Add Go rewrite of autosolve actions by fantapop · Pull Request #8 · cockroachdb/actions

fantapop · 2026-03-19T21:14:18Z

Single Go binary (autosolve) replaces the bash script chain with typed config, mockable interfaces for Claude CLI and GitHub API, embedded prompt templates, and 45 unit tests. Composite action YAMLs reduced to two steps each (build + run).

Copilot

Pull request overview

This PR introduces a Go-based autosolve CLI to replace the prior bash-script chain for the autosolve GitHub Actions, aiming for typed configuration, testable interfaces, and embedded prompt templates.

Changes:

Add a new Go module (autosolve-go) implementing assess/implement/security/prompt subcommands with Claude CLI + GitHub API wrappers.
Embed prompt templates (security preamble + assessment/implementation footers) and generate prompts on the fly.
Update composite GitHub Actions to build and run the new Go binary in two steps (build + run).

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
autosolve-go/go.mod	Introduces Go module definition and dependencies for the autosolve CLI.
autosolve-go/go.sum	Adds dependency checksums.
autosolve-go/Makefile	Adds basic build/test/clean targets for the Go implementation.
autosolve-go/cmd/autosolve/main.go	Adds the main CLI entrypoint and subcommand wiring for GitHub Actions usage.
autosolve-go/internal/action/action.go	Adds helpers for GitHub Actions outputs, summaries, and log annotations.
autosolve-go/internal/action/action_test.go	Adds unit tests for GitHub Actions I/O helpers.
autosolve-go/internal/assess/assess.go	Implements the assessment phase orchestration.
autosolve-go/internal/assess/assess_test.go	Adds unit tests for assessment phase behavior and outputs.
autosolve-go/internal/claude/claude.go	Implements Claude CLI runner and output parsing helpers.
autosolve-go/internal/claude/claude_test.go	Adds unit tests for Claude JSON parsing and marker detection.
autosolve-go/internal/config/config.go	Adds typed config loading/validation from GitHub Actions env inputs.
autosolve-go/internal/config/config_test.go	Adds unit tests for config validation and parsing behavior.
autosolve-go/internal/github/github.go	Adds a `gh`-CLI-backed GitHub client wrapper interface/implementation.
autosolve-go/internal/implement/implement.go	Implements retry orchestration, security checks, and PR creation flow.
autosolve-go/internal/implement/implement_test.go	Adds unit tests for retry behavior, output writing, and orchestration outcomes.
autosolve-go/internal/prompt/prompt.go	Implements prompt assembly from embedded templates and inputs.
autosolve-go/internal/prompt/prompt_test.go	Adds unit tests for prompt assembly variants and error cases.
autosolve-go/internal/prompt/templates/security-preamble.md	Adds embedded security preamble template for the Claude prompt.
autosolve-go/internal/prompt/templates/assessment-footer.md	Adds embedded assessment footer template and output marker requirement.
autosolve-go/internal/prompt/templates/implementation-footer.md	Adds embedded implementation footer template and output marker requirement.
autosolve-go/internal/security/security.go	Adds working-tree blocked-path checks and symlink detection.
autosolve-go/internal/security/security_test.go	Adds unit tests for security blocked-path detection and staging behavior.
autosolve-go/assess/action.yml	Updates assess composite action to build/run the Go binary.
autosolve-go/implement/action.yml	Updates implement composite action to build/run the Go binary.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-19T21:18:48Z

autosolve-go/internal/implement/implement.go

+		p := cfg.Prompt
+		if p == "" {
+			p = "automated change"
+		}
+		if len(p) > 72 {
+			p = p[:72]
+		}
+		subject = "autosolve: " + p
+	}


When falling back to deriving the commit subject from cfg.Prompt, the prompt can contain newlines or leading/trailing whitespace, which can produce a malformed multi-line subject (and an odd PR title derived from it). Consider normalizing to the first line, trimming whitespace, and then enforcing the 72-character limit.

Done. Now normalizes to first line, trims whitespace, and enforces the 72-char limit (named const maxCommitSubjectLen). </claude>

Copilot · 2026-03-19T21:18:48Z

autosolve-go/internal/security/security.go

+		// Check symlinks pointing into blocked paths
+		info, err := os.Lstat(file)
+		if err != nil {
+			continue
+		}
+		if info.Mode()&os.ModeSymlink != 0 {
+			target, err := filepath.EvalSymlinks(file)
+			if err != nil {
+				continue
+			}
+			for _, blocked := range blockedPaths {
+				if strings.Contains(target, "/"+blocked) {
+					violations = append(violations, fmt.Sprintf("symlink to blocked path: %s -> %s", file, target))
+				}
+			}
+		}


The symlink protection is incomplete and can be bypassed:

It only checks EvalSymlinks when the changed file itself is a symlink, so changes under a symlinked directory (e.g. allowed_dir/file where allowed_dir -> secrets/) won't be detected.

