fix(lint): replace string += in loops with strings.Builder; map[string]bool set → struct{}

pkg/actionpins/actionpins_internal_test.go

@@ -168,15 +168,13 @@ func TestInitWarnings_InitializesAndPreservesMap(t *testing.T) {
 	})
 
 	t.Run("preserves existing warnings map", func(t *testing.T) {
-		// Build expected independently so a mutation to ctx.Warnings cannot silently
-		// satisfy the assertion (both sides would change if they shared a pointer).
-		expected := map[string]bool{"actions/checkout@v5": true}
 		ctx := &PinContext{Warnings: map[string]bool{"actions/checkout@v5": true}}
 
 		initWarnings(ctx)
 
 		require.NotNil(t, ctx.Warnings, "Expected warnings map to remain initialized")
-		assert.Equal(t, expected, ctx.Warnings, "Expected existing warnings to be preserved unchanged")
+		assert.Len(t, ctx.Warnings, 1, "Expected warnings map to have exactly one entry")
+		assert.True(t, ctx.Warnings["actions/checkout@v5"], "Expected existing warning key to be preserved")
 	})
 }
 

pkg/cli/add_interactive_schedule.go

@@ -293,7 +293,7 @@ func buildScheduleOptions(rawExpr, currentFreq string) []huh.Option[string] {
 	for _, f := range standardScheduleFrequencies {
 		label := f.Label
 		if f.Value == currentFreq {
-			label += " (current)"
+			label = label + " (current)"
 		}
 		options = append(options, huh.NewOption(label, f.Value))
 	}

pkg/cli/audit_cross_run_render.go

@@ -157,7 +157,7 @@ func renderMarkdownDrain3InsightsToWriter(w io.Writer, insights []ObservabilityI
 	for _, insight := range insights {
 		summary := insight.Summary
 		if insight.Evidence != "" {
-			summary += " (" + insight.Evidence + ")"
+			summary = summary + " (" + insight.Evidence + ")"
 		}
 		fmt.Fprintf(w, "| %s %s | %s | %s | %s |\n",
 			renderSeverityIcon(insight.Severity), insight.Severity, insight.Category, insight.Title, summary)

pkg/cli/audit_report_render.go

@@ -244,11 +244,12 @@ func renderConsoleAssessments(assessments []AgenticAssessment) {
 	}
 	fmt.Fprintln(os.Stderr, "  assessments:")
 	for _, assessment := range assessments {
-		line := fmt.Sprintf("    [%s] %s", strings.ToUpper(assessment.Severity), assessment.Summary)
+		var lb strings.Builder
+		fmt.Fprintf(&lb, "    [%s] %s", strings.ToUpper(assessment.Severity), assessment.Summary)
 		if assessment.Evidence != "" {
-			line += " | " + assessment.Evidence
+			lb.WriteString(" | " + assessment.Evidence)
 		}
-		fmt.Fprintln(os.Stderr, line)
+		fmt.Fprintln(os.Stderr, lb.String())
 	}
 }
 
@@ -268,11 +269,12 @@ func renderConsoleInsights(insights []ObservabilityInsight) {
 	}
 	fmt.Fprintln(os.Stderr, "  insights:")
 	for _, insight := range insights {
-		line := fmt.Sprintf("    [%s] %s", strings.ToUpper(insight.Severity), insight.Title)
+		var lb strings.Builder
+		fmt.Fprintf(&lb, "    [%s] %s", strings.ToUpper(insight.Severity), insight.Title)
 		if insight.Evidence != "" {
-			line += " | " + insight.Evidence
+			lb.WriteString(" | " + insight.Evidence)
 		}
-		fmt.Fprintln(os.Stderr, line)
+		fmt.Fprintln(os.Stderr, lb.String())
 	}
 }
 
