++ b/pkg/cli/shell_completion.go
@@ -36,21 +36,21 @@ func DetectShell() ShellType {
 	shellCompletionLog.Print("Detecting current shell")
 
 	// Check shell-specific version variables first (most reliable)
-	if os.Getenv("ZSH_VERSION") != "" { //nolint:osgetenvlibrary
+	if os.Getenv("ZSH_VERSION") != "" { //nolint:osgetenvlibrary // shell detection intentionally relies on inherited shell marker env vars.
 		shellCompletionLog.Print("Detected zsh from ZSH_VERSION")
 		return ShellZsh
 	}
-	if os.Getenv("BASH_VERSION") != "" { //nolint:osgetenvlibrary
+	if os.Getenv("BASH_VERSION") != "" { //nolint:osgetenvlibrary // shell detection intentionally relies on inherited shell marker env vars.
 		shellCompletionLog.Print("Detected bash from BASH_VERSION")
 		return ShellBash
 	}
-	if os.Getenv("FISH_VERSION") != "" { //nolint:osgetenvlibrary
+	if os.Getenv("FISH_VERSION") != "" { //nolint:osgetenvlibrary // shell detection intentionally relies on inherited shell marker env vars.
 		shellCompletionLog.Print("Detected fish from FISH_VERSION")
 		return ShellFish
 	}
 
 	// Fall back to $SHELL environment variable
-	shell := os.Getenv("SHELL") //nolint:osgetenvlibrary
+	shell := os.Getenv("SHELL") //nolint:osgetenvlibrary // shell detection intentionally falls back to the user's SHELL environment.
 	if shell == "" {
 		shellCompletionLog.Print("SHELL environment variable not set, checking platform")
 		// On Windows, check for PowerShell
@@ -143,7 +143,7 @@ func installBashCompletion(verbose bool, cmd *cobra.Command) error {
 	// Try to determine the best location for bash completions
 	if runtime.GOOS == "darwin" {
 		// macOS with Homebrew
-		brewPrefix := os.Getenv("HOMEBREW_PREFIX") //nolint:osgetenvlibrary
+		brewPrefix := os.Getenv("HOMEBREW_PREFIX") //nolint:osgetenvlibrary // Homebrew installs intentionally honor explicit HOMEBREW_PREFIX overrides.
 		if brewPrefix == "" {
 			// Try common locations
 			for _, prefix := range []string{constants.HomebrewPrefix, constants.UsrLocalPrefix} {
@@ -425,7 +425,7 @@ func uninstallBashCompletion(verbose bool) error {
 
 	// macOS with Homebrew
 	if runtime.GOOS == "darwin" {
-		brewPrefix := os.Getenv("HOMEBREW_PREFIX") //nolint:osgetenvlibrary
+		brewPrefix := os.Getenv("HOMEBREW_PREFIX") //nolint:osgetenvlibrary // Homebrew installs intentionally honor explicit HOMEBREW_PREFIX overrides.
 		if brewPrefix == "" {
 			for _, prefix := range []string{constants.HomebrewPrefix, constants.UsrLocalPrefix} {
 				if fileutil.DirExists(filepath.Join(prefix, "etc", "bash_completion.d")) {
diff --git a/pkg/cli/update_check.go b/pkg/cli/update_check.go
index 907a898f117..5955873c246 100644
--- a/pkg/cli/update_check.go
+++ b/pkg/cli/update_check.go
@@ -74,7 +74,7 @@ func shouldCheckForUpdate(noCheckUpdate bool) bool {
 // This is a heuristic - we can't reliably detect this, so we're conservative
 func isRunningAsMCPServer() bool {
 	// Check for MCP_SERVER environment variable that could be set by the MCP server
-	return os.Getenv("GH_AW_MCP_SERVER") != "" //nolint:osgetenvlibrary
+	return os.Getenv("GH_AW_MCP_SERVER") != "" //nolint:osgetenvlibrary // MCP mode detection intentionally uses a dedicated process-env marker.
 }
 
