Function bodies 88 total

func min(a, b int) int {
	if a < b {
		return a
	}
	return b
}

func DefaultOptions() FormatOptions {
	return FormatOptions{
		MaxIssuesPerLinter: 10,
		MaxTotalIssues:     50,
		UseCollapsible:     true,
	}
}

func NewFormatter(format string, w io.Writer) *Formatter {
	return &Formatter{
		format: format,
		writer: w,
	}
}

func (f *Formatter) PrintResults(results *Results) error {
	switch f.format {
	case "json":
		return f.printJSON(results)
	default:
		return f.printText(results)
	}
}

func (f *Formatter) printText(results *Results) error {
	for _, check := range results.Checks {
		symbol := getStatusSymbol(check.Status)
		duration := fmt.Sprintf("(%.1fs)", check.Duration.Seconds())

		line := fmt.Sprintf("%s %-8s %s", symbol, check.Name, duration)

		// Add check-specific details
		switch check.Name {
		case "test":
			if check.Coverage > 0 {
				line += fmt.Sprintf(" - %.1f%% coverage", check.Coverage)
				if check.Threshold > 0 {
					line += fmt.Sprintf(" (threshold: %.0f%%)", check.Threshold)
				}
			}
		case "lint":
			if check.Issues >= 0 {
				line += fmt.Sprintf(" - %d issues", check.Issues)
			}
		case "security":
			if check.Vulnerabilities >= 0 {
				line += fmt.Sprintf(" - %d vulnerabilities", check.Vulnerabilities)
			}
		}

		if check.Message != "" {
			line += " - " + check.Message
		}

		if _, err := fmt.Fprintln(f.writer, line); err != nil {
			return fmt.Errorf("failed to write check result: %w", err)
		}
	}

	if _, err := fmt.Fprintln(f.writer); 

func getStatusSymbol(status string) string {
	switch status {
	case "pass":
		return "✓"
	case "fail":
		return "✗"
	case "error":
		return "⚠"
	case "skip":
		return "○"
	default:
		return "?"
	}
}

func (f *Formatter) PrintProgress(checks []string) error {
	if f.format == "json" {
		return nil // Skip progress messages in JSON mode
	}

	if _, err := fmt.Fprintf(f.writer, "Running: %s\n\n", joinChecks(checks)); err != nil {
		return fmt.Errorf("failed to write progress message: %w", err)
	}
	return nil
}

func joinChecks(checks []string) string {
	if len(checks) == 0 {
		return ""
	}
	if len(checks) == 1 {
		return checks[0]
	}

	result := checks[0]
	for i := 1; i < len(checks)-1; i++ {
		result += ", " + checks[i]
	}
	result += " and " + checks[len(checks)-1]

	return result
}

func (r *Runner) RunBenchmark() (output.CheckResult, error) {
	result := output.CheckResult{
		Name:   "benchmark",
		Status: "pass",
	}

	start := time.Now()
	defer func() {
		result.Duration = time.Since(start)
	}()

	// Check if go is installed
	if err := checkToolInstalled("go"); err != nil {
		return result, err
	}

	// Get benchmark configuration
	benchArgs := r.cfg.CI.Benchmark.Args
	if benchArgs == "" {
		benchArgs = "-bench=. -benchmem"
	}

	benchCount := r.cfg.CI.Benchmark.Count
	if benchCount == 0 {
		benchCount = 5
	}

	// Run benchmarks
	benchOutput, err := benchmark.RunBenchmarks(".", benchArgs, benchCount)
	if err != nil || !benchOutput.Success {
		result.Status = "fail"
		if err != nil {
			result.Message = fmt.Sprintf("benchmark failed: %v", err)
		} else {
			result.Message = fmt.Sprintf("benchmark failed: %s", benchOutput.Error)
		}
		return result, nil
	}

	// Format results for output
	if len(benchOutput.Results) > 0 {
		result.Message = fmt.Sprintf("ran %d benchma

func (r *Runner) RunLint() (output.CheckResult, error) {
	result := output.CheckResult{
		Name:   "lint",
		Status: "pass",
	}

	start := time.Now()
	defer func() {
		result.Duration = time.Since(start)
	}()

