[go-fan] Go Module Review: mvdan.cc/sh/v3
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
阅读 pkg/workflow/taint/javascript_workflow.go 第 223 行附近，并检查 javascriptExecutables 的遍历。报告指出 syntax.Walk 的回调总是继续遍历，并建议将 syntax.Preorder 作为行为不变的替代方案；先检查现有遍历如何收集可执行文件。完成标准是该调用点使用 Preorder，并保留相同的收集结果。
由索引模型根据 Issue 内容生成。
描述
Go Fan Report: mvdan.cc/sh/v3
Module Overview
mvdan.cc/sh/v3 (repo mvdan/sh) is a pure-Go shell parser, formatter, and interpreter (the engine behind shfmt), supporting POSIX Shell, Bash, Zsh, and mksh. gh-aw only imports its syntax subpackage, the AST parser, and does not use interp, expand, shell, or pattern.
Current Usage in gh-aw
- Files: 3 non-test files plus 1 test file, all in pkg/workflow/taint
- Purpose: static taint-tracking security analyzer for shell run steps in agentic workflows. It propagates untrusted data (issue/PR titles, comments, etc.) through assignments, command substitutions, redirects, pipes, and env/curl/wget calls, flagging leaks into logs, files, GITHUB_OUTPUT/GITHUB_ENV, or network requests.
- Key APIs: syntax.NewParser().Parse, syntax.Walk, and type-switching over CallExpr, BinaryCmd, IfClause, ForClause, WhileClause, CaseClause, FuncDecl, ParamExp, CmdSubst, and more.
Research Findings
Version pinned: v3.14.1, which is the latest release (published 2026-09-06). gh-aw is already fully up to date; no version bump needed.
Recent releases: v3.14.1 fixed heredoc indentation and a zsh parsing edge case (no effect on gh-aw). v3.14.0 added syntax.Preorder, a Walk-complementing iter.Seq[Node] range-over-func iterator, plus parser correctness fixes. v3.13.0 added Zsh language support to the parser.
Improvement Opportunities
Quick Wins:
- javascriptExecutables in pkg/workflow/taint/javascript_workflow.go (around line 223) calls syntax.Walk with a callback that always returns true, meaning it never prunes the traversal. This is exactly the case the new (v3.14.0) syntax.Preorder iterator was added for. Replacing it with a for node := range syntax.Preorder(tree) loop is a behavior-neutral readability improvement. The other 4 syntax.Walk call sites in the package rely on pruning and should keep using Walk directly.
Feature Opportunities:
- None of the interp/expand/pattern additions apply, since gh-aw correctly stays with the static syntax parser only.
- Zsh parsing is available since v3.13.0 but not modeled; shell.go explicitly reports a gap for any shell other than bash/sh. Low priority since GitHub Actions built-in shell values do not include zsh on hosted runners.
Best Practice Alignment:
- Parser configuration is already minimal and correct: no Variant, RecoverErrors, StopAt, or KeepPadding options are set, which is the right conservative choice for a security analyzer.
- Dependency surface is already minimal: only syntax is imported, never interp or cmd/shfmt.
Recommendations
- Optional, low risk: replace the javascriptExecutables syntax.Walk call with syntax.Preorder for a small readability win.
- No version bump needed; already on latest v3.14.1.
- No urgent action needed otherwise; the module is well-utilized and scoped tightly to the syntax subpackage for a legitimate static-analysis use case.
Generated by Go Fan. Module summary saved to scratchpad/mods/sh.md
References:
Generated by 🐹 Go Fan · claude · agent · 163.6 AIC · ⌖ 0.88 AIC · ⊞ 6.6K · ◷
- expires on Oct 20, 2026, 12:13 AM UTC-08:00
- 主要语言
- Go
- 星标
- 5.4k
- 派生
- 596
- 平均合并
- 3 小时 24 分钟
- 30 天内合并 PR
- 824
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/gh-aw 的其他 Issue
-
automation models
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
agent-research
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
agentic-workflows automation aw-essential cookie
难度 2/5 1-3 小时 新手友好度 65/100
维护者通常 1 天内回复
-
automated conformance safe-outputs
难度 1/5 1 小时以内 新手友好度 75/100
维护者通常 1 天内回复
-
automated conformance safe-outputs
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
相似的 Issue
-
bug triage
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
mvanhorn/cli-printing-press#5146 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 74/100
AvengeMedia/DankMaterialShell#3853 ·
-
难度 2/5 1-3 小时 新手友好度 60/100
-
难度 1/5 1 小时以内 新手友好度 85/100
维护者通常 1 天内回复