 var (
diff --git a/pkg/console/accessibility.go b/pkg/console/accessibility.go
index 1af08c97958..18865b6a871 100644
--- a/pkg/console/accessibility.go
+++ b/pkg/console/accessibility.go
@@ -13,7 +13,7 @@ import "os"
 // - Simplify interactive elements
 // - Use plain text instead of fancy formatting
 func IsAccessibleMode() bool {
-	return os.Getenv("ACCESSIBLE") != "" || //nolint:osgetenvlibrary
-		os.Getenv("TERM") == "dumb" || //nolint:osgetenvlibrary
-		os.Getenv("NO_COLOR") != "" //nolint:osgetenvlibrary
+	return os.Getenv("ACCESSIBLE") != "" || //nolint:osgetenvlibrary // terminal accessibility flags are intentionally inherited from the process environment.
+		os.Getenv("TERM") == "dumb" || //nolint:osgetenvlibrary // terminal accessibility flags are intentionally inherited from the process environment.
+		os.Getenv("NO_COLOR") != "" //nolint:osgetenvlibrary // terminal accessibility flags are intentionally inherited from the process environment.
 }
diff --git a/pkg/constants/constants.go b/pkg/constants/constants.go
index dc62ebd0735..d3de987aa60 100644
--- a/pkg/constants/constants.go
+++ b/pkg/constants/constants.go
@@ -569,7 +569,7 @@ const UsrLocalPrefix = "/usr/local"
 // Always uses forward slashes, which are required for git/GitHub paths.
 // GH_AW_WORKFLOWS_DIR overrides the default; any OS-specific separators are normalized.
 func GetWorkflowDir() string {
-	if dir := os.Getenv("GH_AW_WORKFLOWS_DIR"); dir != "" { //nolint:osgetenvlibrary
+	if dir := os.Getenv("GH_AW_WORKFLOWS_DIR"); dir != "" { //nolint:osgetenvlibrary // workflow directory overrides are intentionally process-env driven.
 		return filepath.ToSlash(dir)
 	}
 	return WorkflowsDir
diff --git a/pkg/envutil/envutil.go b/pkg/envutil/envutil.go
index 50237c1bfcd..300bd518cdf 100644
--- a/pkg/envutil/envutil.go
+++ b/pkg/envutil/envutil.go
@@ -36,7 +36,7 @@ func GetIntFromEnv(envVar string, defaultValue, minValue, maxValue int, debugLog
 		}
 	}
 
-	envValue := os.Getenv(envVar) //nolint:osgetenvlibrary
+	envValue := os.Getenv(envVar) //nolint:osgetenvlibrary // envutil centralizes audited process-env reads for downstream callers.
 	if envValue == "" {
 		return defaultValue
 	}
diff --git a/pkg/github/label_objective_mapping.go b/pkg/github/label_objective_mapping.go
index 54c87f72b9a..dc167796053 100644
--- a/pkg/github/label_objective_mapping.go
+++ b/pkg/github/label_objective_mapping.go
@@ -149,7 +149,7 @@ func LoadObjectiveMappingFromConfig() *ObjectiveMapping {
 	labelObjectiveMappingLog.Print("Loading objective mapping configuration")
 
 	// Try loading from OBJECTIVE_MAPPING_JSON env var
-	if mappingJSON := os.Getenv("OBJECTIVE_MAPPING_JSON"); mappingJSON != "" { //nolint:osgetenvlibrary
+	if mappingJSON := os.Getenv("OBJECTIVE_MAPPING_JSON"); mappingJSON != "" { //nolint:osgetenvlibrary // objective mapping test and override payloads are intentionally injected via env.
 		labelObjectiveMappingLog.Print("Attempting to load from OBJECTIVE_MAPPING_JSON env var")
 		var om ObjectiveMapping
 		if err := json.Unmarshal([]byte(mappingJSON), &om); err == nil {
diff --git a/pkg/logger/logger.go b/pkg/logger/logger.go
index 7a693752873..9581b496565 100644
--- a/pkg/logger/logger.go
+++ b/pkg/logger/logger.go
@@ -29,7 +29,7 @@ var (
 	debugEnv = initDebugEnv()
 
