Add rationale comments to production osgetenvlibrary suppressions

[Copilot]

Production code had 45 //nolint:osgetenvlibrary suppressions with no explanation, which made it hard to distinguish intentional environment-bound reads from stale exemptions. This updates each surviving production suppression to carry a short rationale at the callsite.

• What changed

  • Added a one-line rationale to every production osgetenvlibrary suppression across CLI, parser, console, logger, workflow, constants, and GitHub integration code.
  • Kept the existing raw environment reads in place where they are still the correct boundary behavior: runtime detection, auth/token discovery, shell detection, secret sourcing, and explicit env-based overrides.

• Auditability

  • Each suppression now states why that environment read is intentional, so future review can evaluate scope creep without re-deriving context from surrounding code.
  • The comments are localized to the exact os.Getenv / os.LookupEnv usage rather than documented elsewhere.

• Scope

  • No logic changes.
  • No suppression broadening.
  • Test fixture coverage for the linter itself was left unchanged.

Example of the updated pattern:

iftoken:=os.Getenv("GITHUB_TOKEN"); token!="" { //nolint:osgetenvlibrary // GitHub auth intentionally prefers the runner-provided token environment.returntoken, nil
}

[github-actions]

🤖 Triage Assessment

Field	Value
Category	chore
Risk	🟢 Low
Score	28/100 (Impact 10 + Urgency 8 + Quality 10)
Action	defer (draft)

Summary: Adds rationale comments to 45 nolint suppressions across 27 files. Draft. No logic change, +45/−45.

Next: Convert to ready-for-review when reviewed by maintainer.

Generated by 🔧 PR Triage Agent · 97.9 AIC · ⌖ 12.4 AIC · ⊞ 5.4K · ◷

[Copilot]

Pull request overview

This PR improves auditability of production //nolint:osgetenvlibrary suppressions by adding short, callsite-local rationales explaining why direct process environment reads are intentional boundaries (host/token discovery, runtime detection, CI/Codespaces checks, secret sourcing, explicit overrides).

Changes:

• Added one-line rationale comments to os.Getenv / os.LookupEnv callsites that retain //nolint:osgetenvlibrary suppressions across the CLI and supporting packages.
• Kept behavior unchanged (comment-only updates) while making future reviews of env-bound reads easier.

Show a summary per file

File	Description
pkg/workflow/process_env_lookup.go	Adds rationale for process env lookup helper suppression.
pkg/parser/github.go	Adds rationales for GitHub host/token env override reads.
pkg/logger/logger.go	Adds rationales for DEBUG/ACTIONS_RUNNER_DEBUG/DEBUG_COLORS reads.
pkg/github/label_objective_mapping.go	Adds rationale for env-injected objective mapping JSON override.
pkg/envutil/envutil.go	Adds rationale for centralized env read in integer parsing helper.
pkg/constants/constants.go	Adds rationale for workflow directory env override.
pkg/console/accessibility.go	Adds rationales for accessibility-related terminal env flags.
pkg/cli/update_check.go	Adds rationale for MCP-mode env marker check.
pkg/cli/shell_completion.go	Adds rationales for shell detection and Homebrew prefix env reads.
pkg/cli/secrets.go	Adds rationale for env-first secret availability detection.
pkg/cli/secret_set_command.go	Adds rationale for --from-env secret value resolution.
pkg/cli/mcp_validation.go	Adds rationales for env checks during MCP server secret validation.
pkg/cli/mcp_tools_privileged.go	Adds rationale for inheriting GITHUB_REPOSITORY into privileged tool args.
pkg/cli/mcp_server_command.go	Adds rationale for reading GITHUB_ACTOR during actor validation.
pkg/cli/mcp_repository.go	Adds rationale for preferring GITHUB_REPOSITORY in repo resolution.
pkg/cli/logs_command.go	Adds rationale for MCP-container fast-path GITHUB_REPOSITORY matching.
pkg/cli/interactive.go	Adds rationale for interactive-mode guards using test/CI env markers.
pkg/cli/init.go	Adds rationales for GHES detection using GitHub/gh CLI env hints.
pkg/cli/import_url_fetcher.go	Adds rationale for GH_HOST env usage in import auth host resolution.
pkg/cli/engine_secrets.go	Adds rationales for env-based secret discovery and export paths.
pkg/cli/compile_update_check.go	Adds rationale for env-based update-check opt-out.
pkg/cli/compile_orchestrator.go	Adds rationale for GH_HOST gating of auto-detection behavior.
pkg/cli/codespace.go	Adds rationale for Codespaces runtime env marker detection.
pkg/cli/ci.go	Adds rationale for CI env marker detection loop.
pkg/cli/add_wizard_command.go	Adds rationale for CI env check gating interactive wizard use.
pkg/cli/add_interactive_workflow.go	Adds rationale for Codespaces UX gating via env marker.
pkg/cli/add_interactive_orchestrator.go	Adds rationales for interactive guards and GH_HOST gating of auto-detection.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 27/27 changed files
• Comments generated: 1
• Review effort level: Low