[repository-quality] Repository Quality Improvement Report - Subprocess Execution and Cancellation Hygiene

[github-actions[bot]]

🎯 Repository Quality Improvement Report - Subprocess Execution and Cancellation Hygiene

Analysis Date: 2026-10-16
Focus Area: Subprocess Execution and Cancellation Hygiene
Strategy Type: Custom
Custom Area: Yes — the CLI shells out heavily to git/gh/docker/npm/pip; cancellation, timeouts and file permissions are repo-specific risks not covered by earlier runs.

Executive Summary

Non-test Go code under pkg/ has ~100 exec.Command( calls versus ~68 exec.CommandContext( calls. The execcommandwithoutcontext linter only flags calls inside functions that already receive a context.Context. Context-less helpers such as ensureCleanGitWorktree and resetGitWorktreeToHEAD in pkg/cli/pr_command.go:262-281 are called from ctx-aware flows yet cannot be cancelled. pkg/cli/git.go alone has 20 exec.Command calls.

File permissions are well centralised via constants.FilePermPublic/Sensitive (~180 uses), with one stray literal (pkg/cli/edit_command.go:160). pkg/cli/dispatch.go:232,251 writes workflow files with FilePermSensitive (0600); confirm this is intentional.

Full Analysis Report

Focus Area: Subprocess Execution and Cancellation Hygiene

Current State Assessment

Metrics Collected:

Metric	Value	Status
exec.Command( non-test calls in pkg	~100	⚠️
exec.CommandContext( non-test calls	~68	✅
Files with exec.Command( (cli/workflow/parser)	31	⚠️
pkg/cli/git.go exec.Command calls	20	❌
pkg/cli/pr_command.go exec.Command calls	13	⚠️
Literal permission modes outside constants	1	✅
InsecureSkipVerify / md5 / sha1 usage	0	✅
Test/source LOC ratio	661899 / 358308	✅

Findings

Strengths

• Permission constants centralised in pkg/constants/constants.go.
• Existing linter for exec.Command in ctx-aware functions.
• No insecure TLS or weak hashes.

Areas for Improvement

• 🟠 Context-less helpers in pkg/cli/git.go and pkg/cli/pr_command.go run git without cancellation.
• 🟡 Linter blind spot: helpers without ctx called from ctx-aware callers.
• 🟡 docker pull/npm view/pip index validators in pkg/workflow/*_validation.go have no timeout.
• ⚪ Stray 0o644 literal in edit_command.go:160; verify 0600 in dispatch.go.

---

🤖 Tasks for Copilot Agent

NOTE TO PLANNER AGENT: Split the following tasks into individual work items.

Improvement Tasks

Task 1: Thread context through git helpers in pkg/cli/git.go

Priority: High
Estimated Effort: Medium
Focus Area: Subprocess cancellation

Description: Convert the 20 exec.Command calls in git.go to exec.CommandContext, adding a ctx parameter to helpers and updating callers.

Acceptance Criteria:

• No exec.Command( remains in pkg/cli/git.go
• Callers pass their ctx (Background only at entry points)
• make fmt and impacted unit tests pass

Code Region: pkg/cli/git.go

Convert exec.Command to exec.CommandContext in pkg/cli/git.go by adding ctx context.Context as first parameter to affected helpers; update all callers. Keep behaviour identical. Run make fmt and targeted tests.

---

Task 2: Make PR transfer and trial git helpers cancellable

Priority: Medium
Estimated Effort: Small
Focus Area: Subprocess cancellation

Description: ensureCleanGitWorktree, resetGitWorktreeToHEAD and other calls in pr_command.go should take ctx.

Acceptance Criteria:

• All 13 exec.Command calls in pr_command.go use CommandContext
• Same for trial_helpers.go and trial_repository.go where ctx is available
• Tests pass

Code Region: pkg/cli/pr_command.go, pkg/cli/trial_helpers.go, pkg/cli/trial_repository.go

Add ctx parameters to git helper functions in pkg/cli/pr_command.go and use exec.CommandContext; apply the same to trial_helpers.go and trial_repository.go.

---

Task 3: Add timeouts to package validators

Priority: Medium
Estimated Effort: Small
Focus Area: Robustness

Description: docker/pip/npm validators run network subprocesses with no deadline; a hung registry stalls compilation.

Acceptance Criteria:

• Each subprocess uses CommandContext with a bounded timeout constant
• Timeouts produce an actionable warning
• Unit test covers the timeout path

Code Region: pkg/workflow/docker_validation.go, pkg/workflow/pip_validation.go, pkg/workflow/npm_validation.go

Wrap docker/pip/npm validation subprocess calls with context.WithTimeout and exec.CommandContext. Add a named timeout constant and tests simulating a slow command.

---

Task 4: Extend linter and tidy permissions

Priority: Low
Estimated Effort: Medium
Focus Area: Tooling / permissions

Description: Extend execcommandwithoutcontext to flag exec.Command in same-package helpers called from ctx-aware functions. Replace the literal in edit_command.go:160 with constants.FilePermPublic; review dispatch.go modes.

Acceptance Criteria:

• Linter testdata covers the new case
• edit_command.go uses constants
• dispatch.go permission choice documented or corrected

Code Region: pkg/linters/execcommandwithoutcontext/, pkg/cli/edit_command.go, pkg/cli/dispatch.go

Extend the execcommandwithoutcontext analyzer to report exec.Command inside same-package helpers invoked from functions with a context parameter. Add testdata. Replace os.FileMode(0o644) in edit_command.go with constants.FilePermPublic and review dispatch.go file modes.

---

📊 Historical Context

Previous Focus Areas

Date	Focus Area	Type	Custom	Key Outcomes
2026-10-13	Large Source File Decomposition	Custom	Y	Split 800+ LOC files
2026-10-14	Library Robustness	Custom	Y	Panics, context.Background audit
2026-10-15	Error Message Quality and Context	Custom	Y	Bare returns, hints
2026-10-16	Subprocess Execution and Cancellation Hygiene	Custom	Y	exec.Command vs CommandContext

---

🎯 Recommendations

Immediate Actions (This Week)

1. Convert pkg/cli/git.go to context-aware exec — Priority: High

Short-term Actions (This Month)

1. Cancellable PR-transfer helpers and validator timeouts — Priority: Medium

Long-term Actions (This Quarter)

1. Strengthen linter coverage — Priority: Low

---

📈 Success Metrics

• Non-test exec.Command( in pkg/cli: ~60 → <15
• Validator subprocesses with timeouts: 0 → 100%

---

Next Steps

1. Review and prioritise the tasks above
2. Assign tasks to Copilot coding agent via planner agent
3. Track progress
4. Re-evaluate in 1 month

---

Generated by Repository Quality Improvement Agent
Next analysis: 2026-10-17 — Focus area selected by diversity algorithm

Generated by ⚡ Repository Quality Improvement Agent · copilot · auto · 27.4 AIC · ⌖ 0.685 AIC · ⊞ 10.5K · ◷

• expires on Oct 17, 2026, 5:04 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-17T13:04:40.685Z.

Closed by Workflow