From 341070ba8aacf0299603cb873d880b0933c494fa Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 1 Aug 2026 23:00:09 +0000 Subject: [PATCH 1/3] Initial plan From 8f4384b033a643df2bd1c5fd71d67f5085e52661 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 1 Aug 2026 23:10:02 +0000 Subject: [PATCH 2/3] fix: replace strings.Index == 0 with strings.HasPrefix, enforce stringsindexhasprefix linter Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/cgo.yml | 4 ++-- pkg/workflow/frontmatter_on_section_cleanup.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cgo.yml b/.github/workflows/cgo.yml index b353a9e47aa..dbb7bb470b0 100644 --- a/.github/workflows/cgo.yml +++ b/.github/workflows/cgo.yml @@ -1359,10 +1359,10 @@ jobs: # legacy custom analyzer findings in tests or other analyzer families. # Note: -test=false intentionally scopes this gate to production code only. - name: Run custom linters - run: make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -manualmutexunlock -osexitinlibrary -rawloginlib -logfatallibrary -regexpcompileinfunction -fprintlnsprintf -strconvparseignorederror -jsonmarshalignoredeerror -uncheckedtypeassertion -fmterrorfnoverbs -tolowerequalfold -httpnoctx -timeafterleak -errortypeassertion -execcommandwithoutcontext -sprintfint -stringsindexcontains -stringscountcontains -bytesbufferstring -ioutildeprecated -mapclearloop -mapdeletecheck -sprintfbool -appendoneelement -timenowsub -stringsjoinone -writebytestring -lenstringsplit -stringreplaceminusone -osgetenvlibrary -ossetenvlibrary -test=false" + run: make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -manualmutexunlock -osexitinlibrary -rawloginlib -logfatallibrary -regexpcompileinfunction -fprintlnsprintf -strconvparseignorederror -jsonmarshalignoredeerror -uncheckedtypeassertion -fmterrorfnoverbs -tolowerequalfold -httpnoctx -timeafterleak -errortypeassertion -execcommandwithoutcontext -sprintfint -stringsindexcontains -stringscountcontains -bytesbufferstring -ioutildeprecated -mapclearloop -mapdeletecheck -sprintfbool -appendoneelement -timenowsub -stringsjoinone -writebytestring -lenstringsplit -stringreplaceminusone -osgetenvlibrary -ossetenvlibrary -stringsindexhasprefix -test=false" - name: Run custom linters (wasm) - run: GOOS=js GOARCH=wasm make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -manualmutexunlock -osexitinlibrary -rawloginlib -logfatallibrary -regexpcompileinfunction -fprintlnsprintf -strconvparseignorederror -jsonmarshalignoredeerror -uncheckedtypeassertion -fmterrorfnoverbs -tolowerequalfold -httpnoctx -timeafterleak -errortypeassertion -execcommandwithoutcontext -sprintfint -stringsindexcontains -stringscountcontains -bytesbufferstring -ioutildeprecated -mapclearloop -mapdeletecheck -sprintfbool -appendoneelement -timenowsub -stringsjoinone -writebytestring -lenstringsplit -stringreplaceminusone -osgetenvlibrary -ossetenvlibrary -test=false" LINTER_PACKAGES="./pkg/console ./pkg/parser ./pkg/styles ./pkg/tty ./pkg/workflow" + run: GOOS=js GOARCH=wasm make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -manualmutexunlock -osexitinlibrary -rawloginlib -logfatallibrary -regexpcompileinfunction -fprintlnsprintf -strconvparseignorederror -jsonmarshalignoredeerror -uncheckedtypeassertion -fmterrorfnoverbs -tolowerequalfold -httpnoctx -timeafterleak -errortypeassertion -execcommandwithoutcontext -sprintfint -stringsindexcontains -stringscountcontains -bytesbufferstring -ioutildeprecated -mapclearloop -mapdeletecheck -sprintfbool -appendoneelement -timenowsub -stringsjoinone -writebytestring -lenstringsplit -stringreplaceminusone -osgetenvlibrary -ossetenvlibrary -stringsindexhasprefix -test=false" LINTER_PACKAGES="./pkg/console ./pkg/parser ./pkg/styles ./pkg/tty ./pkg/workflow" # Ensure no action shell scripts invoke python or python3 - name: Lint action shell scripts diff --git a/pkg/workflow/frontmatter_on_section_cleanup.go b/pkg/workflow/frontmatter_on_section_cleanup.go index 31aae91811a..1b0156f5d26 100644 --- a/pkg/workflow/frontmatter_on_section_cleanup.go +++ b/pkg/workflow/frontmatter_on_section_cleanup.go @@ -707,7 +707,7 @@ func (c *Compiler) addZizmorIgnoreForWorkflowRun(yamlStr string) string { // Match lines that are only 'workflow_run:' (possibly with trailing whitespace or a comment) // e.g., 'workflow_run:', 'workflow_run: # comment', ' workflow_run:' // But not 'someworkflow_run:', 'workflow_run: value', etc. - if idx := strings.Index(trimmedLine, "workflow_run:"); idx == 0 { + if strings.HasPrefix(trimmedLine, "workflow_run:") { after := strings.TrimSpace(trimmedLine[len("workflow_run:"):]) // Only allow if nothing or only a comment follows if after == "" || strings.HasPrefix(after, "#") { From 7a27f506adf5a51796436e4907fcf1fe9891e933 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 2 Aug 2026 00:11:06 +0000 Subject: [PATCH 3/3] test: align aw-failure-investigator expectation with run-level failures Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com> --- pkg/cli/aw_failure_investigator_workflow_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/cli/aw_failure_investigator_workflow_test.go b/pkg/cli/aw_failure_investigator_workflow_test.go index c86e9968735..afac049735b 100644 --- a/pkg/cli/aw_failure_investigator_workflow_test.go +++ b/pkg/cli/aw_failure_investigator_workflow_test.go @@ -15,7 +15,7 @@ func TestAWFailureInvestigatorPrefetchUsesRunLevelFailures(t *testing.T) { text := string(content) for _, fragment := range []string{ - `FAILURE_CONCLUSIONS = {"failure", "timed_out", "startup_failure", "cancelled"}`, + `FAILURE_CONCLUSIONS = {"failure", "timed_out", "startup_failure"}`, `MAX_DISCOVERY_PAGES = 20`, `Path(".github/workflows").glob("*.lock.yml")`, `falling back to workflow path suffix matching`,