fix(cli): execute YAML pattern analyzers during analysis

[sanket-deepsource]

Problem

RunCheckers in pkg/cli/cli.go loads built-in and custom YAML pattern checkers into a patternCheckers map, but the map is never passed to analysis.RunAnalyzers. Only Go-based analyzers (from LoadGoCheckers() and the custom Go stub) are executed end-to-end.

The result: every YAML-defined rule — whether built-in under checkers/**/*.yml or custom under .globstar/*.yml — silently produces zero findings. This is the follow-up bug noted in #230: after that PR fixed the YAML loader, loaded checkers still weren't reaching the analyzer runtime.

Reproduced against master with a trivial custom YAML rule and matching Go fixture: 0 issues reported. Same symptom for built-in YAML rules (e.g. go_des_weak_crypto) against obviously-violating source.

Fix

After the Go analyzer pass, flatten patternCheckers into []*analysis.Analyzer and call analysis.RunAnalyzers with the same file filter used for Go analyzers. Preserve Severity / Category on the resulting issues by looking up the originating analyzer by name (the runtime populates Issue.Id from Analyzer.Name but does not copy severity/category).

Minimal change, no refactor — the fileFilter closure is hoisted once so both runs share it.

Tests

• New TestRunCheckers_ExecutesCustomYamlCheckers in pkg/cli/cli_test.go writes a YAML rule to a temp .globstar, writes a matching Go file, constructs a Cli, invokes RunCheckers(false, true), and asserts a finding is produced. Verified this test fails on master (0 issues) and passes with the fix.
• Full go test ./... — the two pre-existing failures (checkers/go has YAML test fixtures that confuse the Go toolchain, checkers/discover/custom_analyzer_stub is a template requiring generated symbols) are present on clean master and unrelated to this change.
• Smoke-tested the built binary end-to-end:
  • ./globstar check --checkers=local against a minimal custom rule: 1 issue reported, exit 1.
  • ./globstar check --checkers=builtin against a des.NewCipher call: built-in go_des_weak_crypto fires correctly.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
globstar	Ignored		Apr 19, 2026 6:21am