fix: resolve all non-largefunc custom linter findings

docs/adr/44461-adopt-idiomatic-go-patterns-for-custom-linter-compliance.md

@@ -0,0 +1,45 @@
+# ADR-44461: Adopt Idiomatic Go Patterns for Custom Linter Compliance
+
+**Date**: 2026-07-09
+**Status**: Draft
+**Deciders**: Unknown (automated PR by Copilot SWE Agent)
+
+---
+
+### Context
+
+The repository maintains a bespoke `make golint-custom` suite of `go/analysis` linters (see `pkg/linters/`) that enforce project-wide Go idioms. Over time, the codebase accumulated ~128 new lines of business logic that contained patterns flagged by these linters. The accumulated diagnostics fell into five categories across `pkg/cli`, `pkg/workflow`, `pkg/parser`, and `pkg/logger`: (1) allocating `[]byte`→`string` conversions for equality (`bytes.Equal` is already covered by ADR-44389); (2) `map[string]bool` used as membership sets where `map[string]struct{}` avoids per-entry boolean allocations; (3) `h.Write([]byte(s))` hash writes that allocate unnecessarily when `io.WriteString` can be used if the writer implements `io.StringWriter`; (4) `len(s) > 0` empty-string checks where the idiomatic form is `s != ""`; and (5) bare `time.Sleep` calls that ignore context cancellation. Each category has an established preferred idiom in Go and a registered linter diagnostic. The diagnostics form ongoing noise in the CI lint step and are tracked separately from the function-length (`largefunc`) backlog.
+
+### Decision
+
+We will apply all non-`largefunc` custom linter findings in a single compliance pass across the affected packages: replace `map[string]bool` membership sets with `map[string]struct{}` (including API and test updates), switch hash writer calls from `h.Write([]byte(s))` to `io.WriteString(h, s)`, replace `len(s) > 0` guards with `s != ""` at ~50 call sites, replace bare `time.Sleep` with a context-aware `select { case <-time.After(d): case <-ctx.Done(): }` pattern in `mcp_inspect.go`, and replace untyped `sort.Slice` with type-safe `slices.SortFunc`. Discarded `json.Unmarshal` errors in test files are also handled. The pass brings `make golint-custom` output to zero non-`largefunc` diagnostics.
+
+### Alternatives Considered
+
+#### Alternative 1: Suppress or Disable the Linter Rules
+
+Linter rules could be suppressed per-file (`//nolint:lintname`) or removed from the custom suite, treating the flagged patterns as acceptable. This was rejected because the patterns are flagged for real reasons (unnecessary allocations, non-idiomatic style, context-ignoring sleeps), and suppressing them would permanently hide future regressions of the same patterns in new code.
+
+#### Alternative 2: Fix One Category at a Time Across Separate PRs
+
+Each pattern category could be addressed in its own PR, allowing focused review. This was rejected in favor of a single consolidated pass because (a) the categories are mechanically similar and share the same motivation (linter compliance), (b) splitting them would produce more merge conflicts and more CI runs for equivalent net value, and (c) the individual changes are small enough that a single PR remains reviewable.
+
+### Consequences
+
+#### Positive
+- `make golint-custom` produces zero non-`largefunc` diagnostics after this PR, eliminating CI noise and providing a clean baseline.
+- `map[string]struct{}` sets avoid storing a redundant `bool` value per entry; `io.WriteString` avoids a `[]byte` heap allocation per hash write call.
+- The context-aware shutdown in `mcp_inspect.go` correctly respects cancellation instead of blocking the goroutine for the full sleep duration.
+- Typed `slices.SortFunc` surfaces type errors at compile time that `sort.Slice` would not catch.
+
+#### Negative
+- `map[string]struct{}` is more syntactically verbose than `map[string]bool`; set membership checks require the two-value `_, ok := m[k]` idiom instead of the direct boolean `m[k]`.
+- The breadth of the change (57 files, ~128 additions) increases the review surface and raises the probability of a rebase conflict if another branch touches the same files.
+
+#### Neutral
+- The `map[string]struct{}` API change in `action_resolver.go` and `action_cache.go` is breaking at the Go type level; all internal callers and tests are updated in the same PR.
+- `io.WriteString` falls back to a plain `Write([]byte(s))` call if the writer does not implement `io.StringWriter`; behavior is identical, only the allocation path differs.
+
+---
+
+*ADR created by [adr-writer agent]. Review and finalize before changing status from Draft to Accepted.*

