[lint-monster] remediate dynamic regexp pattern findings #51916

Overview

Daily make golint-custom found 23 findings for dynamic regexp patterns that are not compile-time constants.

Root cause grouping

This group covers findings where regexp patterns are built from non-constant inputs. The linter flags these because malformed dynamic patterns can panic in MustCompile, return errors from Compile, or let untrusted input control pattern complexity and size.

Key metrics

• Findings: 23
• Main paths:
  • pkg/parser/schema_suggestions.go (7)
  • pkg/parser/json_path_locator.go (3)
  • pkg/workflow/gh_cli_permissions.go (2)
  • pkg/workflow/template_injection_utils.go (2)
  • pkg/workflow/yaml.go (2)

Representative diagnostics

• pkg/agentdrain/mask.go:33: regexp pattern is not a compile-time constant
• pkg/parser/schema_suggestions.go:506: regexp pattern is not a compile-time constant
• pkg/workflow/gh_cli_permissions.go:103: regexp pattern is not a compile-time constant

Expected outcome

Refactor the flagged call sites to avoid unchecked dynamic regexp compilation, keeping behavior unchanged while making failure handling explicit and bounded.

Remediation checklist

• Keep remediation scoped to the flagged regexp findings only.
• Prefer minimal, targeted code edits.
• Hoist stable regexps to package-level vars when possible.
• When patterns must remain dynamic, use explicit compilation and error handling rather than panic-prone variants.
• Preserve matching semantics and existing tests.
• Run make golint-custom after the changes.
• If Go files change, run make fmt.

Fused skill guidance

• From go-linters: validate the final change with make golint-custom.
• From developer: keep remediation targeted and prefer minimal edits; run make fmt after Go changes.

Generated by 🧌 LintMonster · pi · lint-monster daily scan

Generated by 🧌 LintMonster · gpt54 · 24.6 AIC · ⌖ 4.34 AIC · ⊞ 5.7K · ◷

• expires on Aug 17, 2026, 7:15 PM UTC-08:00