	// Check if golangci-lint is installed
	if err := checkToolInstalled("golangci-lint"); err != nil {
		return result, err
	}

	// Build lint command
	args := strings.Fields(r.cfg.CI.Lint.Args)
	if len(args) == 0 {
		args = []string{"run", "./..."}
	}

	// Add JSON output for parsing (golangci-lint v2.1+ format)
	args = append(args, "--output.json.path", "stdout")

	cmd := exec.Command("golangci-lint", args...)
	var stdout, stderr bytes.Buffer
	cmd.Stdout = &stdout
	cmd.Stderr = &stderr

	err := cmd.Run()

	// Save raw output to file for GitHub Actions formatter
	if writeErr := os.WriteFile("golangci-lint-report.json", stdout.Bytes(), 0644); writeErr != nil {
		fmt.Fprintf(os.Stderr, "Warning: failed to save golangci-lint report: %v\n", writeErr)
	}

	// Parse JSON output
	issues, 

func parseLintOutput(data []byte) ([]lintIssue, error) {
	if len(data) == 0 {
		return []lintIssue{}, nil
	}

	// golangci-lint v2.1+ outputs JSON on first line, then text summary
	// Extract only the first line (the JSON)
	lines := bytes.SplitN(data, []byte("\n"), 2)
	jsonData := lines[0]

	if len(jsonData) == 0 {
		return []lintIssue{}, nil
	}

	var report lintReport
	if err := json.Unmarshal(jsonData, &report); err != nil {
		return nil, fmt.Errorf("failed to parse lint output: %w", err)
	}

	return report.Issues, nil
}

func (r *Runner) RunAll() (*output.Results, error) {
	results := &output.Results{
		Checks: []output.CheckResult{},
		Status: "pass",
	}

	start := time.Now()

	// Determine which checks to run
	checks := r.getEnabledChecks()

	for _, checkName := range checks {
		var result output.CheckResult
		var err error

		switch checkName {
		case "test":
			result, err = r.RunTest()
		case "lint":
			result, err = r.RunLint()
		case "security":
			result, err = r.RunSecurity()
		case "benchmark":
			result, err = r.RunBenchmark()
		default:
			continue
		}

		if err != nil {
			result.Status = "error"
			result.Message = err.Error()
		}

		results.Checks = append(results.Checks, result)

		// Update overall status
		if result.Status == "fail" || result.Status == "error" {
			results.Status = "fail"
		}
	}

	results.Total = time.Since(start)

	return results, nil
}

func (r *Runner) RunCheck(name string) (*output.Results, error) {
	results := &output.Results{
		Checks: []output.CheckResult{},
		Status: "pass",
	}

	start := time.Now()

	var result output.CheckResult
	var err error

	switch name {
	case "test":
		result, err = r.RunTest()
	case "lint":
		result, err = r.RunLint()
	case "security":
		result, err = r.RunSecurity()
	case "benchmark":
		result, err = r.RunBenchmark()
	default:
		return nil, fmt.Errorf("unknown check: %s", name)
	}

	if err != nil {
		result.Status = "error"
		result.Message = err.Error()
	}

	results.Checks = append(results.Checks, result)

	if result.Status == "fail" || result.Status == "error" {
		results.Status = "fail"
	}

	results.Total = time.Since(start)

	return results, nil
}

func (r *Runner) getEnabledChecks() []string {
	var checks []string

	if r.cfg.CI.Test.Enabled != nil && *r.cfg.CI.Test.Enabled {
		checks = append(checks, "test")
	}
	if r.cfg.CI.Lint.Enabled {
		checks = append(checks, "lint")
	}
	if r.cfg.CI.Security.Enabled {
		checks = append(checks, "security")
	}
	if r.cfg.CI.Benchmark.Enabled {
		checks = append(checks, "benchmark")
	}

	return checks
}

func checkToolInstalled(tool string) error {
	_, err := exec.LookPath(tool)
	if err != nil {
		return fmt.Errorf("%s is not installed or not in PATH", tool)
	}
	return nil
}

func (r *Runner) RunSecurity() (output.CheckResult, error) {
	result := output.CheckResult{
		Name:   "security",
		Status: "pass",
	}

	start := time.Now()
	defer func() {
		result.Duration = time.Since(start)
	}()

