[typist] Typist: Go type duplication and map[string]any opportunities in pkg/

[github-actions[bot]]

🔤 Typist - Go Type Consistency Analysis

Analysis of repository: github/gh-aw

Executive Summary

Across 1,792 non-test Go files under pkg/ (1,911 type definitions), this analysis found 8 actionable duplicate-type clusters (0 exact, 2 near, 6 semantic) plus a focused set of untyped-usage opportunities. Production code has already fully migrated off legacy interface{} in favor of any (only 2 remaining references, both in comments). pkg/workflow/tools_types.go has already begun migrating map[string]any-shaped tool config to a typed ToolsConfig - the same ad hoc map pattern, with repeated manual type assertions, still appears in OTLP/observability parsing, GitHub guard-policy construction, and safe-outputs config generation, which is the highest-value remaining opportunity. The most impactful duplicate-type issue is three unrelated Finding structs (scanfindings, taint, gradershell) sharing one name across packages; cross-reference tracing confirmed scanfindings.Finding is used throughout pkg/cli, and the related workflow.Job type has 301 references across the compiler.

Full Analysis Report

Duplicated Type Definitions

Summary: 1911 types analyzed across 1792 files; 8 clusters (0 exact, 2 near, 6 semantic).

1. ToolCallInfo / ToolUsageInfo (near) - pkg/workflow/metrics.go:16 vs pkg/cli/audit_report.go:192. 5 of 6 fields match (MaxDuration differs: time.Duration vs formatted string). logs_models.go:115 already aliases ToolCallInfo for one path. Fix: reuse workflow.ToolCallInfo in audit_report.go; format MaxDuration only at render time. Impact: Medium.

2. graderManifestEntry (near) - pkg/workflow/compiler_yaml_graders.go:13 (full manifest entry) vs pkg/cli/audit_report_graders.go:67 (5-field projection), both decoding the same grader manifest JSON. Fix: share one type, or rename the CLI projection to graderManifestSummary. Impact: Medium.

3. Finding (semantic, 3 packages) - pkg/scanfindings/scanfindings.go:107, pkg/workflow/taint/taint.go:43, pkg/workflow/gradershell/check.go:14 are unrelated structs sharing one name. find_referencing_symbols confirmed scanfindings.Finding is the de facto shared model, used throughout pkg/cli. Fix: rename to TaintFinding / ShellWriteFinding. Impact: High.

4. Job (semantic, two layers) - pkg/workflow/actions/workflow.go:20 (typed model) vs pkg/workflow/jobs.go:50 (YAML-ready string model embedding *actions.Job). Cross-reference tracing found 301 references to workflow.Job. Fix: rename one layer (e.g. ActionsJob / YAMLJob) and document the lowering step; prefer rename over merge given the reference count. Impact: Medium.

5. RepoMemoryEntry / CacheMemoryEntry / DriveMemoryEntry (semantic) - repo_memory.go:51, cache_config.go:106, drive_memory_config.go:38; 5 of 9 fields overlap (ID, Description, AllowedExtensions, Validation, RestoreOnly). Fix: extract MemoryEntryBase, mirroring the existing types.BaseMCPServerConfig pattern. Impact: Medium.

6. ModelRoutingLogsSummary / ModelRoutingSummary (semantic) - logs_report.go:55 vs model_routing.go:65, both summarizing the same routing run. Fix: have the logs report reuse ModelRoutingSummarys cost/deviation fields. Impact: Low.

7. GraderResult / graderArtifactFullResult / graderArtifactResult (semantic) - three grader-result shapes in pkg/cli differing in Value type (*float64 vs json.RawMessage) and JSON tags. Fix: one canonical type with a RawMessage-to-float64 conversion step. Impact: Medium.

8. Tool usage summary types (semantic) - MCPToolSummary, ToolUsageSummary, MCPToolUsageSummary all embed ToolUsageStatsBase but repeat call-count/size/duration fields. Fix: derive aggregates from ToolUsageStatsBase, keep only grouping keys per summary. Impact: Medium.

---

Untyped Usages

Summary: legacy interface{} in production code: 0 (fully migrated to any); map[string]any occurrences (non-test, non-testdata): 584, concentrated in frontmatter/JSON config handling; untyped constant groups flagged: 1.