pkg/cli/actions_build_command.go

@@ -76,7 +76,7 @@ func ActionsValidateCommand() error {
 	for _, actionName := range actionDirs {
 		actionPath := filepath.Join(actionsDir, actionName)
 		if err := validateActionYml(actionPath); err != nil {
-			fmt.Fprintln(os.Stderr, console.FormatErrorMessage(fmt.Sprintf("✗ %s/action.yml: %s", actionName, err.Error())))
+			fmt.Fprintln(os.Stderr, console.FormatErrorMessage(fmt.Sprintf("✗ %s/action.yml: %s", actionName, err)))
 			allValid = false
 		} else {
 			fmt.Fprintln(os.Stderr, console.FormatInfoMessage(fmt.Sprintf("  ✓ %s/action.yml is valid", actionName)))

pkg/cli/audit_report.go

@@ -838,7 +838,7 @@ func stripGHALogTimestamps(content string) string {
 				if zPos+1 <= len(line) {
 					line = line[zPos+1:]
 					// Skip leading space after the timestamp
-					if len(line) > 0 && line[0] == ' ' {
+					if line != "" && line[0] == ' ' {
 						line = line[1:]
 					}
 				}

pkg/cli/codemod_agent_session.go

@@ -57,7 +57,7 @@ func getAgentTaskToAgentSessionCodemod() Codemod {
 					}
 
 					// Check if we've left the safe-outputs block
-					if inSafeOutputsBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+					if inSafeOutputsBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 						if hasExitedBlock(line, safeOutputsIndent) {
 							inSafeOutputsBlock = false
 						}

pkg/cli/codemod_assign_to_agent.go

@@ -70,7 +70,7 @@ func getAssignToAgentDefaultAgentCodemod() Codemod {
 					}
 
 					// Check if we've left the safe-outputs block
-					if inSafeOutputsBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+					if inSafeOutputsBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 						if hasExitedBlock(line, safeOutputsIndent) {
 							inSafeOutputsBlock = false
 							inAssignToAgentBlock = false
@@ -86,7 +86,7 @@ func getAssignToAgentDefaultAgentCodemod() Codemod {
 					}
 
 					// Check if we've left the assign-to-agent block
-					if inAssignToAgentBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+					if inAssignToAgentBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 						if hasExitedBlock(line, assignToAgentIndent) {
 							inAssignToAgentBlock = false
 						}

pkg/cli/codemod_bash_anonymous.go

@@ -66,7 +66,7 @@ func replaceBashAnonymousWithTrue(lines []string) ([]string, bool) {
 		}
 
 		// Check if we've left the tools block
-		if inToolsBlock && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") {
+		if inToolsBlock && trimmed != "" && !strings.HasPrefix(trimmed, "#") {
 			if hasExitedBlock(line, toolsIndent) {
 				inToolsBlock = false
 			}

pkg/cli/codemod_cli_proxy_mode.go

@@ -99,7 +99,7 @@ func addGitHubModeGhProxyToTools(lines []string) []string {
 	toolsEnd := len(lines)
 	for i := toolsLine + 1; i < len(lines); i++ {
 		trimmed := strings.TrimSpace(lines[i])
-		if len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") && hasExitedBlock(lines[i], toolsIndent) {
+		if trimmed != "" && !strings.HasPrefix(trimmed, "#") && hasExitedBlock(lines[i], toolsIndent) {
 			toolsEnd = i
 			break
 		}
@@ -128,7 +128,7 @@ func addGitHubModeGhProxyToTools(lines []string) []string {
 	insertAt := githubLine + 1
 	for i := githubLine + 1; i < len(lines); i++ {
 		trimmed := strings.TrimSpace(lines[i])
-		if len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") {
+		if trimmed != "" && !strings.HasPrefix(trimmed, "#") {
 			if hasExitedBlock(lines[i], githubIndent) {
 				insertAt = i
 			} else {

pkg/cli/codemod_difc_proxy.go

@@ -128,7 +128,7 @@ func addIntegrityProxyFalseToToolsGitHub(lines []string) []string {
 		}
 
 		// Check if we've left the tools block
-		if inTools && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") {
+		if inTools && trimmed != "" && !strings.HasPrefix(trimmed, "#") {
 			if hasExitedBlock(line, toolsIndent) {
 				inTools = false
 				inGitHub = false
@@ -144,7 +144,7 @@ func addIntegrityProxyFalseToToolsGitHub(lines []string) []string {
 		}
 
 		// Inside github block: inject integrity-proxy: false before the first sub-field
-		if inGitHub && !fieldInserted && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") {
+		if inGitHub && !fieldInserted && trimmed != "" && !strings.HasPrefix(trimmed, "#") {
 			if hasExitedBlock(line, githubIndent) {
 				// Exited github block without seeing any sub-fields; use default indentation
 				fieldIndent := githubIndent + "  "

pkg/cli/codemod_discussion_flag.go

@@ -65,7 +65,7 @@ func getDiscussionFlagRemovalCodemod() Codemod {
 					}
 
 					// Check if we've left the safe-outputs block
-					if inSafeOutputsBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+					if inSafeOutputsBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 						if hasExitedBlock(line, safeOutputsIndent) {
 							inSafeOutputsBlock = false
 							inAddCommentBlock = false
@@ -81,7 +81,7 @@ func getDiscussionFlagRemovalCodemod() Codemod {
 					}
 
 					// Check if we've left the add-comment block
-					if inAddCommentBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+					if inAddCommentBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 						if hasExitedBlock(line, addCommentIndent) {
 							inAddCommentBlock = false
 						}

pkg/cli/codemod_engine_env_secrets.go

@@ -175,7 +175,7 @@ func removeUnsafeEngineEnvKeys(lines []string, unsafeKeys map[string]struct {
 			continue
 		}
 
-		if inEngine && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") && len(indent) <= len(engineIndent) {
+		if inEngine && trimmed != "" && !strings.HasPrefix(trimmed, "#") && len(indent) <= len(engineIndent) {
 			inEngine = false
 			inEnv = false
 			removingKey = false
@@ -189,7 +189,7 @@ func removeUnsafeEngineEnvKeys(lines []string, unsafeKeys map[string]struct {
 			continue
 		}
 
-		if inEnv && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") && len(indent) <= len(envIndent) {
+		if inEnv && trimmed != "" && !strings.HasPrefix(trimmed, "#") && len(indent) <= len(envIndent) {
 			inEnv = false
 			removingKey = false
 		}
@@ -207,7 +207,7 @@ func removeUnsafeEngineEnvKeys(lines []string, unsafeKeys map[string]struct {
 			removingKey = false
 		}
 
-		if inEnv && !removingKey && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") && len(indent) > len(envIndent) {
+		if inEnv && !removingKey && trimmed != "" && !strings.HasPrefix(trimmed, "#") && len(indent) > len(envIndent) {
 			key := parseYAMLMapKey(trimmed)
 			if key != "" && setutil.Contains(unsafeKeys, key) {
 				modified = true

pkg/cli/codemod_engine_steps.go

@@ -60,7 +60,7 @@ func getEngineStepsToTopLevelCodemod() Codemod {
 					}
 
 					// Check if we've exited the engine block
-					if inEngineBlock && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") {
+					if inEngineBlock && trimmed != "" && !strings.HasPrefix(trimmed, "#") {
 						lineIndent := getIndentation(line)
 						if len(lineIndent) <= len(engineIndent) {
 							inEngineBlock = false

pkg/cli/codemod_engine_to_top_level_helpers.go

@@ -67,7 +67,7 @@ func migrateEngineFieldToTopLevel(
 				engineIndent = getIndentation(line)
 				continue
 			}
-			if inEngineBlock && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") && len(getIndentation(line)) <= len(engineIndent) {
+			if inEngineBlock && trimmed != "" && !strings.HasPrefix(trimmed, "#") && len(getIndentation(line)) <= len(engineIndent) {
 				inEngineBlock = false
 			}
 			if inEngineBlock && strings.HasPrefix(trimmed, engineFieldPrefix) {

pkg/cli/codemod_expires_integer.go

@@ -81,7 +81,7 @@ func convertExpiresIntegersToDayStrings(lines []string) ([]string, bool) {
 		}
 
 		// Check if we've left the safe-outputs block
-		if inSafeOutputsBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+		if inSafeOutputsBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 			if hasExitedBlock(line, safeOutputsIndent) {
 				inSafeOutputsBlock = false
 			}

pkg/cli/codemod_mcp_mode_to_type.go

@@ -72,7 +72,7 @@ func renameModeToTypeInMCPServers(lines []string) ([]string, bool) {
 		}
 
 		// Check if we've left mcp-servers block
-		if inMCPServers && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+		if inMCPServers && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 			if hasExitedBlock(line, mcpServersIndent) {
 				inMCPServers = false
 			}

pkg/cli/codemod_mcp_network.go

@@ -171,7 +171,7 @@ func removeFieldFromMCPServer(lines []string, serverName string, fieldName strin
 		}
 
 		// Check if we've left mcp-servers block
-		if inMCPServers && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+		if inMCPServers && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 			if hasExitedBlock(line, mcpServersIndent) {
 				inMCPServers = false
 				inServerBlock = false
@@ -187,7 +187,7 @@ func removeFieldFromMCPServer(lines []string, serverName string, fieldName strin
 		}
 
 		// Check if we've left the server block
-		if inServerBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+		if inServerBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 			currentIndent := getIndentation(line)
 			// Exit if we're back at mcp-servers level or less
 			if len(currentIndent) <= len(serverIndent) && strings.Contains(line, ":") {
@@ -306,7 +306,7 @@ func updateNetworkAllowed(lines []string, domains []string) []string {
 		}
 
 		// Check if we've left network block
-		if inNetworkBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+		if inNetworkBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 			if hasExitedBlock(line, networkIndent) {
 				inNetworkBlock = false
 				inAllowedBlock = false
@@ -376,7 +376,7 @@ func addAllowedToNetwork(lines []string, domains []string) []string {
 			networkIndent = getIndentation(line)
 		}
 
-		if inNetworkBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+		if inNetworkBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 			if hasExitedBlock(line, networkIndent) {
 				// Found the end of network block
 				insertIndex = i

pkg/cli/codemod_network_firewall.go

@@ -135,7 +135,7 @@ func insertSandboxAfterNetworkBlock(lines []string, sandboxLines []string) []str
 			inNetworkBlock = true
 			continue
 		}
-		if inNetworkBlock && len(trimmed) > 0 && isTopLevelKey(line) {
+		if inNetworkBlock && trimmed != "" && isTopLevelKey(line) {
 			insertIndex = i
 			break
 		}

pkg/cli/codemod_permissions_write.go

@@ -90,7 +90,7 @@ func getMigrateWritePermissionsToReadCodemod() Codemod {
 					}
 
 					// Check if we've left the permissions block
-					if inPermissionsBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+					if inPermissionsBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 						if hasExitedBlock(line, permissionsIndent) {
 							inPermissionsBlock = false
 						}

pkg/cli/codemod_playwright_domains.go

@@ -127,7 +127,7 @@ func removeFieldFromPlaywright(lines []string, fieldName string) ([]string, bool
 		}
 
 		// Check if we've left the tools block
-		if inTools && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") {
+		if inTools && trimmed != "" && !strings.HasPrefix(trimmed, "#") {
 			if hasExitedBlock(line, toolsIndent) {
 				inTools = false
 				inPlaywright = false
@@ -143,7 +143,7 @@ func removeFieldFromPlaywright(lines []string, fieldName string) ([]string, bool
 		}
 
 		// Check if we've left the playwright block
-		if inPlaywright && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") {
+		if inPlaywright && trimmed != "" && !strings.HasPrefix(trimmed, "#") {
 			if hasExitedBlock(line, playwrightIndent) {
 				inPlaywright = false
 			}

pkg/cli/codemod_pull_request_target_checkout_false.go

@@ -141,7 +141,7 @@ func ensureCheckoutFalseForPullRequestTarget(lines []string) ([]string, bool) {
 					if strings.TrimSpace(next) == "" {
 						continue
 					}
-					if len(next) > 0 && (next[0] == ' ' || next[0] == '\t') {
+					if next != "" && (next[0] == ' ' || next[0] == '\t') {
 						return lines, false
 					}
 					break

pkg/cli/codemod_run_install_scripts.go

@@ -171,7 +171,7 @@ func detectFrontmatterIndent(lines []string) string {
 			continue
 		}
 		ind := getIndentation(line)
-		if len(ind) > 0 {
+		if ind != "" {
 			return ind
 		}
 	}

pkg/cli/codemod_serena_import.go

@@ -190,7 +190,7 @@ func removeSerenaFromToolsList(lines []string) ([]string, bool) {
 		}
 
 		// Track block exit.
-		if inToolsBlock && len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") {
+		if inToolsBlock && trimmed != "" && !strings.HasPrefix(trimmed, "#") {
 			if hasExitedBlock(line, toolsIndent) {
 				inToolsBlock = false
 			}

pkg/cli/codemod_slash_command.go

@@ -50,7 +50,7 @@ func getCommandToSlashCommandCodemod() Codemod {
 					}
 
 					// Check if we've left the on block
-					if inOnBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+					if inOnBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 						if hasExitedBlock(line, onIndent) {
 							inOnBlock = false
 						}

pkg/cli/codemod_steps_run_secrets_env.go

@@ -3,6 +3,7 @@ package cli
 import (
 	"fmt"
 	"hash/fnv"
+	"io"
 	"regexp"
 	"strings"
 
@@ -446,7 +447,7 @@ func mapRunExpressionToEnvBinding(body string) (string, string, bool) {
 func hashedBindingName(prefix, body string) string {
 	h := fnv.New32a()
 	// fnv.Hash.Write on in-memory bytes is guaranteed not to return an error.
-	_, _ = h.Write([]byte(body))
+	_, _ = io.WriteString(h, body)
 	return fmt.Sprintf("%s_%08x", prefix, h.Sum32())
 }
 

pkg/cli/codemod_upload_assets.go

@@ -50,7 +50,7 @@ func getUploadAssetsCodemod() Codemod {
 					}
 
 					// Check if we've left the safe-outputs block
-					if inSafeOutputsBlock && len(trimmedLine) > 0 && !strings.HasPrefix(trimmedLine, "#") {
+					if inSafeOutputsBlock && trimmedLine != "" && !strings.HasPrefix(trimmedLine, "#") {
 						if hasExitedBlock(line, safeOutputsIndent) {
 							inSafeOutputsBlock = false
 						}

pkg/cli/codemod_user_rate_limit.go

@@ -81,7 +81,7 @@ func renameRateLimitToUserRateLimit(lines []string) ([]string, bool) {
 		if inUserRateLimit {
 			lineIndent := getIndentation(line)
 			if isDescendant(lineIndent, userRateLimitIndent) {
-				if len(trimmed) > 0 && !strings.HasPrefix(trimmed, "#") && userRateLimitChildIndent == "" {
+				if trimmed != "" && !strings.HasPrefix(trimmed, "#") && userRateLimitChildIndent == "" {
 					userRateLimitChildIndent = lineIndent
 				}
 				if userRateLimitChildIndent != "" && lineIndent != userRateLimitChildIndent {

pkg/cli/generate_action_metadata_command.go

@@ -84,7 +84,7 @@ func GenerateActionMetadataCommand() error {
 		contentBytes, err := os.ReadFile(jsPath)
 		if err != nil {
 			generateActionMetadataLog.Printf("Skipping %s: failed to read file: %v", filename, err)
-			fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("⚠ Skipping %s: %s", filename, err.Error())))
+			fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("⚠ Skipping %s: %s", filename, err)))
 			continue
 		}
 		content := string(contentBytes)
@@ -94,7 +94,7 @@ func GenerateActionMetadataCommand() error {
 		// Extract metadata
 		metadata, err := extractActionMetadata(filename, content)
 		if err != nil {
-			fmt.Fprintln(os.Stderr, console.FormatErrorMessage(fmt.Sprintf("✗ Failed to extract metadata from %s: %s", filename, err.Error())))
+			fmt.Fprintln(os.Stderr, console.FormatErrorMessage(fmt.Sprintf("✗ Failed to extract metadata from %s: %s", filename, err)))
 			continue
 		}
 
@@ -205,7 +205,7 @@ func generateHumanReadableName(actionName string) string {
 	// Replace underscores with spaces and capitalize words
 	words := strings.Split(actionName, "_")
 	for i, word := range words {
-		if len(word) > 0 {
+		if word != "" {
 			words[i] = strings.ToUpper(word[:1]) + word[1:]
 		}
 	}