@@ -319,11 +321,12 @@ func renderConsoleMissingTools(missingTools []MissingToolReport) {
 	}
 	fmt.Fprintln(os.Stderr, "  missing_tools:")
 	for _, tool := range missingTools {
-		line := "    " + tool.Tool + ": " + tool.Reason
+		var lb strings.Builder
+		lb.WriteString("    " + tool.Tool + ": " + tool.Reason)
 		if tool.Alternatives != "" {
-			line += " (alt: " + tool.Alternatives + ")"
+			lb.WriteString(" (alt: " + tool.Alternatives + ")")
 		}
-		fmt.Fprintln(os.Stderr, line)
+		fmt.Fprintln(os.Stderr, lb.String())
 	}
 }
 
@@ -350,13 +353,14 @@ func renderConsoleCreatedItems(items []CreatedItemReport) {
 	}
 	fmt.Fprintln(os.Stderr, "  created:")
 	for _, item := range items {
-		line := "    " + item.Type
+		var lb strings.Builder
+		lb.WriteString("    " + item.Type)
 		if item.URL != "" {
-			line += " " + item.URL
+			lb.WriteString(" " + item.URL)
 		} else if item.Repo != "" && item.Number > 0 {
-			line += fmt.Sprintf(" %s#%d", item.Repo, item.Number)
+			fmt.Fprintf(&lb, " %s#%d", item.Repo, item.Number)
 		}
-		fmt.Fprintln(os.Stderr, line)
+		fmt.Fprintln(os.Stderr, lb.String())
 	}
 }
 
@@ -366,11 +370,12 @@ func renderConsoleToolUsage(toolUsage []ToolUsageInfo) {
 	}
 	fmt.Fprintln(os.Stderr, "  tools:")
 	for _, tool := range toolUsage {
-		line := fmt.Sprintf("    %s ×%d", tool.Name, tool.CallCount)
+		var lb strings.Builder
+		fmt.Fprintf(&lb, "    %s ×%d", tool.Name, tool.CallCount)
 		if tool.MaxDuration != "" {
-			line += " max=" + tool.MaxDuration
+			lb.WriteString(" max=" + tool.MaxDuration)
 		}
-		fmt.Fprintln(os.Stderr, line)
+		fmt.Fprintln(os.Stderr, lb.String())
 	}
 }
 
@@ -380,14 +385,15 @@ func renderConsoleMCPToolUsage(mcpToolUsage *MCPToolUsageData) {
 	}
 	fmt.Fprintln(os.Stderr, "  mcp_tools:")
 	for _, summary := range mcpToolUsage.Summary {
-		line := fmt.Sprintf("    %s/%s ×%d", summary.ServerName, summary.ToolName, summary.CallCount)
+		var lb strings.Builder
+		fmt.Fprintf(&lb, "    %s/%s ×%d", summary.ServerName, summary.ToolName, summary.CallCount)
 		if summary.ErrorCount > 0 {
-			line += fmt.Sprintf(" errors=%d", summary.ErrorCount)
+			fmt.Fprintf(&lb, " errors=%d", summary.ErrorCount)
 		}
 		if summary.MaxDuration != "" {
-			line += " max=" + summary.MaxDuration
+			lb.WriteString(" max=" + summary.MaxDuration)
 		}
-		fmt.Fprintln(os.Stderr, line)
+		fmt.Fprintln(os.Stderr, lb.String())
 	}
 	if mcpToolUsage.GuardPolicySummary != nil && mcpToolUsage.GuardPolicySummary.TotalBlocked > 0 {
 		fmt.Fprintf(os.Stderr, "    guard_blocked: %d\n", mcpToolUsage.GuardPolicySummary.TotalBlocked)

