Expand timenowsub coverage to safe selector and index arguments

[Copilot]

timenowsub only rewrote time.Now().Sub(t) when t was an ident, so it missed the common stored-start-time forms s.start and starts[i]. This change broadens the safety check to cover side-effect-free selector and index expressions while continuing to exclude call-based arguments.

• Analyzer coverage

  • Extend isSafeSinceArg beyond bare idents to accept pure expression shapes that are evaluation-order invariant around time.Now().
  • Keep call expressions rejected, preserving the existing safety boundary for potentially observable argument evaluation.

• Suggested-fix behavior

  • Allow autofixes for common elapsed-time patterns such as field reads and indexed time values.
  • Reuse the existing time qualifier/alias handling unchanged.

• Regression coverage

  • Add bad cases for selector and index arguments and corresponding golden rewrites.
  • Add good cases proving selector/index expressions that contain calls are still not flagged.

Example:

type state struct {
	start time.Time
}

func elapsed(s state, starts []time.Time, i int) {
	_ = time.Now().Sub(s.start)   // -> time.Since(s.start)
	_ = time.Now().Sub(starts[i]) // -> time.Since(starts[i])
}

• Fixes timenowsub coverage gap: isSafeSinceArg rejects side-effect-free selector/index args (e.g. time.Now().Sub(s.start)) — false nega [Content truncated due to length] #46708

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR broadens the timenowsub linter’s notion of “safe” arguments so it can suggest simplifying time.Now().Sub(x) to time.Since(x) for additional argument shapes (selectors and indexing), and updates the linter’s golden test fixtures accordingly. It also refreshes the pinned versions in the generated VulnHunter workflow lockfile.

Changes:

• Extend isSafeSinceArg to treat selector, index, pointer dereference, and basic literal expressions as “safe”.
• Add/adjust timenowsub test cases + golden output for selector/index arguments.
• Bump versions/pins in .github/workflows/daily-vulnhunter-scan.lock.yml.

Show a summary per file

File	Description
pkg/linters/timenowsub/timenowsub.go	Expands “safe argument” AST patterns used to decide when to suggest time.Since(...).
pkg/linters/timenowsub/testdata/src/timenowsub/timenowsub.go	Adds new test scenarios for selector/index arguments and ensures some call-based variants remain “good”.
pkg/linters/timenowsub/testdata/src/timenowsub/timenowsub.go.golden	Updates expected diagnostics/fixes for the new scenarios.
.github/workflows/daily-vulnhunter-scan.lock.yml	Updates generated lockfile pins (AWF + Claude Code versions, container digests).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Low

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.14