fix: address critical issues from panel review#7
Merged
Conversation
Security hardening: - Add parser timeout (5s) to prevent DoS via malicious files - Add AST complexity limits (100k nodes, 1k depth) - Add ASTComplexityValidator to enforce limits during walks - Wrap parsing in goroutine with panic recovery Error handling: - Analyze() now returns ([]Issue, []string) with errors - No more silent file/parse error swallowing - Verbose mode logs skipped files Honesty: - Rename --fix to --suggest (no files are modified) - Update all "auto-fix" language to "suggestion" - Clear documentation that fixes are not applied Config file support: - Add config/config.go with YAML config loading - Support .goperf.yml for team settings - Add .goperf.yml.example template Documentation: - Create docs/RULES.md with all 20+ rules documented - Include false positive rate disclosure (77%) - Add examples, fixes, and edge cases for each rule Testing: - Add rules/analyzer_test.go with 7 test functions - Add testdata/ fixtures for analyzer tests - Tests cover basics, ignore paths, empty files, syntax errors, context extraction, and multi-file analysis Generated using OpenAI Codex CLI with parallel task execution.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses critical issues identified by a 5-reviewer panel audit:
Security (CRITICAL)
Testing
Developer Experience
.goperf.ymlconfig file support.goperf.yml.exampletemplateHonesty
--fixflag to--suggest(it never actually modified files)Documentation
docs/RULES.md(24KB) with:Error Handling
Analyze()to return([]Issue, []string)for proper error trackingTest plan
go build ./...passesgo test ./...passes (7 new tests)--suggestflag