Eliminate looped time.After timer leaks, propagate cancellation correctly, and enforce timeafterleak in CI (#39188)

Author: Copilot

.github/workflows/cgo.yml

@@ -1118,8 +1118,9 @@ jobs:
 
       # Enforce selected production custom analyzers without blocking on unrelated
       # legacy custom analyzer findings in tests or other analyzer families.
+      # Note: -test=false intentionally scopes this gate to production code only.
     - name: Run custom linters
-      run: make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -manualmutexunlock -osexitinlibrary -rawloginlib -regexpcompileinfunction -fprintlnsprintf -strconvparseignorederror -jsonmarshalignoredeerror -uncheckedtypeassertion -fmterrorfnoverbs -tolowerequalfold -httpnoctx -test=false"
+      run: make golint-custom LINTER_FLAGS="-errstringmatch -panicinlibrarycode -manualmutexunlock -osexitinlibrary -rawloginlib -regexpcompileinfunction -fprintlnsprintf -strconvparseignorederror -jsonmarshalignoredeerror -uncheckedtypeassertion -fmterrorfnoverbs -tolowerequalfold -httpnoctx -timeafterleak -test=false"
 
       # Ensure no action shell scripts invoke python or python3
     - name: Lint action shell scripts

pkg/cli/add_interactive_workflow.go

@@ -32,13 +32,15 @@ func (c *AddInteractiveConfig) checkStatusAndOfferRun(ctx context.Context) error
 	var workflowFound bool
 	for i := range 5 {
 		// Wait 2 seconds before each check (including the first)
+		timer := time.NewTimer(2 * time.Second)
 		select {
 		case <-ctx.Done():
+			timer.Stop()
 			if spinner != nil {
 				spinner.Stop()
 			}
 			return ctx.Err()
-		case <-time.After(2 * time.Second):
+		case <-timer.C:
 			// Continue with check
 		}
 

pkg/cli/add_interactive_workflow_test.go

@@ -3,6 +3,8 @@
 package cli
 
 import (
+	"context"
+	"errors"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -59,3 +61,14 @@ func TestGetWorkflowStatuses(t *testing.T) {
 		})
 	}
 }
+
+func TestCheckStatusAndOfferRun_ContextCancelled(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	cfg := &AddInteractiveConfig{Verbose: true}
+	err := cfg.checkStatusAndOfferRun(ctx)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("expected context cancellation error, got %v", err)
+	}
+}

pkg/cli/docker_images.go

@@ -195,10 +195,12 @@ func StartDockerImageDownload(ctx context.Context, image string) bool {
 				dockerImagesLog.Printf("Failed to download image %s (attempt %d/%d). Retrying in %ds...", image, attempt, maxAttempts, waitTime)
 
 				// Use context-aware sleep
+				timer := time.NewTimer(time.Duration(waitTime) * time.Second)
 				select {
-				case <-time.After(time.Duration(waitTime) * time.Second):
+				case <-timer.C:
 					// Continue to next retry
 				case <-ctx.Done():
+					timer.Stop()
 					// Context cancelled during sleep
 					dockerImagesLog.Printf("Download of image %s cancelled during retry wait: %v", image, ctx.Err())
 					return

pkg/cli/mcp_inspect_mcp_scripts_server.go

@@ -43,8 +43,10 @@ func findAvailablePort(startPort int, verbose bool) int {
 	return 0
 }
 
-// waitForServerReady waits for the HTTP server to be ready by polling the endpoint
-func waitForServerReady(ctx context.Context, port int, timeout time.Duration, verbose bool) bool {
+var errMCPScriptsServerStartupTimeout = errors.New("mcp-scripts HTTP server failed to start within timeout")
+
+// waitForServerReady waits for the HTTP server to be ready by polling the endpoint.
+func waitForServerReady(ctx context.Context, port int, timeout time.Duration, verbose bool) error {
 	deadline := time.Now().Add(timeout)
 	client := &http.Client{
 		Timeout: 1 * time.Second,
@@ -54,13 +56,13 @@ func waitForServerReady(ctx context.Context, port int, timeout time.Duration, ve
 	for time.Now().Before(deadline) {
 		select {
 		case <-ctx.Done():
-			return false
+			return ctx.Err()
 		default:
 		}
 		req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 		if err != nil {
 			mcpInspectLog.Printf("Failed to create request: %v", err)
-			return false
+			return err
 		}
 		resp, err := client.Do(req)
 		if err == nil {
@@ -70,17 +72,19 @@ func waitForServerReady(ctx context.Context, port int, timeout time.Duration, ve
 			if verbose {
 				mcpInspectLog.Printf("Server is ready on port %d", port)
 			}
-			return true
+			return nil
 		}
+		timer := time.NewTimer(mcpScriptsServerStartupDelay)
 		select {
 		case <-ctx.Done():
-			return false
-		case <-time.After(mcpScriptsServerStartupDelay):
+			timer.Stop()
+			return ctx.Err()
+		case <-timer.C:
 		}
 	}
 
 	mcpInspectLog.Printf("Server did not become ready within timeout")
-	return false
+	return errMCPScriptsServerStartupTimeout
 }
 
 // startMCPScriptsHTTPServer starts the mcp-scripts HTTP MCP server
@@ -180,7 +184,7 @@ func startMCPScriptsServer(ctx context.Context, mcpScriptsConfig *workflow.MCPSc
 	}
 
 	// Wait for the server to start up
-	if !waitForServerReady(ctx, port, 5*time.Second, verbose) {
+	if err := waitForServerReady(ctx, port, 5*time.Second, verbose); err != nil {
 		if serverCmd.Process != nil {
 			// Kill the process and log warning if it fails
 			if err := serverCmd.Process.Kill(); err != nil && verbose {
@@ -190,7 +194,7 @@ func startMCPScriptsServer(ctx context.Context, mcpScriptsConfig *workflow.MCPSc
 		if err := os.RemoveAll(tmpDir); err != nil && verbose {
 			mcpInspectLog.Printf("Warning: failed to clean up temporary directory %s: %v", tmpDir, err)
 		}
-		return nil, nil, "", errors.New("mcp-scripts HTTP server failed to start within timeout")
+		return nil, nil, "", err
 	}
 
 	if verbose {

pkg/cli/mcp_inspect_mcp_scripts_server_test.go

@@ -0,0 +1,27 @@
+//go:build !integration
+
+package cli
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestWaitForServerReady_ContextCancelled(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	err := waitForServerReady(ctx, 65535, 100*time.Millisecond, false)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("expected context cancellation error, got %v", err)
+	}
+}
+
+func TestWaitForServerReady_Timeout(t *testing.T) {
+	err := waitForServerReady(t.Context(), 65535, 10*time.Millisecond, false)
+	if !errors.Is(err, errMCPScriptsServerStartupTimeout) {
+		t.Fatalf("expected timeout error, got %v", err)
+	}
+}