Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[go-fan] Go Module Review: mvdan.cc/sh/v3

Open Beginner friendly
  • Is something wrong?
#70,197 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
security

Research direction

Read pkg/workflow/taint/javascript_workflow.go around line 223 and inspect the javascriptExecutables traversal. The report identifies its syntax.Walk callback as always continuing and suggests syntax.Preorder as a behavior-neutral alternative; first check how the existing traversal collects executables. Done means that call site uses Preorder and preserves the same collected results.

Written by the indexing model from the issue text.

Description

automation cookie dependencies go-fan
Go Fan Report: mvdan.cc/sh/v3

Module Overview
mvdan.cc/sh/v3 (repo mvdan/sh) is a pure-Go shell parser, formatter, and interpreter (the engine behind shfmt), supporting POSIX Shell, Bash, Zsh, and mksh. gh-aw only imports its syntax subpackage, the AST parser, and does not use interp, expand, shell, or pattern.

Current Usage in gh-aw

  • Files: 3 non-test files plus 1 test file, all in pkg/workflow/taint
  • Purpose: static taint-tracking security analyzer for shell run steps in agentic workflows. It propagates untrusted data (issue/PR titles, comments, etc.) through assignments, command substitutions, redirects, pipes, and env/curl/wget calls, flagging leaks into logs, files, GITHUB_OUTPUT/GITHUB_ENV, or network requests.
  • Key APIs: syntax.NewParser().Parse, syntax.Walk, and type-switching over CallExpr, BinaryCmd, IfClause, ForClause, WhileClause, CaseClause, FuncDecl, ParamExp, CmdSubst, and more.

Research Findings
Version pinned: v3.14.1, which is the latest release (published 2026-09-06). gh-aw is already fully up to date; no version bump needed.

Recent releases: v3.14.1 fixed heredoc indentation and a zsh parsing edge case (no effect on gh-aw). v3.14.0 added syntax.Preorder, a Walk-complementing iter.Seq[Node] range-over-func iterator, plus parser correctness fixes. v3.13.0 added Zsh language support to the parser.

Improvement Opportunities

Quick Wins:

  • javascriptExecutables in pkg/workflow/taint/javascript_workflow.go (around line 223) calls syntax.Walk with a callback that always returns true, meaning it never prunes the traversal. This is exactly the case the new (v3.14.0) syntax.Preorder iterator was added for. Replacing it with a for node := range syntax.Preorder(tree) loop is a behavior-neutral readability improvement. The other 4 syntax.Walk call sites in the package rely on pruning and should keep using Walk directly.

Feature Opportunities:

  • None of the interp/expand/pattern additions apply, since gh-aw correctly stays with the static syntax parser only.
  • Zsh parsing is available since v3.13.0 but not modeled; shell.go explicitly reports a gap for any shell other than bash/sh. Low priority since GitHub Actions built-in shell values do not include zsh on hosted runners.

Best Practice Alignment:

  • Parser configuration is already minimal and correct: no Variant, RecoverErrors, StopAt, or KeepPadding options are set, which is the right conservative choice for a security analyzer.
  • Dependency surface is already minimal: only syntax is imported, never interp or cmd/shfmt.

Recommendations

  1. Optional, low risk: replace the javascriptExecutables syntax.Walk call with syntax.Preorder for a small readability win.
  2. No version bump needed; already on latest v3.14.1.
  3. No urgent action needed otherwise; the module is well-utilized and scoped tightly to the syntax subpackage for a legitimate static-analysis use case.

Generated by Go Fan. Module summary saved to scratchpad/mods/sh.md

References:

Generated by 🐹 Go Fan · claude · agent · 163.6 AIC · ⌖ 0.88 AIC · ⊞ 6.6K · ◷

  • expires on Oct 20, 2026, 12:13 AM UTC-08:00
Dominant language
Go
Stars
5.4k
Forks
584
Avg merge
3h 16m
Merged PRs (30d)
829

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw

All issues in github/gh-aw

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.