go-concurrency-hazard-mining
Read-only mining codemod that surfaces potential concurrency hazards in Go
source. Findings are suspicious patterns suitable for review, go test -race,
or remediation — not proven data races.
Static analysis can identify risky patterns but cannot prove that two goroutines
access the same memory concurrently, that a write overlaps another access at
runtime, or that no happens-before relationship exists. Treat output as
high-signal review candidates.
v0.2.0 — false-positive reduction
Protected writes (mutex, atomic, sync.Once) on shared slices/maps/scalars are
suppressed by default. Use emit_low_confidence=true to include them for
audit trails.
New metric cardinalities:
| field | values |
|---|---|
confidence | high, medium, low |
protection | mutex, atomic, sync_once, none |
Mutex detection pairs Lock/RLock with matching Unlock/RUnlock on the
same receiver, including nested if blocks and defer mu.Unlock() patterns
(e.g. Kraken PrefetchHandler errList aggregation).
Workflow parameters
| param | default | description |
|---|---|---|
include_tests | true | Set false to skip *_test.go (production-only scans) |
emit_low_confidence | false | Set true to emit mutex-protected writes at confidence=low |
Hazard types
hazard_type | Severity | Suppressed when protected? |
|---|---|---|
waitgroup_add_inside_goroutine | high | never |
map_write_in_goroutine | high | yes (mutex/atomic/once) |
slice_append_in_goroutine | high | yes |
outer_scope_variable_write | medium | yes |
shared_pointer_mutation | medium | yes |
loop_variable_capture | medium | when loop var passed as closure arg |
multiple_channel_close | medium | never |
double_checked_locking | medium | never |
request_scoped_object_in_background_goroutine | medium | never |
Run locally