[lint-monster] lint-monster: remediate dynamic regexp custom-linter findings

[github-actions]

Summary

Daily make golint-custom found 23 dynamic-regexp findings where regexp patterns are not compile-time constants.

Root cause

The custom linter flags regexp construction from non-constant patterns because dynamic patterns can panic at runtime or enable ReDoS when influenced by untrusted input.

Affected paths

• pkg/agentdrain/mask.go
• pkg/stringutil/sanitize.go
• pkg/parser/frontmatter_content.go
• pkg/parser/json_path_locator.go
• pkg/parser/schema_suggestions.go
• pkg/cli/codemod_activation_outputs.go
• pkg/cli/firewall_policy.go
• pkg/workflow/gh_cli_permissions.go
• pkg/workflow/mcp_renderer_guard.go
• pkg/workflow/observability_otlp.go
• pkg/workflow/template_injection_utils.go
• pkg/workflow/yaml.go

Representative diagnostics

• pkg/agentdrain/mask.go:33: regexp pattern is not a compile-time constant
• pkg/stringutil/sanitize.go:168: regexp pattern is not a compile-time constant
• pkg/parser/json_path_locator.go:184: regexp pattern is not a compile-time constant
• pkg/parser/schema_suggestions.go:506: regexp pattern is not a compile-time constant

Expected outcome

Replace flagged dynamic regexp construction with safer alternatives such as:

• precompiled constant regexps,
• quoted literals (regexp.QuoteMeta) combined with safe matching primitives,
• string operations when full regexp support is unnecessary,
• explicit validation paths that avoid user-influenced pattern compilation.

Remediation checklist

• Keep remediation scoped to the dynamic-regexp findings only
• Prefer minimal, targeted code edits
• Remove or isolate non-constant regexp compilation in the listed paths
• Preserve behavior with tests where available
• Validate with make golint-custom

Generated by 🧌 LintMonster · gpt54 · 20 AIC · ⌖ 6.27 AIC · ⊞ 5.5K · ◷

• expires on Aug 13, 2026, 7:34 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.4 AIC · ⊞ 8.6K · ◷

[github-actions]

This duplicate dynamic-regexp tracking issue has been superseded by the current function-length-only daily backlog and is no longer the active work item for today. Closing to keep one active issue per lint topic.

Generated by 🧌 LintMonster · gpt54 · 29 AIC · ⌖ 4.44 AIC · ⊞ 5.7K