go/concurrency
go/concurrency reviews Go concurrency for lifecycle races, cancellation ownership mistakes, WaitGroup misuse, and unsafe channel or synchronization patterns an experienced Go engineer would block.
It is a concurrency domain reviewer, not a general race detector or linter. It prefers silence over speculative warnings. When it reports, the concurrent work cannot start, stop, fail, or complete predictably.
What it does
- Discovers non-test Go files (
*.go, excluding*_test.go). - Parses with Tree-sitter Go and runs structural detectors with stable rule ids.
- Synthesizes a review focused on lifecycle ownership.
- Optionally enhances with a model when provided — ranking and explanation only.
It never executes the scanned project as the product under review, never installs dependencies into it, and never needs network access to the target repository.
What it detects
Every shipped rule id, severity, and short description lives in CHECKS.md — the audit surface for “what does this adversary look for?”
Highlights:
| Area | Examples |
|---|---|
| Cancellation | Unused cancel functions; context not derived for child work |
| WaitGroup | Add inside goroutine; WaitGroup copied by value; lifecycle races |
| Channels | Self-deadlock patterns; busy select with default |
| Timers | time.Ticker / Timer not stopped |
| Loops | Loop variable capture in goroutines |
| Mutex | Mutex copied by value |
Ownership boundaries
Other official adversaries own adjacent classes so findings stay non-duplicative:
| Concern | Owned by |
|---|---|
| CLI process/subprocess cancellation at the command boundary | go/cli |
| HTTP server/client timeouts and request contexts | go/http |
| DB rows/transaction lifecycle | go/database |
Precision stance
- High confidence only for deterministic, evidence-backed patterns.
- Clean fixtures must stay quiet; vulnerable fixtures must fire where graded fixtures exist.
- Prefer missing a weak signal over a false positive on normal production code.