The strings.Contains(target, "/"+blocked) check is not a reliable path-boundary check and can miss cases like a symlink resolving exactly to a blocked directory path.
Consider resolving the real path for every changed file (or its parent dir if needed), then compare against cleaned absolute blocked prefixes (repoRoot + blocked) using filepath.Clean + prefix checks with path separators.

Done. Now resolves real path for every changed file (not just symlinks), and compares against cleaned absolute blocked path prefixes using filepath.Clean + separator-aware prefix checks. </claude>

Copilot · 2026-03-19T21:18:48Z

autosolve-go/internal/action/action.go

+	delim := fmt.Sprintf("GHEOF_%d", os.Getpid())
+	content := fmt.Sprintf("%s<<%s\n%s\n%s", key, delim, value, delim)
+	appendToFile(os.Getenv("GITHUB_OUTPUT"), content)


The multiline output delimiter is derived only from the PID (GHEOF_<pid>). If the output value happens to contain that delimiter (or if multiple processes write to the same output file), the GitHub Actions output file can become malformed. Prefer a cryptographically-random delimiter (and/or ensure the delimiter does not appear in value) to make this robust.

Done. Now uses crypto/rand to generate a 16-byte hex suffix for the delimiter, with PID-based fallback only if rand fails. </claude>

Copilot · 2026-03-19T21:18:48Z

autosolve-go/internal/security/security_test.go

+	_ = filepath.Base(dir) // use filepath to avoid unused import
+}


The filepath import is only kept alive via _ = filepath.Base(dir); this makes the test harder to read and is easy to forget about later. Remove the unused import and the dummy reference instead of using a no-op line.

Done. Removed both the dummy _ = filepath.Base(dir) line and the path/filepath import. </claude>

Copilot · 2026-03-19T21:18:49Z

autosolve-go/internal/github/github.go

+	}
+	_ = out // TODO: parse JSON response
+	return nil, nil
+}


ListPRs currently discards the gh pr list JSON output and returns (nil, nil) even on success. This makes it very easy for callers to mis-handle the result (nil slice with no error) and hides incomplete functionality behind a seemingly valid API. Either parse and return the PRs, or return a clear "not implemented" error until it's needed.

Done. Removed ListPRs entirely along with the ListPRsOptions and PR types — they weren't needed. </claude>

Copilot · 2026-03-19T21:18:49Z

autosolve-go/internal/implement/implement.go

+	// Stage tracked modifications
+	_ = exec.Command("git", "add", "--update").Run()


git add --update only stages modifications/deletions of already-tracked files. If Claude creates new files (a common outcome), they will not be included in the commit and this can also cause a false "no changes to commit" error. Use a staging command that includes new files as well (e.g. git add -A) after removing the autosolve metadata files.

Suggested change

// Stage tracked modifications

_ = exec.Command("git", "add", "--update").Run()

// Stage all changes (including new files and deletions)

_ = exec.Command("git", "add", "-A").Run()

Done. Changed to git add -A to include new files created by Claude. </claude>

Copilot · 2026-03-19T21:18:49Z

autosolve-go/internal/implement/implement.go

+			opts.Resume = sessionID
+			opts.RetryPrompt = retryPrompt


Retry attempts always set opts.RetryPrompt, but if sessionID is empty then CLIRunner.Run won't provide any stdin (it only uses RetryPrompt when Resume is set). This can cause the retry invocation to hang or fail unexpectedly. Handle the empty-session case explicitly (e.g., re-run with the original prompt file, or treat it as a hard error before retrying).

Suggested change

opts.Resume = sessionID

opts.RetryPrompt = retryPrompt

if sessionID == "" {

action.LogWarning("No session ID from previous attempt; restarting conversation with original prompt")

opts.PromptFile = promptFile

} else {

opts.Resume = sessionID

opts.RetryPrompt = retryPrompt

}

Done. Now explicitly handles empty session: logs a warning and restarts with the original prompt file instead of hanging. </claude>

fantapop · 2026-03-19T21:34:00Z

autosolve-go/internal/github/github.go

+}
+
+// PROptions configures PR creation.
+type PROptions struct {


This type name is hard to read. Let's change it to PullRequestOptions

Done. Renamed to PullRequestOptions. </claude>

fantapop · 2026-03-19T21:34:27Z

autosolve-go/internal/github/github.go

+}
+
+// PR represents a pull request.
+type PR struct {


lets' change to PullRequest

Removed this type entirely along with ListPRs — it wasn't used. </claude>

fantapop · 2026-03-19T21:34:37Z

autosolve-go/internal/github/github.go

+}
+
+// GHClient implements Client by shelling out to the gh CLI.
+type GHClient struct {


Let's change to GithubClient

Done. Renamed to GithubClient. </claude>

fantapop · 2026-03-19T21:35:24Z

autosolve-go/internal/github/github.go

+	if err != nil {
+		return nil, fmt.Errorf("listing PRs: %w", err)
+	}
+	_ = out // TODO: parse JSON response


Let's not leave TODO comments. Is there something to be done here?