 	// DEBUG_COLORS environment variable to control color output.
-	debugColors = os.Getenv("DEBUG_COLORS") != "0" //nolint:osgetenvlibrary
+	debugColors = os.Getenv("DEBUG_COLORS") != "0" //nolint:osgetenvlibrary // logger debug color toggles intentionally follow process-wide env switches.
 
 	basePaletteColors = []color.Color{
 		styles.ColorInfo,
@@ -60,10 +60,10 @@ func buildColorPalette() []lipgloss.Style {
 // If DEBUG is set, it takes precedence. Otherwise, if ACTIONS_RUNNER_DEBUG=true,
 // all loggers are enabled (equivalent to DEBUG=*).
 func initDebugEnv() string {
-	if d := os.Getenv("DEBUG"); d != "" { //nolint:osgetenvlibrary
+	if d := os.Getenv("DEBUG"); d != "" { //nolint:osgetenvlibrary // logger debug selectors intentionally come from standard DEBUG env configuration.
 		return d
 	}
-	if os.Getenv("ACTIONS_RUNNER_DEBUG") == "true" { //nolint:osgetenvlibrary
+	if os.Getenv("ACTIONS_RUNNER_DEBUG") == "true" { //nolint:osgetenvlibrary // GitHub Actions runner debug mode is intentionally inherited from the job environment.
 		return "*"
 	}
 	return ""
diff --git a/pkg/parser/github.go b/pkg/parser/github.go
index e82ad0ae45c..91a6c5fb1ed 100644
--- a/pkg/parser/github.go
+++ b/pkg/parser/github.go
@@ -29,7 +29,7 @@ func GetGitHubHost() string {
 	envVars := []string{"GITHUB_SERVER_URL", "GITHUB_ENTERPRISE_HOST", "GITHUB_HOST", "GH_HOST"}
 
 	for _, envVar := range envVars {
-		if value := os.Getenv(envVar); value != "" { //nolint:osgetenvlibrary
+		if value := os.Getenv(envVar); value != "" { //nolint:osgetenvlibrary // GitHub host detection intentionally honors standard host env overrides.
 			githubLog.Printf("Resolved GitHub host from %s: %s", envVar, value)
 			return stringutil.NormalizeGitHubHostURL(value)
 		}
@@ -62,11 +62,11 @@ func GetGitHubToken() (string, error) {
 	githubLog.Print("Getting GitHub token")
 
 	// First try environment variable
-	if token := os.Getenv("GITHUB_TOKEN"); token != "" { //nolint:osgetenvlibrary
+	if token := os.Getenv("GITHUB_TOKEN"); token != "" { //nolint:osgetenvlibrary // GitHub auth intentionally prefers the runner-provided token environment.
 		githubLog.Print("Found GITHUB_TOKEN environment variable")
 		return token, nil
 	}
-	if token := os.Getenv("GH_TOKEN"); token != "" { //nolint:osgetenvlibrary
+	if token := os.Getenv("GH_TOKEN"); token != "" { //nolint:osgetenvlibrary // gh CLI auth intentionally honors the user's GH_TOKEN environment.
 		githubLog.Print("Found GH_TOKEN environment variable")
 		return token, nil
 	}
diff --git a/pkg/workflow/process_env_lookup.go b/pkg/workflow/process_env_lookup.go
index 791adcc2e05..bef7c2f366e 100644
--- a/pkg/workflow/process_env_lookup.go
+++ b/pkg/workflow/process_env_lookup.go
@@ -5,6 +5,6 @@ import "os"
 func lookupProcessEnv(key string) string {
 	// Intentionally ignore the existence flag to preserve os.Getenv semantics:
 	// missing variables and explicitly empty variables are both treated as "".
-	value, _ := os.LookupEnv(key) //nolint:osgetenvlibrary
+	value, _ := os.LookupEnv(key) //nolint:osgetenvlibrary // this helper intentionally mirrors direct process-env lookup semantics.
 	return value
 }