Skip to content

feat(extractor): pooled buffers through the flow engine → OWN003/OWN002 (recall 4/9→6/9) #309

feat(extractor): pooled buffers through the flow engine → OWN003/OWN002 (recall 4/9→6/9)

feat(extractor): pooled buffers through the flow engine → OWN003/OWN002 (recall 4/9→6/9) #309

Triggered via pull request June 20, 2026 14:50
Status Success
Total duration 1m 7s
Artifacts

ci.yml

on: pull_request
lint (ruff + mypy --strict)
11s
lint (ruff + mypy --strict)
extended codegen fuzz
27s
extended codegen fuzz
golden C# compiles & runs (.NET)
17s
golden C# compiles & runs (.NET)
C# leak extractor (Roslyn) -> OwnIR -> core
29s
C# leak extractor (Roslyn) -> OwnIR -> core
own-check repo scan (github + msbuild) + composite action
43s
own-check repo scan (github + msbuild) + composite action
own-check SARIF -> GitHub code scanning (dog-food)
30s
own-check SARIF -> GitHub code scanning (dog-food)
corpus benchmark (real C# recall + specificity)
1m 3s
corpus benchmark (real C# recall + specificity)
Matrix: tests
Fit to window
Zoom out
Zoom in

Annotations

28 errors and 33 warnings
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L63
[OWN001] IDisposable local 'whileLeak' is never disposed (leak) [resource: disposable]
OWN003: frontend/roslyn/samples/FlowLocalsSample.cs#L33
[OWN003] IDisposable local 'dbl' is disposed more than once [resource: disposable]
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L23
[OWN001] IDisposable local 'leak' may not be disposed on every path (leak) [resource: disposable]
OWN002: frontend/roslyn/samples/FlowLocalsSample.cs#L14
[OWN002] IDisposable local 'uad' is used after it is disposed [resource: disposable]
OWN001: frontend/roslyn/samples/DisposableFieldViewModel.cs#L10
[OWN001] IDisposable field '_cts' (type 'CancellationTokenSource') is never disposed — its owner 'ReportViewModel' leaks it (leak) [resource: disposable field]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L64
[DI001] singleton 'PrimaryCtorService' captures scoped service 'AppDbContext' (captive dependency: PrimaryCtorService -> AppDbContext) [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L61
[DI001] singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo) [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L53
[DI001] singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext) [resource: DI lifetime]
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L86
IDisposable local 'forLeak' is never disposed (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L74
IDisposable local 'foreachLeak' is never disposed (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L63
IDisposable local 'whileLeak' is never disposed (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L23
IDisposable local 'leak' may not be disposed on every path (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L14
IDisposable local 'uad' is used after it is disposed
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DisposableFieldViewModel.cs#L10
IDisposable field '_cts' (type 'CancellationTokenSource') is never disposed — its owner 'ReportViewModel' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L64
singleton 'PrimaryCtorService' captures scoped service 'AppDbContext' (captive dependency: PrimaryCtorService -> AppDbContext)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L61
singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L53
singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext)
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L86
[OWN001] IDisposable local 'forLeak' is never disposed (leak) [resource: disposable]
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L74
[OWN001] IDisposable local 'foreachLeak' is never disposed (leak) [resource: disposable]
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L63
[OWN001] IDisposable local 'whileLeak' is never disposed (leak) [resource: disposable]
OWN003: frontend/roslyn/samples/FlowLocalsSample.cs#L33
[OWN003] IDisposable local 'dbl' is disposed more than once [resource: disposable]
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L23
[OWN001] IDisposable local 'leak' may not be disposed on every path (leak) [resource: disposable]
OWN002: frontend/roslyn/samples/FlowLocalsSample.cs#L14
[OWN002] IDisposable local 'uad' is used after it is disposed [resource: disposable]
OWN001: frontend/roslyn/samples/DisposableFieldViewModel.cs#L10
[OWN001] IDisposable field '_cts' (type 'CancellationTokenSource') is never disposed — its owner 'ReportViewModel' leaks it (leak) [resource: disposable field]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L64
[DI001] singleton 'PrimaryCtorService' captures scoped service 'AppDbContext' (captive dependency: PrimaryCtorService -> AppDbContext) [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L61
[DI001] singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo) [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L53
[DI001] singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext) [resource: DI lifetime]
tests (py3.11)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
tests (py3.13)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
tests (py3.12)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
lint (ruff + mypy --strict)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
golden C# compiles & runs (.NET)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
extended codegen fuzz
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
C# leak extractor (Roslyn) -> OwnIR -> core
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
C# leak extractor (Roslyn) -> OwnIR -> core: frontend/roslyn/OwnSharp.Extractor/Program.cs#L934
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
own-check SARIF -> GitHub code scanning (dog-food)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
own-check SARIF -> GitHub code scanning (dog-food): frontend/roslyn/OwnSharp.Extractor/Program.cs#L934
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
OWN001: frontend/roslyn/samples/ExternalRefSubscription.cs#L20
[OWN001] event '_bus.Changed' is subscribed (handler 'OnChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ExternalRefSubscription' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/CustomerViewModel.cs#L15
[OWN001] event 'bus.CustomerChanged' is subscribed (handler 'OnCustomerChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CustomerViewModel' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
[OWN001] event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak) [resource: subscription token]
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L23
IDisposable local 'leak' may not be disposed on every path (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L14
IDisposable local 'uad' is used after it is disposed
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/ExternalRefSubscription.cs#L20
event '_bus.Changed' is subscribed (handler 'OnChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ExternalRefSubscription' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DisposableFieldViewModel.cs#L10
IDisposable field '_cts' (type 'CancellationTokenSource') is never disposed — its owner 'ReportViewModel' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L64
singleton 'PrimaryCtorService' captures scoped service 'AppDbContext' (captive dependency: PrimaryCtorService -> AppDbContext)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L61
singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L53
singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/CustomerViewModel.cs#L15
event 'bus.CustomerChanged' is subscribed (handler 'OnCustomerChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CustomerViewModel' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/LambdaHandlerViewModel.cs#L21
event 'bus.CustomerChanged' is subscribed (handler '(s, e) => _count++') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'LambdaHandlerViewModel' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/ExternalRefSubscription.cs#L20
event '_bus.Changed' is subscribed (handler 'OnChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ExternalRefSubscription' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/CustomerViewModel.cs#L15
event 'bus.CustomerChanged' is subscribed (handler 'OnCustomerChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CustomerViewModel' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak)
OWN001: frontend/roslyn/samples/LambdaHandlerViewModel.cs#L21
[OWN001] event 'bus.CustomerChanged' is subscribed (handler '(s, e) => _count++') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'LambdaHandlerViewModel' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached) [resource: subscription token]
OWN001: frontend/roslyn/samples/ExternalRefSubscription.cs#L20
[OWN001] event '_bus.Changed' is subscribed (handler 'OnChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ExternalRefSubscription' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/CustomerViewModel.cs#L15
[OWN001] event 'bus.CustomerChanged' is subscribed (handler 'OnCustomerChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CustomerViewModel' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
[OWN001] event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak) [resource: subscription token]
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/OwnSharp.Extractor/Program.cs#L934
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
corpus benchmark (real C# recall + specificity)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/