CodeQL reports two high-severity go/incorrect-integer-conversion alerts:
In loadBudget, parsed values are converted int64 → int32 without a range check:
b.Loops = int32(loops) // line ~248
b.Seconds = int32(secs) // line ~253
A value above math.MaxInt32 would silently overflow/wrap.
Proposed fix (standard approach)
- Either parse directly with
strconv.ParseInt(v, 10, 32), or clamp to [0, math.MaxInt32] before converting (envInt64 already rejects negatives). Apply the same guard anywhere else an int64 is narrowed to int32.
- Add a test for an out-of-range value.
Alerts: /security/code-scanning/1 and /security/code-scanning/2
CodeQL reports two high-severity
go/incorrect-integer-conversionalerts:internal/config/config.go:248— code-scanning alert chore(ci): bump actions/setup-go from 5 to 6 #1internal/config/config.go:253— code-scanning alert chore(ci): bump actions/checkout from 4 to 6 #2In
loadBudget, parsed values are convertedint64 → int32without a range check:A value above
math.MaxInt32would silently overflow/wrap.Proposed fix (standard approach)
strconv.ParseInt(v, 10, 32), or clamp to[0, math.MaxInt32]before converting (envInt64already rejects negatives). Apply the same guard anywhere else an int64 is narrowed to int32.Alerts: /security/code-scanning/1 and /security/code-scanning/2