[lint-monster] LintMonster: harden indexing and data handling (1,996 findings) #65473

Findings

The current make golint-custom run reports 1,996 remaining value-handling findings: 1,772 direct slice/string indexes without an established bounds check, 158 type assertions that discard the ok result, 46 manual slash-path concatenations, 8 mutations of package-level slice/map state, 7 string-builder reuse cases without Reset(), 3 case-insensitive comparisons better expressed with strings.EqualFold, and 2 boolean maps used as sets. The largest areas are pkg/cli (680 indexing findings), pkg/workflow (591), pkg/parser (239), and pkg/linters (179).

Representative diagnostics include direct indexing in pkg/logger and pkg/stringutil, and shared package-state mutation in pkg/workflow and pkg/cli.

Remediation checklist

• Establish safe bounds before indexing and preserve the intended behavior for empty or short inputs.
• Handle type assertion success explicitly and address package-level mutable state without introducing races.
• Apply the targeted path, builder, comparison, and set idioms only at reported locations.
• Keep changes scoped to this diagnostic group, use minimal edits, and run make golint-custom to validate.

Expected outcome: reported value-access and shared-state hazards are handled deliberately, and the remaining data-handling diagnostics follow the repository’s established Go idioms.