	// Check if govulncheck is installed
	if err := checkToolInstalled("govulncheck"); err != nil {
		return result, err
	}

	// Build security command for JSON output
	argsJSON := strings.Fields(r.cfg.CI.Security.Args)
	if len(argsJSON) == 0 {
		argsJSON = []string{"./..."}
	}
	argsJSON = append(argsJSON, "-json")

	cmdJSON := exec.Command("govulncheck", argsJSON...)
	var stdoutJSON, stderrJSON bytes.Buffer
	cmdJSON.Stdout = &stdoutJSON
	cmdJSON.Stderr = &stderrJSON

	err := cmdJSON.Run()

	// Save JSON output to file for GitHub Actions formatter
	if writeErr := os.WriteFile("govulncheck-report.json", stdoutJSON.Bytes(), 0644); writeErr != nil {
		fmt.Fprintf(os.Stderr, "Warning: failed to save govulncheck JSON report: %v\n", writeErr)
	}

	// Also run with text output for G

func parseSecurityOutput(data []byte) ([]vulnerability, error) {
	if len(data) == 0 {
		return []vulnerability{}, nil
	}

	// govulncheck outputs newline-delimited JSON
	lines := bytes.Split(data, []byte("\n"))
	var vulns []vulnerability

	for _, line := range lines {
		if len(line) == 0 {
			continue
		}

		var entry struct {
			Finding *vulnerability `json:"finding,omitempty"`
		}

		if err := json.Unmarshal(line, &entry); err != nil {
			continue // Skip malformed lines
		}

		if entry.Finding != nil {
			vulns = append(vulns, *entry.Finding)
		}
	}

	return vulns, nil
}

func (r *Runner) RunTest() (output.CheckResult, error) {
	result := output.CheckResult{
		Name:   "test",
		Status: "pass",
	}

	start := time.Now()
	defer func() {
		result.Duration = time.Since(start)
	}()

	// Check if go is installed
	if err := checkToolInstalled("go"); err != nil {
		return result, err
	}

	// Build test command
	args := strings.Fields(r.cfg.CI.Test.Args)
	if len(args) == 0 {
		args = []string{"-v", "-race", "./..."}
	}

	// Add coverage if enabled
	if r.cfg.CI.Test.Coverage.Enabled != nil && *r.cfg.CI.Test.Coverage.Enabled {
		// Check if -coverprofile is already in args
		hasCoverProfile := false
		for _, arg := range args {
			if strings.HasPrefix(arg, "-coverprofile") {
				hasCoverProfile = true
				break
			}
		}
		if !hasCoverProfile {
			args = append(args, "-coverprofile=coverage.out")
		}
	}

	cmd := exec.Command("go", append([]string{"test"}, args...)...)
	output_bytes, err := cmd.CombinedOutput()
	outputStr := string(output_bytes)

	if err != nil {
		r

func extractCoverage(output string) (float64, error) {
	// Match patterns like "coverage: 85.2% of statements"
	re := regexp.MustCompile(`coverage:\s+([\d.]+)%`)
	matches := re.FindStringSubmatch(output)

	if len(matches) < 2 {
		return 0, fmt.Errorf("coverage not found in output")
	}

	coverage, err := strconv.ParseFloat(matches[1], 64)
	if err != nil {
		return 0, fmt.Errorf("failed to parse coverage: %w", err)
	}

	return coverage, nil
}

func ParseGovulncheck(jsonOutput string) (*SecurityResult, error) {
	scanner := bufio.NewScanner(strings.NewReader(jsonOutput))

	osvMap := make(map[string]*OSV)
	findingsMap := make(map[string][]*Finding)

	// Parse newline-delimited JSON
	for scanner.Scan() {
		line := strings.TrimSpace(scanner.Text())
		if line == "" {
			continue
		}

		var msg GovulncheckMessage
		if err := json.Unmarshal([]byte(line), &msg); err != nil {
			// Skip malformed JSON lines
			continue
		}

		if msg.OSV != nil {
			osvMap[msg.OSV.ID] = msg.OSV
		}

		if msg.Finding != nil {
			findings := findingsMap[msg.Finding.OSV]
			findings = append(findings, msg.Finding)
			findingsMap[msg.Finding.OSV] = findings
		}
	}

	if err := scanner.Err(); err != nil {
		return nil, fmt.Errorf("error reading input: %w", err)
	}

