This directory contains CodeQL queries for detecting common issues in go-git usage.
Detects instances where Repository or Storage objects are created but never closed, which can lead to file handle leaks, particularly on Windows.
What it detects:
- Calls to
PlainOpen,Init,Clone, and other repository creation functions - Calls to
NewStorageandNewStorageWithOptions - Submodule and worktree operations that return repositories
- Missing
Close()calls ordefercleanup patterns
Example violations:
// BAD: No Close() call
func bad() error {
r, err := git.PlainOpen("/path/to/repo")
if err != nil {
return err
}
// Missing: defer func() { _ = r.Close() }()
_, err = r.Head()
return err
}
// GOOD: Proper cleanup
func good() error {
r, err := git.PlainOpen("/path/to/repo")
if err != nil {
return err
}
defer func() { _ = r.Close() }()
_, err = r.Head()
return err
}codeql database create /tmp/go-git-db --language=go --source-root=/path/to/go-git
codeql query run codeql/queries/unclosed-resources.ql --database=/tmp/go-git-dbThe queries run automatically via the CodeQL workflow on pull requests.
To add a new query:
- Create a
.qlfile incodeql/queries/ - Include proper metadata (name, description, severity, tags)
- Test the query against go-git codebase
- Document the query in this README