chore: cleanup golangci-lint and cspell findings#7548
Merged
weikanglim merged 4 commits intoAzure:mainfrom Apr 7, 2026
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Document callback-owned cancellation in vsrpc and move spinner cancellation setup below Run() so Stop remains the owner of the callback lifecycle. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
weikanglim
force-pushed
the
weikanglim/issue-7426-lint-cspell-cleanup
branch
from
f9920ed to
22e5561
Compare
weikanglim
force-pushed
the
weikanglim/issue-7426-lint-cspell-cleanup
branch
from
22e5561 to
e98cb60
Compare
weikanglim
requested review from
JeffreyCA,
hemarina,
jongio,
rajeshkamal5050,
tg-msft,
vhvb1989 and
wbreza
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses issue #7426 by clearing remaining golangci-lint (gosec) and cspell findings while preserving intended behavior, including a targeted hardening of local template .gitignore reads during initialization.
Changes:
- Anchor local template
.gitignorereads to the template root usingos.OpenRootto prevent nested.gitignoreresolution from escaping the template tree. - Add/relocate
gosecsuppressions with more precise justifications (process inspection on macOS, cancellation callbacks, trusted/managed output paths, local FastAPI detection). - Promote repo-specific spellings into the shared cspell dictionary and adjust file-scoped overrides.
Show a summary per file
| File | Description |
|---|---|
| cli/azd/pkg/ux/spinner.go | Moves WithCancel setup to a clearer location and updates gosec suppression formatting for stored cancel func. |
| cli/azd/pkg/tools/dotnet/dotnet.go | Refines gosec suppression placement/reasoning for writing an azd-managed manifest path. |
| cli/azd/pkg/infra/provisioning/terraform/terraform_provider.go | Refines gosec suppression reasoning for writing parameters into the managed environment directory. |
| cli/azd/pkg/azdext/process_darwin.go | Adds gosec suppressions for exec.Command with PID-derived args (macOS process inspection). |
| cli/azd/pkg/azdext/azd_client.go | Rewords TLS comment for clarity (“man-in-the-middle”). |
| cli/azd/pkg/azdext/atomicfile.go | Fixes spelling (“file systems”). |
| cli/azd/internal/vsrpc/server.go | Adjusts gosec suppression placement and preserves tracing context when creating per-call cancelable contexts. |
| cli/azd/internal/runcontext/agentdetect/detect_process_darwin.go | Adds gosec suppressions for exec.Command with PID-derived args (macOS parent process inspection). |
| cli/azd/internal/repository/initializer.go | Uses os.OpenRoot(source) + relative reads for .gitignore to prevent escaping the local template tree. |
| cli/azd/internal/appdetect/python.go | Adds gosec suppression for opening local project files during FastAPI launch detection. |
| cli/azd/.vscode/cspell.yaml | Adds file-scoped overrides for compat identifiers; removes now-unneeded overrides after dictionary promotion. |
| cli/azd/.vscode/cspell-azd-dictionary.txt | Adds repo terms (e.g., GOWORK, covdata, ndjson, googleapis) to the shared dictionary. |
Copilot's findings
- Files reviewed: 11/12 changed files
- Comments generated: 0
JeffreyCA
approved these changes
Apr 7, 2026
jongio
reviewed
Apr 7, 2026
Member
jongio
left a comment
jongio
left a comment
There was a problem hiding this comment.
Clean lint cleanup. One note: the childCtx change in server.go isn't just a nolint reformat - it switches the cancel context's parent from ctx to childCtx, which preserves the tracing span from tracing.Start. The old code was dropping that span for Call requests. Worth mentioning in the PR description since it's a behavior correction, not just a lint fix.
Everything else checks out - os.OpenRoot is the right API for path confinement, spinner reorder is safe (Stop() handles nil cancel), and the cspell promotions are clean.
Collaborator
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
wbreza
approved these changes
Apr 7, 2026
Contributor
wbreza
left a comment
wbreza
left a comment
There was a problem hiding this comment.
Code review: no significant issues found. Linter fixes are appropriate, security hardening with os.Root for path traversal prevention is correct, and lint suppressions are well-justified. LGTM.
vhvb1989
approved these changes
Apr 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #7426.
This PR cleans up the remaining
golangci-lintandcspellfindings and includes one small correctness fix invsrpcthat fell out of the lint cleanup..gitignorereads to the template root so nested.gitignorefiles can't escape the local template tree during initialization.internal/vsrpc/server.goto derive per-call cancelable contexts fromchildCtx, which preserves the tracing span fromtracing.Startfor Call requests instead of dropping it.gosecsuppressions where the flagged values are already trusted, managed by azd, or owned by a later callback (local FastAPI detection, Darwin process inspection, spinner/server cancellation callbacks, and managed output paths).