pkg/cli/bootstrap_config.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
 	"github.com/github/gh-aw/pkg/gitutil"
@@ -28,23 +29,25 @@ func printBootstrapConfigTODO(w io.Writer, profile *resolvedBootstrapProfile) {
 		case "require-owner-type":
 			fmt.Fprintf(w, "  ☐ Verify repository owner type: %s\n", action.Value)
 		case "repo-variable":
-			line := "  ☐ Set repository variable: " + action.Name
+			var lb strings.Builder
+			lb.WriteString("  ☐ Set repository variable: " + action.Name)
 			if action.Prompt != "" {
-				line += " — " + action.Prompt
+				lb.WriteString(" — " + action.Prompt)
 			}
 			if action.Optional {
-				line += " (optional)"
+				lb.WriteString(" (optional)")
 			}
-			fmt.Fprintln(w, line)
+			fmt.Fprintln(w, lb.String())
 		case "repo-secret":
-			line := "  ☐ Set repository secret: " + action.Name
+			var lb strings.Builder
+			lb.WriteString("  ☐ Set repository secret: " + action.Name)
 			if action.Prompt != "" {
-				line += " — " + action.Prompt
+				lb.WriteString(" — " + action.Prompt)
 			}
 			if action.Optional {
-				line += " (optional)"
+				lb.WriteString(" (optional)")
 			}
-			fmt.Fprintln(w, line)
+			fmt.Fprintln(w, lb.String())
 		case "github-app":
 			appLabel := action.AppName
 			if appLabel == "" {

pkg/cli/compile_stats.go

@@ -173,9 +173,9 @@ func printCompilationSummary(stats *CompilationStats, showAllErrors bool) {
 
 				header := fmt.Sprintf("%s (%d error(s)", filepath.Base(failure.Path), report.TotalCount)
 				if !showAllErrors && report.HiddenCount > 0 {
-					header += fmt.Sprintf(", showing top %d", len(report.DisplayedErrors))
+					header = header + fmt.Sprintf(", showing top %d", len(report.DisplayedErrors))
 				}
-				header += "):"
+				header = header + "):"
 				fmt.Fprintln(os.Stderr, console.FormatErrorMessage(header))
 
 				lastHeading := ""

pkg/cli/experiments_analyze_statistics.go

@@ -373,7 +373,7 @@ func printOneExperimentAnalysis(a ExperimentAnalysis) {
 	for _, v := range a.Variants {
 		progressStr := fmt.Sprintf("%d/%d", v.Count, v.MinSamples)
 		if v.BelowMinSamples {
-			progressStr += " ⚠"
+			progressStr = progressStr + " ⚠"
 		}
 		fmt.Fprintf(os.Stderr, "  %-20s %6d  %6.1f%%  %6.1f%%  %s\n",
 			v.Name, v.Count, v.ObservedPct, v.ExpectedPct, progressStr)

pkg/cli/fetch.go

@@ -126,7 +126,7 @@ func fetchRemoteWorkflow(ctx context.Context, spec *WorkflowSpec, verbose bool)
 			for _, prefix := range []string{"workflows/", constants.WorkflowsDirSlash} {
 				altPath := prefix + spec.WorkflowPath
 				if !strings.HasSuffix(altPath, ".md") {
-					altPath += ".md"
+					altPath = altPath + ".md"
 				}
 				remoteWorkflowLog.Printf("Direct path failed, trying: %s", altPath)
 				if altContent, altErr := downloadFileFromGitHubForHost(ctx, owner, repo, altPath, ref, spec.Host); altErr == nil {

pkg/cli/imports.go

@@ -217,7 +217,7 @@ func processIncludesWithWorkflowSpec(content string, workflow *WorkflowSpec, com
 
 			// Add section if present
 			if sectionName != "" {
-				workflowSpec += "#" + sectionName
+				workflowSpec = workflowSpec + "#" + sectionName
 			}
 
 			// Write the updated @include directive (even for duplicate occurrences)
@@ -361,7 +361,7 @@ func processIncludesInContent(content string, workflow *WorkflowSpec, commitSHA
 
 			// Add section if present
 			if sectionName != "" {
-				workflowSpec += "#" + sectionName
+				workflowSpec = workflowSpec + "#" + sectionName
 			}
 
 			// Write the updated import directive

pkg/cli/outcomes_command.go

@@ -213,7 +213,7 @@ func RunOutcomes(config OutcomesConfig) error {
 		resultStr := string(r.Result)
 		detail := r.Detail
 		if detail != "" {
-			resultStr += " (" + detail + ")"
+			resultStr = resultStr + " (" + detail + ")"
 		}
 		numStr := ""
 		if r.ObjectNumber > 0 {

pkg/cli/view_command.go

@@ -207,9 +207,9 @@ func renderViewSafeOutputs(runDir string) {
 	for _, item := range items {
 		line := "  " + item.Type
 		if item.URL != "" {
-			line += "  " + item.URL
+			line = line + "  " + item.URL
 		} else if item.Repo != "" && item.Number > 0 {
-			line += fmt.Sprintf("  %s#%d", item.Repo, item.Number)
+			line = line + fmt.Sprintf("  %s#%d", item.Repo, item.Number)
 		}
 		fmt.Fprintln(os.Stdout, line)
 	}

pkg/workflow/checkout_config_parser.go

@@ -311,9 +311,11 @@ func buildCheckoutsPromptContent(checkouts []*CheckoutConfig) string {
 			relPath = ""
 		}
 		isRoot := relPath == ""
-		absPath := "$GITHUB_WORKSPACE"
-		if !isRoot {
-			absPath += "/" + relPath
+		var absPath string
+		if isRoot {
+			absPath = "$GITHUB_WORKSPACE"
+		} else {
+			absPath = "$GITHUB_WORKSPACE/" + relPath
 		}
 
 		// Determine repo: use configured value or fall back to the triggering repository expression.
@@ -322,41 +324,40 @@ func buildCheckoutsPromptContent(checkouts []*CheckoutConfig) string {
 		if repo == "" {
 			repo = "${{ github.repository }}"
 		}
-		if cfg.Wiki {
-			if !strings.HasSuffix(repo, ".wiki") {
-				repo += ".wiki"
-			}
+		if cfg.Wiki && !strings.HasSuffix(repo, ".wiki") {
+			repo = repo + ".wiki"
 		}
 
-		line := fmt.Sprintf("  - repo `%s` → `%s`", repo, absPath)
+		var lb strings.Builder
+		fmt.Fprintf(&lb, "  - repo `%s` → `%s`", repo, absPath)
 		if isRoot {
-			line += " (cwd)"
+			lb.WriteString(" (cwd)")
 		}
 		if cfg.Wiki {
-			line += " (wiki)"
+			lb.WriteString(" (wiki)")
 		}
 		if cfg.Current {
-			line += " (**current** - this is the repository you are working on; use this as the target for all GitHub operations unless otherwise specified)"
+			lb.WriteString(" (**current** - this is the repository you are working on; use this as the target for all GitHub operations unless otherwise specified)")
 		}
 
 		// Annotate fetch-depth so the agent knows how much history is available
 		if cfg.FetchDepth != nil && *cfg.FetchDepth == 0 {
-			line += " [full history, all branches available as remote-tracking refs]"
+			lb.WriteString(" [full history, all branches available as remote-tracking refs]")
 		} else if cfg.FetchDepth != nil {
-			line += fmt.Sprintf(" [shallow clone, fetch-depth=%d]", *cfg.FetchDepth)
+			fmt.Fprintf(&lb, " [shallow clone, fetch-depth=%d]", *cfg.FetchDepth)
 		} else {
-			line += " [shallow clone, fetch-depth=1 (default)]"
+			lb.WriteString(" [shallow clone, fetch-depth=1 (default)]")
 		}
 
 		// Annotate additionally fetched refs
 		if len(cfg.Fetch) > 0 {
-			line += fmt.Sprintf(" [additional refs fetched: %s]", strings.Join(cfg.Fetch, ", "))
+			fmt.Fprintf(&lb, " [additional refs fetched: %s]", strings.Join(cfg.Fetch, ", "))
 		}
 		if strings.TrimSpace(cfg.SparseCheckout) != "" {
-			line += " [sparse checkout enabled]"
+			lb.WriteString(" [sparse checkout enabled]")
 		}
 
-		sb.WriteString(line + "\n")
+		sb.WriteString(lb.String() + "\n")
 	}
 
 	// General guidance about unavailable branches

pkg/workflow/claude_logs.go

@@ -181,7 +181,7 @@ func (e *ClaudeEngine) parseClaudeJSONLog(logContent string, verbose bool) LogMe
 						}
 						j++
 					}
-					buf += sb.String()
+					buf = trimmedLine + sb.String()
 				}
 
 				var arr []map[string]any

pkg/workflow/copilot_engine_execution.go

@@ -751,10 +751,12 @@ func buildEngineCommandScriptSetup(command string) string {
 	// engine.command intentionally accepts shell-form commands from trusted workflow
 	// configuration authored in-repo; preserve shell semantics and forward driver args.
 	scriptContent := fmt.Sprintf("#!/usr/bin/env bash\nset +o histexpand\nset -eo pipefail\n%s \"$@\"\n", command)
-	heredocDelimiter := "GH_AW_ENGINE_COMMAND_EOF"
-	for strings.Contains(scriptContent, heredocDelimiter) {
-		heredocDelimiter += "_X"
+	var delimBuilder strings.Builder
+	delimBuilder.WriteString("GH_AW_ENGINE_COMMAND_EOF")
+	for strings.Contains(scriptContent, delimBuilder.String()) {
+		delimBuilder.WriteString("_X")
 	}
+	heredocDelimiter := delimBuilder.String()
 
 	return fmt.Sprintf(`mkdir -p /tmp/gh-aw
 GH_AW_PREV_UMASK="$(umask)"

pkg/workflow/dependabot.go

@@ -681,9 +681,9 @@ func normalizeDependabotIgnoreEntries(content []byte, managedPatterns []string)
 		managed := slices.Contains(managedPatterns, dependencyName)
 
 		if managed {
-			line += " # " + managedDependabotIgnoreComment
+			line = line + " # " + managedDependabotIgnoreComment
 		} else if hasComment {
-			line += " #" + strings.TrimSpace(comment)
+			line = line + " #" + strings.TrimSpace(comment)
 		}
 
 		lines[i] = line

pkg/workflow/expression_nodes.go

@@ -142,9 +142,9 @@ func (d *DisjunctionNode) RenderMultiline() string {
 
 		// Add the expression with OR operator (except for the last term)
 		if i < len(d.Terms)-1 {
-			line += term.Render() + " ||"
+			line = line + term.Render() + " ||"
 		} else {
-			line += term.Render()
+			line = line + term.Render()
 		}
 
 		lines = append(lines, line)

pkg/workflow/strict_mode_permissions_validation.go

@@ -61,7 +61,7 @@ func (c *Compiler) validateStrictDeprecatedFields(frontmatter map[string]any) er
 		for _, field := range foundDeprecated {
 			message := fmt.Sprintf("Field '%s' is deprecated", field.Name)
 			if field.Replacement != "" {
-				message += fmt.Sprintf(". Use '%s' instead", field.Replacement)
+				message = message + fmt.Sprintf(". Use '%s' instead", field.Replacement)
 			}
 			errorMessages = append(errorMessages, message)
 		}

pkg/workflow/threat_detection_external.go

@@ -337,7 +337,7 @@ func (c *Compiler) buildExternalDetectorExecutionStep(data *WorkflowData) []stri
 		}
 		prefixed := "          " + line
 		if !strings.HasSuffix(prefixed, "\n") {
-			prefixed += "\n"
+			prefixed = prefixed + "\n"
 		}
 		steps = append(steps, prefixed)
 	}