	// Combine OSV info with findings
	var vulnerabilities []Vulnerability

	for osvID, findings := range findingsMap {
		osv := osvMap[osvID]
		if osv == nil {
			continue
		}

		// Get the first fi

func extractSeverity(severities []SeverityScore) (Severity, float64) {
	var cvssScore float64

	// Look for CVSS_V3 score first
	for _, s := range severities {
		if s.Type == "CVSS_V3" {
			if score, err := strconv.ParseFloat(s.Score, 64); err == nil {
				cvssScore = score
				break
			}
		}
	}

	// Map CVSS score to severity level
	severity := SeverityUnknown
	if cvssScore >= 9.0 {
		severity = SeverityCritical
	} else if cvssScore >= 7.0 {
		severity = SeverityHigh
	} else if cvssScore >= 4.0 {
		severity = SeverityMedium
	} else if cvssScore > 0 {
		severity = SeverityLow
	}

	return severity, cvssScore
}

func buildCallstackSummary(trace []TraceEntry) string {
	var callers []string

	for _, t := range trace {
		if t.Function == "" {
			continue
		}

		caller := fmt.Sprintf("%s.%s", t.Package, t.Function)
		if t.Position != nil {
			caller = fmt.Sprintf("%s (%s:%d)", caller, t.Position.Filename, t.Position.Line)
		}
		callers = append(callers, caller)
	}

	if len(callers) == 0 {
		return ""
	}

	// Show up to 3 callers
	if len(callers) <= 3 {
		return strings.Join(callers, " → ")
	}

	summary := strings.Join(callers[:3], " → ")
	summary += fmt.Sprintf(" ... (%d more)", len(callers)-3)
	return summary
}

func FormatSecurityOutput(result *SecurityResult, options FormatOptions) string {
	if result.TotalCount == 0 {
		return ""
	}

	var lines []string

	// Summary
	pluralSuffix := "ies"
	if result.TotalCount == 1 {
		pluralSuffix = "y"
	}
	lines = append(lines, fmt.Sprintf("Found **%d** known vulnerabilit%s in dependencies.", result.TotalCount, pluralSuffix))
	lines = append(lines, "")

	// Severity table if we have critical or high severity
	critical := result.BySeverity[SeverityCritical]
	high := result.BySeverity[SeverityHigh]
	medium := result.BySeverity[SeverityMedium]
	low := result.BySeverity[SeverityLow]
	unknown := result.BySeverity[SeverityUnknown]

	if len(critical) > 0 || len(high) > 0 {
		lines = append(lines, "| Severity | Count |")
		lines = append(lines, "|----------|-------|")
		if len(critical) > 0 {
			lines = append(lines, fmt.Sprintf("| 🔴 Critical | %d |", len(critical)))
		}
		if len(high) > 0 {
			lines = append(lines, fmt.Sprintf("| 🟠 High | %d |", len(high)))
		}

func formatVulnerability(vuln Vulnerability, index int) string {
	var lines []string

	// Header with ID and severity
	header := fmt.Sprintf("#### %d. %s", index+1, vuln.ID)
	if vuln.CVSSScore > 0 {
		header += fmt.Sprintf(" (%s: %.1f)", vuln.Severity, vuln.CVSSScore)
	} else if vuln.Severity != SeverityUnknown {
		header += fmt.Sprintf(" (%s)", vuln.Severity)
	}
	lines = append(lines, header)
	lines = append(lines, "")

	// Summary
	lines = append(lines, fmt.Sprintf("**%s**", vuln.Summary))
	lines = append(lines, "")

	// Module info
	lines = append(lines, fmt.Sprintf("- **Module:** `%s@%s`", vuln.Module, vuln.FoundVersion))
	if vuln.FixedVersion != "" {
		lines = append(lines, fmt.Sprintf("- **Fixed in:** `%s`", vuln.FixedVersion))
	}

	// Aliases (CVEs)
	if len(vuln.Aliases) > 0 {
		lines = append(lines, fmt.Sprintf("- **CVE:** %s", strings.Join(vuln.Aliases, ", ")))
	}

