[sergo] Sergo Report: Enforce-Readiness Reconciliation & Registry Migration Audit - 2026-08-05

[github-actions[bot]]

Summary

Run §30976061315 (R61) reconciled the linter registry after an architectural migration, confirmed several historical bugs are now fixed in code, and found a fresh, evidence-backed gap: 19 of 62 registered linters are absent from the CI enforcement gate, including 2 whose "add to CI" recommendations were previously closed but never actually applied. One issue was filed.

Strategy (50/50 split)

• Cached half: reapplied the proven "enforce-readiness" checklist — for each candidate linter, verify type-resolved matching, nolint wiring, and zero current production violations before recommending CI enforcement.
• New-exploration half: discovered the linter registration mechanism moved from cmd/linters/main.go to pkg/linters/registry.go (the old detector, grep -c Analyzer main.go, now silently returns 0 — a stale-tool trap avoided this run), reconciled all 157 historical sergo-labeled issues (all closed), and cross-referenced the full registered-linter list against .github/workflows/cgo.yml's LINTER_FLAGS to surface the enforcement gap.

Key finding: CI-enforcement gap (issue filed)

[aw_sg61a1] fileclosenotdeferred, timesleepnocontext, sprintferrorsnew are clean and enforce-ready, but unenforced

Linter	Type-resolved	nolint wired	Prod violations	Prior CI-add issue	In LINTER_FLAGS today
fileclosenotdeferred	✅	✅	0	#35390 (closed)	❌
timesleepnocontext	✅	✅	0	#39324 (closed)	❌
sprintferrorsnew	✅	✅	0	(first audit)	❌

Evidence detail

• fileclosenotdeferred: tracks file variables by types.Object (shadow-safe), stops traversal at FuncLit boundaries, matches os.* via astutil.IsPkgSelector. All ~20 production os.Open/Create/OpenFile sites already defer Close() immediately, including pkg/fileutil.CopyFile's internal copyFileContents helper.
• timesleepnocontext: already carries the FuncLit-boundary fix (astutil.IsGoOrDeferClosure) from earlier remediation. All 4 production time.Sleep sites (ensureTrialRepository, getLatestWorkflowRunWithRetry, cleanupStaleWindowsBackups, validateDockerImage) live in functions that don't accept context.Context.
• sprintferrorsnew: matches errors.New(fmt.Sprintf(...)) via astutil.IsPkgSelector for both errors and fmt. No production sites match.
• CI gate: cgo.yml enforces 43 linters (host + wasm builds); registry now has 62 → 19-wide gap. These 3 are the most immediately safe to add.

Notable process gap: #35390 and #39324 were previously closed as resolved recommendations to add these exact linters to CI enforcement — but cgo.yml's LINTER_FLAGS was never actually updated. This is the same "phantom close" pattern historically seen with code-fix issues (closed without the fix landing), now confirmed to also apply to CI-config recommendations. Future enforce-readiness closes should be verified with a direct grep of cgo.yml before trusting them as done.

Verified already fixed (no new issue needed)

Ruled-out findings from this run's audit sweep

• uncheckedflushreturn: the DeferStmt case (fix for uncheckedflushreturn: node filter omits DeferStmt — defer w.Flush() (the most common discard pattern) is never flagged #49902) is present and correct in code.
• httprespbodyclose: nodeFilter now includes both *ast.FuncDecl and *ast.FuncLit (fix for httprespbodyclose: FuncDecl-only scope + FuncLit skip misses responses closed inside closures (goroutines/handlers) — false nega [Content truncated due to length] #43465) is present and correct.
• excessivefuncparams: the old Threshold linters: excessivefuncparams lints test files (every sibling FuncDecl linter skips them); largefunc & excessivefuncpar [Content truncated due to length] #40734 test-file-skip gap no longer applies — it now uses the shared internal/filecheck.ShouldSkipFilename, which bundles IsTestFile.
• walkfuncerrshadow: zero production violations (all ~30 filepath.Walk/WalkDir sites use non-colliding walkErr/err naming). A named-callback-variable (non-FuncLit) false-negative gap exists in the code but has zero live production sites — not worth filing.

Registry migration note

cmd/linters/main.go is now a 25-line stub (multichecker.Main(linters.All()...)); the canonical registry moved to pkg/linters/registry.go's allAnalyzers slice (62 entries), and pkg/linters/doc.go's header is in sync at 62. This means the historical detector (grep -c Analyzer cmd/linters/main.go) is now stale and was updated in this run's memory cache.

Metrics

• Production .go files scanned (excluding _test.go, prioritizing pkg/): ~1,181
• Linters reviewed in depth this run: 7 (sprintferrorsnew, walkfuncerrshadow, uncheckedflushreturn, fileclosenotdeferred, timesleepnocontext, httprespbodyclose, excessivefuncparams)
• Findings: 8 (1 actionable gap with 3 linters bundled, 4 verified-fixed rule-outs confirmed by code read, 3 zero-violation confirmations)
• Tasks/issues created: 1
• Historical context: 61 total runs, 157 total sergo issues created all-time, 0 currently open pre-run

Recommendations for next run (R62)

1. Continue the CI-enforcement-gap sweep across the remaining ~16 unenforced linters: ctxbackground, deferinloop, largefunc, sortslice, seenmapbool, hardcodedfilepath, httpstatuscode, lenstringzero, sprintferrdot, ssljson, stringsconcatloop, appendbytestring, errorfwrapv, errormessage.
2. Re-verify the R60 finding (sg60a1, writebytestring SuggestedFix compile-correctness bug) actually landed.
3. When closing future "add to CI" recommendations, grep cgo.yml's LINTER_FLAGS directly rather than trusting issue-close status.

References:

• https://github.com/github/gh-aw/actions/runs/30976061315
• Enforce fileclosenotdeferred analyzer in CI — zero prod violations confirmed (#aw_sg21a2) #35390
• timesleepnocontext enforce-readiness: zero production violations after the defer-cleanup FP fix — add to CI #39324

Generated by 🤖 Sergo - Serena Go Expert · agent · 193.2 AIC · ⌖ 31.4 AIC · ⊞ 6K · ◷

• expires on Aug 5, 2026, 9:01 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-06T05:01:13.467Z.

Closed by Workflow

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-06T05:01:13.467Z.

Closed by Workflow

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-06T05:01:13.467Z.

Closed by Workflow