Removed — the TODO was for implementing ListPRs which we removed entirely. </claude>

fantapop · 2026-03-19T21:37:19Z

autosolve-go/internal/implement/implement.go

+		if positive {
+			action.LogNotice(fmt.Sprintf("Implementation succeeded on attempt %d", attempt))
+			implStatus = "SUCCESS"
+			_ = os.WriteFile(resultFile, []byte(resultText), 0644)


Is this skipping an error check? I see some later in this file as well. Ideally we would check those

Done. All os.WriteFile calls now have error checks — warnings are logged if writes fail. </claude>

fantapop · 2026-03-19T21:42:16Z

autosolve-go/internal/implement/implement.go

+	if commitBody != "" {
+		commitMsg += "\n\n" + commitBody
+	}
+	commitMsg += "\n\nCo-Authored-By: Claude <noreply@anthropic.com>"


The signature should be pulled out to a configuration value. It can default to this.

Done. Added CommitSignature config field (defaults to Co-Authored-By: Claude <noreply@anthropic.com>, configurable via INPUT_COMMIT_SIGNATURE). </claude>

fantapop · 2026-03-19T21:43:13Z

autosolve-go/internal/implement/implement.go

+	if err != nil {
+		return
+	}
+	_ = os.WriteFile(filepath.Join(tmpDir, "autosolve-pr-body"), data, 0644)


this seems like an error we should check

Done. Error checked — logs a warning if the write fails. </claude>

fantapop · 2026-03-19T21:43:45Z

autosolve-go/internal/implement/implement.go

+		}
+	}
+
+	body += "\n\n---\n\n*This PR was auto-generated by [claude-autosolve-action](https://github.com/cockroachdb/actions) using Claude Code.*\n*Please review carefully before approving.*"


Let's make this controllable via configuration

Done. Added PRFooter config field (configurable via INPUT_PR_FOOTER), with a sensible default. </claude>

fantapop · 2026-03-19T21:45:24Z

autosolve-go/internal/prompt/prompt.go

+	if prompt != "" {
+		return prompt
+	}
+	return fmt.Sprintf("Fix GitHub issue #%s.\nTitle: %s\nBody: %s", issueNumber, issueTitle, issueBody)


It would be nice if we exposed this as a configurable template somehow...

Done. BuildIssuePrompt now accepts an optional template string with {{ISSUE_NUMBER}}, {{ISSUE_TITLE}}, and {{ISSUE_BODY}} placeholders (configurable via INPUT_ISSUE_PROMPT_TEMPLATE). Falls back to a sensible default. </claude>

fantapop · 2026-03-19T21:47:00Z

autosolve-go/internal/security/security.go

+	for _, args := range [][]string{
+		{"git", "diff", "--name-only"},
+		{"git", "diff", "--name-only", "--cached"},
+		{"git", "ls-files", "--others", "--exclude-standard"},
+	} {
+		out, err := exec.Command(args[0], args[1:]...).Output()


Ideally this could use a git client hidden behind an interface. discussed earlier.

Done. security.Check now takes a git.Client parameter. Tests updated to pass &git.CLIClient{}. </claude>

github-actions · 2026-03-20T22:38:39Z

.github/workflows/github-issue-autosolve.yml

+      - name: Move credentials out of workspace
+        if: inputs.auth_mode == 'vertex' && inputs.vertex_workload_identity_provider != ''
+        shell: bash
+        run: |


🚫 [actionlint] _{reported by reviewdog 🐶}
shellcheck reported issue in this script: SC2129:style:6:3: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]

Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>

fantapop requested a review from Copilot March 19, 2026 21:14

Copilot started reviewing on behalf of fantapop March 19, 2026 21:15 View session

Copilot AI reviewed Mar 19, 2026

View reviewed changes

fantapop force-pushed the autosolve-go-rewrite branch from 7f74273 to 3b9b49a Compare March 19, 2026 21:26

fantapop commented Mar 19, 2026

View reviewed changes

fantapop force-pushed the autosolve-go-rewrite branch 9 times, most recently from a898747 to c102f72 Compare March 20, 2026 22:38

github-actions bot reviewed Mar 20, 2026

View reviewed changes

fantapop force-pushed the autosolve-go-rewrite branch from c102f72 to 0202471 Compare March 20, 2026 22:46

fantapop and others added 3 commits March 20, 2026 15:51

Add Go rewrite of autosolve actions

d4a965e

Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>

Add security hardening to bash autosolve implementation

417d4b9

Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>

Add silent error handling convention to CLAUDE.md

3f51ac4

Co-Authored-By: roachdev-claude <roachdev-claude-bot@cockroachlabs.com>

fantapop force-pushed the autosolve-go-rewrite branch from 0202471 to 3f51ac4 Compare March 20, 2026 22:51

		_ = filepath.Base(dir) // use filepath to avoid unused import
		}

		// Stage tracked modifications
		_ = exec.Command("git", "add", "--update").Run()

Conversation

fantapop commented Mar 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment