diff --git a/pkg/cli/add_interactive_orchestrator.go b/pkg/cli/add_interactive_orchestrator.go
index 8383eb6ad20..8e22194c7ab 100644
--- a/pkg/cli/add_interactive_orchestrator.go
+++ b/pkg/cli/add_interactive_orchestrator.go
@@ -71,7 +71,7 @@ func RunAddInteractive(ctx context.Context, config *AddInteractiveConfig) error
 	addInteractiveLog.Print("Starting interactive add workflow")
 
 	// Assert this function is not running in automated unit tests or CI
-	if os.Getenv("GO_TEST_MODE") == "true" || os.Getenv("CI") != "" {
+	if os.Getenv("GO_TEST_MODE") == "true" || os.Getenv("CI") != "" { //nolint:osgetenvlibrary
 		return errors.New("interactive add cannot be used in automated tests or CI environments")
 	}
 
@@ -79,7 +79,7 @@ func RunAddInteractive(ctx context.Context, config *AddInteractiveConfig) error
 	config.Ctx = ctx
 
 	// Auto-detect GHES host from git remote if not already set
-	if os.Getenv("GH_HOST") == "" {
+	if os.Getenv("GH_HOST") == "" { //nolint:osgetenvlibrary
 		detectedHost := getHostFromOriginRemote()
 		if detectedHost != "github.com" {
 			addInteractiveLog.Printf("Auto-detected GHES host from git remote: %s", detectedHost)
diff --git a/pkg/cli/add_interactive_workflow.go b/pkg/cli/add_interactive_workflow.go
index 8cab14f7afd..3d21d45448a 100644
--- a/pkg/cli/add_interactive_workflow.go
+++ b/pkg/cli/add_interactive_workflow.go
@@ -87,7 +87,7 @@ func (c *AddInteractiveConfig) checkStatusAndOfferRun(ctx context.Context) error
 	}
 
 	// In Codespaces, don't offer to trigger - provide link to Actions page instead
-	if os.Getenv("CODESPACES") == "true" {
+	if os.Getenv("CODESPACES") == "true" { //nolint:osgetenvlibrary
 		addInteractiveLog.Print("Running in Codespaces, skipping run offer and showing Actions link")
 		fmt.Fprintln(os.Stderr, "")
 		fmt.Fprintln(os.Stderr, console.FormatInfoMessage("Running in GitHub Codespaces - please trigger the workflow manually from the Actions page"))
diff --git a/pkg/cli/add_wizard_command.go b/pkg/cli/add_wizard_command.go
index b81898154fd..07fc827cce6 100644
--- a/pkg/cli/add_wizard_command.go
+++ b/pkg/cli/add_wizard_command.go
@@ -84,7 +84,7 @@ Note: To create a new workflow from scratch, use the 'new' command instead.`,
 
 			// add-wizard requires an interactive terminal
 			isTerminal := tty.IsStdoutTerminal()
-			isCIEnv := os.Getenv("CI") != ""
+			isCIEnv := os.Getenv("CI") != "" //nolint:osgetenvlibrary
 			addWizardLog.Printf("Terminal check: is_terminal=%v, is_ci=%v", isTerminal, isCIEnv)
 			if !isTerminal || isCIEnv {
 				return errors.New("add-wizard requires an interactive terminal; use 'add' for non-interactive environments")
diff --git a/pkg/cli/ci.go b/pkg/cli/ci.go
index b467dee4386..367d69eea9b 100644
--- a/pkg/cli/ci.go
+++ b/pkg/cli/ci.go
@@ -18,7 +18,7 @@ func IsRunningInCI() bool {
 	}
 
 	for _, v := range ciVars {
-		if os.Getenv(v) != "" {
+		if os.Getenv(v) != "" { //nolint:osgetenvlibrary
 			ciLog.Printf("CI environment detected via %s", v)
 			return true
 		}
diff --git a/pkg/cli/codespace.go b/pkg/cli/codespace.go
index a281d7d2b92..5794a49121a 100644
--- a/pkg/cli/codespace.go
+++ b/pkg/cli/codespace.go
@@ -14,7 +14,7 @@ var codespaceLog = logger.New("cli:codespace")
 // by checking for the CODESPACES environment variable
 func isRunningInCodespace() bool {
 	// GitHub Codespaces sets CODESPACES=true environment variable
-	isCodespace := strings.EqualFold(os.Getenv("CODESPACES"), "true")
+	isCodespace := strings.EqualFold(os.Getenv("CODESPACES"), "true") //nolint:osgetenvlibrary
 	codespaceLog.Printf("Codespace detection: is_codespace=%v", isCodespace)
 	return isCodespace
 }
diff --git a/pkg/cli/compile_orchestrator.go b/pkg/cli/compile_orchestrator.go
index 60093582328..411afcae16e 100644
--- a/pkg/cli/compile_orchestrator.go
+++ b/pkg/cli/compile_orchestrator.go
@@ -27,7 +27,7 @@ func CompileWorkflows(ctx context.Context, config CompileConfig) ([]*workflow.Wo
 	default:
 	}
 