	// Reference link
	if vuln.ReferenceURL != "" {
		lines = append(lines, fmt.Sprintf("- **Details:** [%s](%s)", v

func CheckFailureThreshold(result *SecurityResult, failOn Severity) bool {
	if failOn == "" {
		// No threshold set, never fail
		return false
	}

	// Define severity hierarchy
	severityLevels := map[Severity]int{
		SeverityCritical: 4,
		SeverityHigh:     3,
		SeverityMedium:   2,
		SeverityLow:      1,
		SeverityUnknown:  0,
	}

	thresholdLevel := severityLevels[failOn]

	// Check if any vulnerability meets or exceeds the threshold
	for _, vuln := range result.Vulnerabilities {
		if severityLevels[vuln.Severity] >= thresholdLevel {
			return true
		}
	}

	return false
}

func New(opts Options) *Validator {
	workingDir := opts.WorkingDir
	if workingDir == "" {
		workingDir = "."
	}
	return &Validator{
		workingDir: workingDir,
		fix:        opts.Fix,
		quiet:      opts.Quiet,
	}
}

func (v *Validator) Validate() Result {
	result := Result{IsValid: true}

	// Validate project structure
	v.validateProject(&result)

	// Validate golangci-lint config
	v.validateGolangciLint(&result)

	// Validate workflow files
	v.validateWorkflows(&result)

	// Validate release config (if applicable)
	v.validateReleaseConfig(&result)

	return result
}

func (v *Validator) validateProject(result *Result) {
	v.log("🔍 Validating Go project structure...")

	// Check for go.mod
	if !v.fileExists("go.mod") {
		result.IsValid = false
		result.Errors = append(result.Errors, "Missing go.mod file")
	} else {
		v.log("  ✅ go.mod found")
	}

	// Check for Go source files
	goFiles, _ := filepath.Glob(filepath.Join(v.workingDir, "*.go"))
	subGoFiles, _ := filepath.Glob(filepath.Join(v.workingDir, "**/*.go"))
	allGoFiles := append(goFiles, subGoFiles...)
	
	if len(allGoFiles) == 0 {
		result.IsValid = false
		result.Errors = append(result.Errors, "No Go source files found")
	} else {
		v.log("  ✅ Go source files found")
	}

	// Check for test files (warning only)
	testFiles, _ := filepath.Glob(filepath.Join(v.workingDir, "*_test.go"))
	subTestFiles, _ := filepath.Glob(filepath.Join(v.workingDir, "**/*_test.go"))
	allTestFiles := append(testFiles, subTestFiles...)

	if len(allTestFiles) == 0 {
		result.Warnings = append(result.Warnings, "No test fil

func (v *Validator) validateGolangciLint(result *Result) {
	v.log("\n🔍 Validating golangci-lint configuration...")

	// Find config file
	configPath := ""
	for _, name := range []string{".golangci.yml", ".golangci.yaml"} {
		if v.fileExists(name) {
			configPath = filepath.Join(v.workingDir, name)
			break
		}
	}

	if configPath == "" {
		result.Warnings = append(result.Warnings, "No .golangci.yml or .golangci.yaml found (optional but recommended)")
		return
	}

	v.log("  ✅ golangci-lint configuration found")

	// Parse config
	data, err := os.ReadFile(configPath)
	if err != nil {
		result.IsValid = false
		result.Errors = append(result.Errors, fmt.Sprintf("Failed to read golangci-lint config: %v", err))
		return
	}

	var config GolangciConfig
	if err := yaml.Unmarshal(data, &config); err != nil {
		result.IsValid = false
		result.Errors = append(result.Errors, fmt.Sprintf("Invalid YAML in golangci-lint config: %v", err))
		return
	}

	// Check version field
	if config.Version == nil {

func (v *Validator) fixGolangciVersion(configPath string, data []byte) bool {
	// Prepend version: 2 to the file
	newContent := "version: 2\n\n" + string(data)
	if err := os.WriteFile(configPath, []byte(newContent), 0644); err != nil {
		fmt.Printf("  ❌ Failed to fix config: %v\n", err)
		return false
	}
	return true
}

func (v *Validator) validateWorkflows(result *Result) {
	v.log("\n🔍 Validating GitHub workflow files...")

	workflowDir := filepath.Join(v.workingDir, ".github", "workflows")
	if !v.fileExists(".github/workflows") {
		result.Warnings = append(result.Warnings, "No .github/workflows directory found")
		return
	}

	// Find workflow files
	yamlFiles, _ := filepath.Glob(filepath.Join(workflowDir, "*.yaml"))
	ymlFiles, _ := filepath.Glob(filepath.Join(workflowDir, "*.yml"))
	workflowFiles := append(yamlFiles, ymlFiles...)

	if len(workflowFiles) == 0 {
		result.Warnings = append(result.Warnings, "No workflow files found in .github/workflows")
		return
	}

	v.log("  Found %d workflow file(s)", len(workflowFiles))

	// Check for go-actions usage
	goActionsPattern := regexp.MustCompile(`uses:\s*jrschumacher/go-actions/(ci|release|self-validate)@`)
	actionsFound := make(map[string]bool)

	for _, wf := range workflowFiles {
		data, err := os.ReadFile(wf)
		if err != nil {
			continue
		}

		match

func (v *Validator) validateReleaseConfig(result *Result) {
	v.log("\n🔍 Validating release configuration...")

	// Check Release Please config
	if !v.fileExists(".release-please-config.json") {
		result.Warnings = append(result.Warnings, "Missing .release-please-config.json (required for release action)")
	} else {
		v.log("  ✅ .release-please-config.json found")
	}

	if !v.fileExists(".release-please-manifest.json") {
		result.Warnings = append(result.Warnings, "Missing .release-please-manifest.json (required for release action)")
	} else {
		v.log("  ✅ .release-please-manifest.json found")
	}

	// Check GoReleaser config
	if !v.fileExists(".goreleaser.yaml") && !v.fileExists(".goreleaser.yml") {
		result.Warnings = append(result.Warnings, "Missing .goreleaser.yaml (required for release action)")
	} else {
		v.log("  ✅ GoReleaser configuration found")
	}
}

func main() {
	fmt.Println("🔢 Go Actions Example Calculator")
	fmt.Println("=================================")

	// Demonstrate basic arithmetic
	a, b := 10, 5
	fmt.Printf("Add(%d, %d) = %d\n", a, b, Add(a, b))
	fmt.Printf("Subtract(%d, %d) = %d\n", a, b, Subtract(a, b))
	fmt.Printf("Multiply(%d, %d) = %d\n", a, b, Multiply(a, b))
	fmt.Printf("Divide(%d, %d) = %.2f\n", a, b, Divide(float64(a), float64(b)))

	// Demonstrate string operations
	words := []string{"Go", "Actions", "Example"}
	fmt.Printf("JoinStrings(%v) = %q\n", words, JoinStrings(words, "-"))
	fmt.Printf("ReverseString(%q) = %q\n", "hello", ReverseString("hello"))

	// Demonstrate math operations
	x := 16.0
	fmt.Printf("Sqrt(%.1f) = %.2f\n", x, Sqrt(x))
	fmt.Printf("Power(2, 3) = %.0f\n", Power(2, 3))

	// Demonstrate validation
	email := "[email protected]"
	fmt.Printf("IsValidEmail(%q) = %t\n", email, IsValidEmail(email))
}

func Divide(a, b float64) float64 {
	if b == 0 {
		return 0
	}
	return a / b
}

func ReverseString(s string) string {
	runes := []rune(s)
	for i, j := 0, len(runes)-1; i < j; i, j = i+1, j-1 {
		runes[i], runes[j] = runes[j], runes[i]
	}
	return string(runes)
}

func Fibonacci(n int) int {
	if n <= 1 {
		return n
	}
	return Fibonacci(n-1) + Fibonacci(n-2)
}

func IsPrime(n int) bool {
	if n < 2 {
		return false
	}
	for i := 2; i*i <= n; i++ {
		if n%i == 0 {
			return false
		}
	}
	return true
}

func ParseAndSum(input string) (int, error) {
	parts := strings.Split(input, ",")
	sum := 0
	for _, part := range parts {
		num, err := strconv.Atoi(strings.TrimSpace(part))
		if err != nil {
			return 0, fmt.Errorf("invalid number: %s", part)
		}
		sum += num
	}
	return sum, nil
}