Skip to content

feat(go): package-level var Source 3 + StdlibLoader embed resolution#643

Merged
shivasurya merged 1 commit intomainfrom
shiva/pr-03-golang-thirdparty
Apr 7, 2026
Merged

feat(go): package-level var Source 3 + StdlibLoader embed resolution#643
shivasurya merged 1 commit intomainfrom
shiva/pr-03-golang-thirdparty

Conversation

@shivasurya
Copy link
Copy Markdown
Owner

Summary

  • Fix F8 (Source 3): Add package-level variable type resolution to Pattern 1b in resolveGoCallTarget. When Source 1 (function params) and Source 2 (scope bindings) both fail, Source 3 scans codeGraph.Nodes for module_variable nodes in the same package as the caller. Reads node.DataType (e.g. *sql.DB), strips pointer prefix, resolves via importMap. Fixes the one PoC failure: globalDB.Query()database/sql.DB.Query. Extends resolveGoCallTarget signature with codeGraph *graph.CodeGraph.
  • Fix C (cross-package embeds): Add resolveEmbeddings method to GoThirdPartyLocalLoader. Tries StdlibLoader.GetType first (covers all stdlib interfaces: context.Context, sort.Interface, etc.), falls back to the hardcoded well-known table when StdlibLoader is nil. Add registry field to loader; wire via InitGoThirdPartyLoader. Called in getOrLoadPackage after tree-sitter extraction.

Test plan

  • TestSource3_PackageLevelVariablevar globalDB *sql.DB resolves globalDB.Querydatabase/sql.DB.Query
  • TestSource3_PointerType — leading * stripped from DataType
  • TestSource3_SamePackageFilter — variable in different package is NOT resolved
  • TestSource3_NoTypeAnnotation — empty DataType skipped gracefully
  • TestSource3_NilCodeGraph — no panic with nil codeGraph
  • TestResolveEmbeddings_ViaStdlibLoadercontext.Context methods flattened via StdlibLoader
  • TestResolveEmbeddings_FallbackToWellKnownio.Closer.Close resolves without StdlibLoader
  • TestResolveEmbeddings_NilRegistryStdlibLoader — no panic, fallback fires
  • TestResolveEmbeddings_DoesNotOverwriteExistingMethods — existing methods preserved
  • TestResolveEmbeddings_SamePackageEmbedSkipped — same-package embeds ignored
  • Full suite: go test ./... — 29/29 packages pass
  • Lint: golangci-lint run — 0 issues

🤖 Generated with Claude Code

@shivasurya shivasurya added enhancement New feature or request go Pull requests that update go code labels Apr 5, 2026
@shivasurya shivasurya self-assigned this Apr 5, 2026
@safedep
Copy link
Copy Markdown

safedep bot commented Apr 5, 2026

SafeDep Report Summary

Green Malicious Packages Badge Green Vulnerable Packages Badge Green Risky License Badge

No dependency changes detected. Nothing to scan.

View complete scan results →

This report is generated by SafeDep Github App

@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 5, 2026

Code Pathfinder Security Scan

Pass Critical High Medium Low Info

No security issues detected.

Metric Value
Files Scanned 9
Rules 205

Powered by Code Pathfinder

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 5, 2026

Codecov Report

❌ Patch coverage is 94.11765% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.24%. Comparing base (4eb8da7) to head (4b48d38).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
sast-engine/graph/callgraph/builder/go_builder.go 83.33% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #643      +/-   ##
==========================================
+ Coverage   84.22%   84.24%   +0.01%     
==========================================
  Files         162      162              
  Lines       23327    23358      +31     
==========================================
+ Hits        19648    19677      +29     
- Misses       2940     2941       +1     
- Partials      739      740       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Owner Author

shivasurya commented Apr 7, 2026

Merge activity

  • Apr 7, 8:35 PM UTC: A user started a stack merge that includes this pull request via Graphite.
  • Apr 7, 8:39 PM UTC: Graphite rebased this pull request as part of a merge.
  • Apr 7, 8:39 PM UTC: @shivasurya merged this pull request with Graphite.

@shivasurya shivasurya changed the base branch from shiva/pr-02-golang-thirdparty to graphite-base/643 April 7, 2026 20:36
@shivasurya shivasurya changed the base branch from graphite-base/643 to main April 7, 2026 20:37
…d fix

Fix F8: Add Source 3 to Pattern 1b in resolveGoCallTarget. Scans
codeGraph.Nodes for module_variable nodes (var globalDB *sql.DB)
in the same package as the caller when Source 1 (params) and
Source 2 (scope) both fail. Reads type from node.DataType, strips
pointer prefix, resolves via importMap. Extends resolveGoCallTarget
signature to accept codeGraph; updates all call sites.

Fix C: Add resolveEmbeddings method to GoThirdPartyLocalLoader.
Tries StdlibLoader.GetType first (covers all stdlib interfaces like
context.Context and sort.Interface), falls back to the hardcoded
well-known table when StdlibLoader is unavailable. Add registry
field to GoThirdPartyLocalLoader and pass it from
InitGoThirdPartyLoader. resolveEmbeddings is called in
getOrLoadPackage after extractGoPackageWithTreeSitter.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@shivasurya shivasurya force-pushed the shiva/pr-03-golang-thirdparty branch from 02bc40f to 4b48d38 Compare April 7, 2026 20:38
@shivasurya shivasurya merged commit 81346a6 into main Apr 7, 2026
6 checks passed
@shivasurya shivasurya deleted the shiva/pr-03-golang-thirdparty branch April 7, 2026 20:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant