httpnoctx: convert 3 context-free HTTP calls to NewRequestWithContext+Do and enforce in CI

[Copilot]

Three production *http.Client.Get calls omitted context.Context, making in-flight requests uncancellable by callers (Ctrl-C, parent timeout, errgroup). All three are now converted to http.NewRequestWithContext + Do, with context threaded through their call chains. The httpnoctx analyzer is added to CI LINTER_FLAGS to prevent regressions.

Changes

• pkg/cli/deps_outdated.go — getLatestVersion (Go proxy @latest query)

  • Added ctx context.Context to getLatestVersion and CheckOutdatedDependencies; threaded from existing ctx in GenerateDependencyReport

• pkg/parser/remote_fetch.go — downloadFileViaRawURL (raw.githubusercontent.com download)

  • Added ctx to downloadFileViaRawURL and its caller downloadFileViaGit; downloadFileFromGitHubWithDepth (no context in signature) passes context.Background() as a minimal, non-invasive bridge

• pkg/cli/mcp_inspect_mcp_scripts_server.go — waitForServerReady (server-ready poll loop)

  • Added ctx to waitForServerReady and startMCPScriptsServer; threaded into InspectWorkflowMCP which now takes ctx and receives it from cmd.Context() in cobra's RunE

• .github/workflows/cgo.yml — appended -httpnoctx to LINTER_FLAGS

Pattern applied at each site

req, err:=http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
iferr!=nil {
return..., err
}
resp, err:=client.Do(req)

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #39054 does not have the 'implementation' label (has_implementation_label=false) and has only 35 new lines in business logic directories (≤100 threshold; requires_adr_by_default_volume=false).

[Copilot]

Pull request overview

This pull request eliminates three context-free HTTP requests by converting them to http.NewRequestWithContext + client.Do, threading context.Context through the relevant call chains. It also enables the httpnoctx custom analyzer in CI to prevent future regressions.

Changes:

• Updated Go proxy, raw GitHub download, and local readiness polling HTTP calls to be context-aware (NewRequestWithContext + Do).
• Threaded context.Context through deps reporting and mcp inspect command entrypoints.
• Enabled the httpnoctx custom analyzer in .github/workflows/cgo.yml via LINTER_FLAGS.

Show a summary per file

File	Description
pkg/parser/remote_fetch.go	Adds ctx plumbing and uses context-aware request creation for raw GitHub downloads.
pkg/cli/mcp_inspect.go	Threads ctx from cobra cmd.Context() into the MCP inspection workflow.
pkg/cli/mcp_inspect_mcp_scripts_server.go	Makes the server readiness poll loop use context-aware HTTP requests.
pkg/cli/deps_report.go	Passes existing ctx into outdated dependency checking.
pkg/cli/deps_outdated.go	Adds ctx plumbing and uses context-aware request creation for Go proxy queries.
.github/workflows/cgo.yml	Enables the httpnoctx analyzer in the custom linter step.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 6/6 changed files
• Comments generated: 1

[pelikhan]

@copilot run pr-finisher skill