[sergo] Enforce osexitinlibrary + rawloginlib analyzers in CI (zero prod violations) (#aw_sg20a1)

[github-actions]

Summary

Two registered custom analyzers — osexitinlibrary and rawloginlib — currently run under the gh-aw multichecker binary at cmd/linters/main.go:46-49 but are not part of the -positive-selector LINTER_FLAGS list in CI at .github/workflows/cgo.yml:1041:

# .github/workflows/cgo.yml:1041
run: make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -test=false"

Audit confirms ZERO production violations of either analyzer in pkg/ (excluding _test.go and testdata/):

Analyzer	Prod violations in pkg/
osexitinlibrary	0
rawloginlib	0

This is the safest possible upgrade — enforcement is purely defensive (locks in existing discipline) with zero refactor cost. Both linters skip cmd/ and *_test.go automatically via pkg/linters/internal/filecheck.

Why this matters

• os.Exit in library code bypasses defer cleanup and makes packages untestable. Library callers cannot recover.
• Stdlib log.* in library code emits unstructured output to os.Stderr, bypasses pkg/logger's contextual fields, and the log.Fatal* family also calls os.Exit(1).
• Both classes of bug are easy to introduce by accident (auto-imports). Without CI enforcement the discipline drifts.

Recommended Fix

Append the two flags to the LINTER_FLAGS positive selector at .github/workflows/cgo.yml:1041:

run: make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -osexitinlibrary -rawloginlib -test=false"

The pattern follows the documented ci_linter_enforce convention (positive selector, -test=false to skip stdlib test files).

Validation

• Confirm make golint-custom LINTER_FLAGS="-osexitinlibrary -rawloginlib -test=false" passes locally with zero diagnostics
• Confirm CI run passes after appending both flags
• Verify the pkg/linters/README.md lists both as enforced

Severity

High — Pure CI hardening with zero code changes required. Locks in existing discipline.

Sergo Context

• Run 20 strategy: reverify-plus-unenforced-linter-zero-violation-audit
• Prior CI enforcement adds: errstringmatch (R13), panicinlibrarycode (R19)
• See sg14a1 (Silent error discards on os.Setenv / os.Chdir in pkg/cli (10 prod sites) #33459) for ossetenvlibrary — still has 4 prod violations and cannot be enforced yet
• See #aw_sg19a1 (refiled) for manualmutexunlock — 16 prod sites prevent enforcement

---

Filed by Sergo Run 20 — workflow run §26491943719

Generated by 🤖 Sergo - Serena Go Expert · opus47 16.9M · ◷

• expires on Jun 3, 2026, 5:16 AM UTC

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · haiku45 33.6K · ◷