The workflow downloads MySQL tarballs via raw curl URLs, which bypasses dbdeployer’s existing downloads machinery (user-agent handling for dev.mysql.com, checksum verification when available, retries, etc.). This increases supply-chain risk and makes the workflow more brittle if MySQL changes download behavior. Consider replacing the custom download logic with dbdeployer downloads get-by-version / get-unpack (run from /tmp/mysql-tarball so caching still works), or at minimum add pinned SHA256 verification for each version in the matrix.

These steps rely on ~/sandboxes/msb_* / ~/sandboxes/rsandbox_* globbing and then call dbdeployer delete all, which could unintentionally target unrelated sandboxes if anything else created them in the runner’s home directory. To make the job self-contained and deterministic, set SANDBOX_HOME to a job-local directory (e.g., inside ${{ github.workspace }}) and reference $SANDBOX_HOME/... explicitly; then delete only within that directory (or delete the specific sandbox name you just created).

pkill -9 mysqld is very broad and can terminate any mysqld process on the runner, not just the ones started by this job. If extra cleanup is needed beyond dbdeployer delete, consider scoping the kill to the current user and/or sandbox home (e.g., by reading PID files under the sandbox directory) to avoid collateral termination.

⚠️ Potential issue | 🟠 Major

#!/bin/bash
# Verify whether G112-relevant server code exists outside tests.
rg -nP --type=go -g '!**/*_test.go' 'http\.Server\s*\{' -C2
rg -nP --type=go -g '!**/*_test.go' '\bReadHeaderTimeout\s*:' -C1

# Verify .golangci.yml exists and check the exact state around lines 16-19
cat -n .golangci.yml | head -30

# Broader search for HTTP server usage in non-test code
rg -i 'http\.Server|net\.Listen|ListenAndServe' --type=go -g '!**/*_test.go' | head -20

# Check for any Unlock() usage in codebase
rg 'Unlock\s*\(' --type=go -B2 -A2 | head -40

# Understand the repository structure and purpose
ls -la && cat README.md | head -50

Scope G112 suppression to test files as general practice; lock.Unlock suppression requires attention.

Line 19 disables G112 globally, which is unnecessary for this codebase: a search for HTTP servers in non-test code returns no results (dbdeployer is a CLI deployment tool, not an HTTP server). While scoping to test files is still good lint hygiene, the original justification (masking server code) does not apply here.

However, the broader concern about line 24–26 (lock.Unlock suppression) is valid. The global exclusion suppresses all errcheck findings for unlock operations. While most code properly uses defer lock.Unlock(), defaults/catalog.go shows an intentional _ = lock.Unlock() that bypasses the check. Rather than suppress errors globally, fix the specific unlock error at its source or add a scoped exclusion if intentional.

 linters-settings:
   errcheck:
     check-type-assertions: false
   gosec:
     excludes:
       - G115  # integer overflow int64->uint64 on file sizes — safe
-      - G112  # Slowloris in test code only
 
 issues:
   exclude-use-default: true
   exclude-rules:
+    - path: '.*_test\.go'
+      linters:
+        - gosec
+      text: "G112"
     - linters:
         - errcheck
       text: "lock.Unlock"

Verify each finding against the current code and only fix it if needed.

In @.golangci.yml around lines 16 - 19, The global G112 suppression and the
broad errcheck unlock suppression are too wide; update .golangci.yml to restrict
G112 to test files only and remove the global errcheck exclusion for
lock.Unlock, then fix the specific occurrence in defaults/catalog.go by either
using defer lock.Unlock(), handling the returned error explicitly instead of "_
= lock.Unlock()", or add a file-scoped errcheck exclusion comment directly above
the intentional unlock if you must ignore it; reference G112, errcheck,
lock.Unlock, and defaults/catalog.go to locate and apply these changes.

⚠️ Potential issue | 🟠 Major

#!/bin/bash
# Find unchecked Unlock() calls that may be hidden by errcheck exclusions.
rg -nP --type=go -C2 '\b_?\s*=\s*[A-Za-z_][A-Za-z0-9_]*\.Unlock\s*\(\)|\bdefer\s+[A-Za-z_][A-Za-z0-9_]*\.Unlock\s*\(\)'

# Check the .golangci.yml to confirm the exclude-rule
cat .golangci.yml

# Get broader context around the Unlock calls in defaults/catalog.go
cat -n defaults/catalog.go | sed -n '65,80p;140,150p;165,180p'

# Search for all lock.Unlock calls to see complete picture
rg -n "lock\.Unlock" --type=go

# Get function names for the other two Unlock calls
cat -n defaults/catalog.go | sed -n '135,150p;160,180p'

# Find the function name for the Unlock at line 145
cat -n defaults/catalog.go | sed -n '120,145p'

Remove the errcheck exclusion for lock.Unlock and handle errors at all call sites.

The global suppress rule in .golangci.yml masks unchecked unlock errors across three functions:

• ReadCatalog() (line 73): _ = lock.Unlock()
• UpdateCatalog() (line 145): defer lock.Unlock()
• DeleteFromCatalog() (line 171): defer lock.Unlock()

Remove the exclusion and apply proper error handling to all three functions:

 issues:
   exclude-use-default: true
-  exclude-rules:
-    - linters:
-        - errcheck
-      text: "lock.Unlock"
+  exclude-rules: []

// For ReadCatalog()
defer func() {
	if unlockErr := lock.Unlock(); unlockErr != nil && err == nil {
		err = unlockErr
	}
}()

// For UpdateCatalog() and DeleteFromCatalog()
defer func() {
	if unlockErr := lock.Unlock(); unlockErr != nil {
		// Log or return the error based on function signature
	}
}()

Verify each finding against the current code and only fix it if needed.

In @.golangci.yml around lines 23 - 26, Remove the global errcheck exclusion for
"lock.Unlock" from .golangci.yml and update all call sites to handle Unlock
errors: in ReadCatalog() wrap the deferred Unlock in a closure that captures
unlockErr and, if the function uses a named error return (err), set err =
unlockErr when err is nil; in UpdateCatalog() and DeleteFromCatalog() wrap the
deferred Unlock in a closure that checks unlockErr and either logs it (using the
package logger) or returns it according to those functions' signatures; ensure
every use of lock.Unlock() (the three functions ReadCatalog, UpdateCatalog,
DeleteFromCatalog) properly checks and handles the returned error instead of
ignoring it.