Category 1 - OTLP/observability config (pkg/workflow/observability_otlp.go, lines 176-328): functions getOTLPGitHubApp, getOTLPWorkloadIdentity, getOTLPGitHubAppTokenConfig, hasOTLPGitHubOIDCAuth, getOTLPIfMissingMode repeatedly chain obs["otlp"].(map[string]any) style assertions to walk the same frontmatter subtree. Fix: decode once into a typed OTLPFrontmatterConfig (with nested WorkloadIdentity/GitHubApp) and have each getter read struct fields. Impact: High - this is the largest concentration of repeated, panic-risk assertions found.

Category 2 - GitHub guard policies (pkg/workflow/mcp_github_config.go, lines 107-291): dynamicEnclaveGitHubGuardPolicies, staticEnclaveGitHubGuardPolicies, writeSinkGuardPolicy, hasGitHubApp, getGitHubType build/read a fully-known allow-only/write-sink shape via map[string]any. Fix: GuardPolicy/AllowOnlyPolicy/WriteSinkPolicy structs with yaml/json tags, converting to a map only at the YAML-emission boundary. Impact: Medium.

Category 3 - safe-outputs config.json assembly (pkg/workflow/safe_outputs_config_generation.go, lines 40-246): ~10 functions build the generated config.json (ledger_append, raw_steps, safe-job/script entries) as nested map[string]any. Fix: follow the precedent already set by tools_types.go (which documents an explicit, in-progress migration from "the pervasive map[string]any pattern" to a typed ToolsConfig via ParseToolsConfig/ToMap) and define a typed SafeOutputsConfigPayload instead. Impact: Medium.

Category 4 - untyped label/value constants (pkg/github/label_objective_mapping_compat_constants.go): ~15 ObjectiveLabel* (untyped string) / ObjectiveValue* (untyped int) constant pairs, e.g. ObjectiveLabelCritical = "critical", ObjectiveValueCritical = 100. The file is explicitly marked Deprecated (compat-only; runtime scoring uses DefaultObjectiveMapping() instead), so this is lower priority. Fix if revisited: type ObjectiveLabel string / type ObjectiveScore int, matching the SeverityLevel style already used in pkg/scanfindings. Impact: Low-Medium.

---

Refactoring Recommendations

Priority 1 (High, ~2-3h): Rename taint.Finding/gradershell.Finding to resolve the Finding collision; replace audit_report.go ToolUsageInfo with workflow.ToolCallInfo. Low risk (renames only).

Priority 2 (High, ~4-6h): Type the OTLP/observability frontmatter subtree in observability_otlp.go - removes the largest cluster of repeated type assertions found.

Priority 3 (Medium, ~6-8h): Type the GitHub guard-policy builders and extend the ToolsConfig precedent to safe_outputs_config_generation.go.

Priority 4 (Low, ~3-4h): Extract MemoryEntryBase for the repo/cache/drive memory entries; consolidate pkg/cli tool-usage summaries around ToolUsageStatsBase.

Implementation Checklist

• Resolve the Finding name collision (taint, gradershell)
• Reuse workflow.ToolCallInfo in pkg/cli/audit_report.go
• Type the OTLP/observability frontmatter subtree
• Type GitHub guard-policy builders in mcp_github_config.go
• Extend the ToolsConfig precedent to safe_outputs_config_generation.go
• Extract MemoryEntryBase for memory entry types
• Consolidate pkg/cli tool-usage summaries around ToolUsageStatsBase

Analysis Metadata

• Total Go Files Analyzed: 1792 (pkg/, non-test)
• Total Type Definitions: 1911
• Duplicate Clusters: 8 (0 exact, 2 near, 6 semantic)
• Untyped Usage Categories Flagged: 4
• Detection Method: Serena semantic analysis (get_symbols_overview, find_referencing_symbols) + grep pattern matching
• Analysis Date: 2026-10-28

Generated by ✍️ Typist - Go Type Analysis · claude · agent · ~95 AIC · ⌖ ~1 AIC · ⊞ 4.5K · ◷

• expires on Oct 29, 2026, 3:34 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-29T11:34:03.251Z.

Closed by Workflow