-	if os.Getenv("GH_HOST") == "" {
+	if os.Getenv("GH_HOST") == "" { //nolint:osgetenvlibrary
 		if detectedHost := getHostFromOriginRemote(); detectedHost != "github.com" && detectedHost != "" {
 			compileOrchestratorLog.Printf("Auto-detected GHES host from git remote: %s", detectedHost)
 			workflow.SetDefaultGHHost(detectedHost)
diff --git a/pkg/cli/compile_update_check.go b/pkg/cli/compile_update_check.go
index 8220cd4f279..166ac280421 100644
--- a/pkg/cli/compile_update_check.go
+++ b/pkg/cli/compile_update_check.go
@@ -108,7 +108,7 @@ func shouldRunCompileUpdateCheck(noCheckUpdate bool) bool {
 		compileUpdateCheckLog.Print("Update check disabled via --no-check-update flag")
 		return false
 	}
-	if os.Getenv(compileUpdateCheckDisableEnv) != "" {
+	if os.Getenv(compileUpdateCheckDisableEnv) != "" { //nolint:osgetenvlibrary
 		compileUpdateCheckLog.Printf("Update check disabled via %s", compileUpdateCheckDisableEnv)
 		return false
 	}
diff --git a/pkg/cli/engine_secrets.go b/pkg/cli/engine_secrets.go
index a84a6569993..922cecb1bce 100644
--- a/pkg/cli/engine_secrets.go
+++ b/pkg/cli/engine_secrets.go
@@ -231,11 +231,11 @@ func ensureSecretAvailable(req SecretRequirement, config EngineSecretConfig) err
 	}
 
 	// Check environment variable
-	envValue := os.Getenv(req.Name)
+	envValue := os.Getenv(req.Name) //nolint:osgetenvlibrary
 	if envValue == "" {
 		// Check alternative environment variables
 		for _, alt := range req.AlternativeEnvVars {
-			envValue = os.Getenv(alt)
+			envValue = os.Getenv(alt) //nolint:osgetenvlibrary
 			if envValue != "" {
 				engineSecretsLog.Printf("Found secret in alternative env var: %s", alt)
 				break
@@ -439,7 +439,7 @@ func checkOptionalSecret(req SecretRequirement, config EngineSecretConfig) error
 	}
 
 	// Check environment
-	if os.Getenv(req.Name) != "" {
+	if os.Getenv(req.Name) != "" { //nolint:osgetenvlibrary
 		if config.Verbose {
 			fmt.Fprintln(os.Stderr, console.FormatInfoMessage(fmt.Sprintf("Optional secret %s found in environment", req.Name)))
 		}
@@ -552,11 +552,11 @@ func GetEngineSecretNameAndValue(engine string, existingSecrets map[string]struc
 		envVar = opt.EnvVarName
 	}
 
-	value := os.Getenv(envVar)
+	value := os.Getenv(envVar) //nolint:osgetenvlibrary
 	if value == "" {
 		// Check alternative environment variables
 		for _, alt := range opt.AlternativeSecrets {
-			value = os.Getenv(alt)
+			value = os.Getenv(alt) //nolint:osgetenvlibrary
 			if value != "" {
 				engineSecretsLog.Printf("Found secret in alternative env var: %s", alt)
 				break
diff --git a/pkg/cli/import_url_fetcher.go b/pkg/cli/import_url_fetcher.go
index 3ef70971cea..6a09e6744a0 100644
--- a/pkg/cli/import_url_fetcher.go
+++ b/pkg/cli/import_url_fetcher.go
@@ -305,7 +305,7 @@ func logResponseBodyVerbose(resp *http.Response) {
 }
 
 func importAuthGHHost() string {
-	ghHost := os.Getenv("GH_HOST")
+	ghHost := os.Getenv("GH_HOST") //nolint:osgetenvlibrary
 	if ghHost == "" {
 		return ""
 	}
diff --git a/pkg/cli/init.go b/pkg/cli/init.go
index 631ce4fc980..9f939ef37cc 100644
--- a/pkg/cli/init.go
+++ b/pkg/cli/init.go
@@ -338,7 +338,7 @@ func isGHESHost(host string) bool {
 //  3. The hostname extracted from the git origin remote URL
 func detectGHESDeployment() string {
 	// Check GITHUB_SERVER_URL first (set inside GitHub Actions runners)
-	if serverURL := os.Getenv("GITHUB_SERVER_URL"); serverURL != "" {
+	if serverURL := os.Getenv("GITHUB_SERVER_URL"); serverURL != "" { //nolint:osgetenvlibrary
 		// serverURL is like "https://ghes.example.com", extract just the host.
 		host := serverURL
 		for _, scheme := range []string{"https://", "http://"} {
@@ -352,7 +352,7 @@ func detectGHESDeployment() string {
 	}
 
 	// Check GH_HOST (set when using the gh CLI against an enterprise instance)
-	if ghHost := os.Getenv("GH_HOST"); ghHost != "" {
+	if ghHost := os.Getenv("GH_HOST"); ghHost != "" { //nolint:osgetenvlibrary
 		if isGHESHost(ghHost) {
 			initLog.Printf("Detected GHES deployment from GH_HOST: %s", ghHost)
 			return ghHost
diff --git a/pkg/cli/interactive.go b/pkg/cli/interactive.go
index be4c1f3affb..c4b967a2b76 100644
--- a/pkg/cli/interactive.go
+++ b/pkg/cli/interactive.go
@@ -64,7 +64,7 @@ func CreateWorkflowInteractively(ctx context.Context, workflowName string, verbo
 	interactiveLog.Printf("Starting interactive workflow creation: workflowName=%s, force=%v", workflowName, force)
 
 	// Assert this function is not running in automated unit tests
-	if os.Getenv("GO_TEST_MODE") == "true" || os.Getenv("CI") != "" {
+	if os.Getenv("GO_TEST_MODE") == "true" || os.Getenv("CI") != "" { //nolint:osgetenvlibrary
 		return errors.New("interactive workflow creation cannot be used in automated tests or CI environments")
 	}
 
diff --git a/pkg/cli/logs_command.go b/pkg/cli/logs_command.go
index bf0c60bfc33..d18bd832a04 100644
--- a/pkg/cli/logs_command.go
+++ b/pkg/cli/logs_command.go
@@ -452,7 +452,7 @@ func repoIsLocal(repo string) bool {
 	ownerRepo, _ := repoutil.NormalizeRepoForAPI(repo)
 
 	// Fast path: GITHUB_REPOSITORY is always the current repo in MCP server containers.
-	if envRepo := os.Getenv("GITHUB_REPOSITORY"); envRepo != "" {
+	if envRepo := os.Getenv("GITHUB_REPOSITORY"); envRepo != "" { //nolint:osgetenvlibrary
 		return strings.EqualFold(ownerRepo, envRepo)
 	}
 
diff --git a/pkg/cli/mcp_repository.go b/pkg/cli/mcp_repository.go
index aacc3a8eb63..7a5c258c56c 100644
--- a/pkg/cli/mcp_repository.go
+++ b/pkg/cli/mcp_repository.go
@@ -21,7 +21,7 @@ func getRepository(ctx context.Context) (string, error) {
 	}
 
 	// Try GITHUB_REPOSITORY environment variable first
-	repo := os.Getenv("GITHUB_REPOSITORY")
+	repo := os.Getenv("GITHUB_REPOSITORY") //nolint:osgetenvlibrary
 	if repo != "" {
 		mcpLog.Printf("Got repository from GITHUB_REPOSITORY: %s", repo)
 		mcpCache.SetRepo(repo)
diff --git a/pkg/cli/mcp_server_command.go b/pkg/cli/mcp_server_command.go
index ce4d43a1e70..d712aa38aba 100644
--- a/pkg/cli/mcp_server_command.go
+++ b/pkg/cli/mcp_server_command.go
@@ -72,7 +72,7 @@ func runMCPServer(ctx context.Context, port int, cmdPath string, validateActor b
 	mcpServerEnv := withNonInteractiveCIEnv(nil)
 
 	// Get actor from environment variable
-	actor := os.Getenv("GITHUB_ACTOR")
+	actor := os.Getenv("GITHUB_ACTOR") //nolint:osgetenvlibrary
 
 	if validateActor {
 		mcpLog.Printf("Actor validation enabled (--validate-actor flag)")
diff --git a/pkg/cli/mcp_tools_privileged.go b/pkg/cli/mcp_tools_privileged.go
index bf1ccd9dff3..a8c59175494 100644
--- a/pkg/cli/mcp_tools_privileged.go
+++ b/pkg/cli/mcp_tools_privileged.go
@@ -28,7 +28,7 @@ const (
 // GITHUB_REPOSITORY is forwarded to the agentic-workflows MCP server container via
 // env_vars in the MCP configuration and inherited by spawned subprocesses.
 func appendRepoFlagFromEnv(args []string) []string {
-	if repo := os.Getenv("GITHUB_REPOSITORY"); repo != "" {
+	if repo := os.Getenv("GITHUB_REPOSITORY"); repo != "" { //nolint:osgetenvlibrary
 		return append(args, "--repo", repo)
 	}
 	return args
diff --git a/pkg/cli/mcp_validation.go b/pkg/cli/mcp_validation.go
index 25de3791d5e..05c46c8ec91 100644
--- a/pkg/cli/mcp_validation.go
+++ b/pkg/cli/mcp_validation.go
@@ -103,7 +103,7 @@ func validateServerSecrets(config parser.RegistryMCPServerConfig, verbose bool,
 				} else {
 					// Automatically try to get GitHub token for GitHub-related environment variables
 					if key == "GITHUB_PERSONAL_ACCESS_TOKEN" || key == "GITHUB_TOKEN" || key == "GH_TOKEN" {
-						if actualValue := os.Getenv(key); actualValue == "" {
+						if actualValue := os.Getenv(key); actualValue == "" { //nolint:osgetenvlibrary
 							// Try to automatically get the GitHub token
 							if token, err := parser.GetGitHubToken(); err == nil {
 								config.Env[key] = token
@@ -114,7 +114,7 @@ func validateServerSecrets(config parser.RegistryMCPServerConfig, verbose bool,
 					} else {
 						// For backward compatibility: check if environment variable with this name exists
 						// This preserves the original behavior for existing tests
-						if actualValue := os.Getenv(key); actualValue == "" {
+						if actualValue := os.Getenv(key); actualValue == "" { //nolint:osgetenvlibrary
 							return fmt.Errorf("environment variable '%s' not set", key)
 						}
 					}
diff --git a/pkg/cli/secret_set_command.go b/pkg/cli/secret_set_command.go
index cf589200a0e..f1ea43c6f4d 100644
--- a/pkg/cli/secret_set_command.go
+++ b/pkg/cli/secret_set_command.go
@@ -162,7 +162,7 @@ func normalizeSecretSetAPIHost(apiBase string) string {
 
 func resolveSecretValueForSet(fromEnv, fromFlag string) (string, error) {
 	if fromEnv != "" {
-		v := os.Getenv(fromEnv)
+		v := os.Getenv(fromEnv) //nolint:osgetenvlibrary
 		if v == "" {
 			return "", fmt.Errorf("environment variable %s is not set or empty", fromEnv)
 		}
diff --git a/pkg/cli/secrets.go b/pkg/cli/secrets.go
index 05ac3927767..af794177e6f 100644
--- a/pkg/cli/secrets.go
+++ b/pkg/cli/secrets.go
@@ -103,7 +103,7 @@ func extractSecretsFromConfig(config parser.RegistryMCPServerConfig) []SecretInf
 func checkSecretsAvailability(secrets []SecretInfo, useActionsSecrets bool) []SecretInfo {
 	for i := range secrets {
 		// First check if it's in environment variables
-		if value := os.Getenv(secrets[i].Name); value != "" {
+		if value := os.Getenv(secrets[i].Name); value != "" { //nolint:osgetenvlibrary
 			secrets[i].Available = true
 			secrets[i].Source = "env"
 			secrets[i].Value = value
diff --git a/pkg/cli/shell_completion.go b/pkg/cli/shell_completion.go
index 757d9b6a94f..67e128ca12a 100644
--- a/pkg/cli/shell_completion.go
+++ b/pkg/cli/shell_completion.go
@@ -36,21 +36,21 @@ func DetectShell() ShellType {
 	shellCompletionLog.Print("Detecting current shell")
 
 	// Check shell-specific version variables first (most reliable)
-	if os.Getenv("ZSH_VERSION") != "" {
+	if os.Getenv("ZSH_VERSION") != "" { //nolint:osgetenvlibrary
 		shellCompletionLog.Print("Detected zsh from ZSH_VERSION")
 		return ShellZsh
 	}
-	if os.Getenv("BASH_VERSION") != "" {
+	if os.Getenv("BASH_VERSION") != "" { //nolint:osgetenvlibrary
 		shellCompletionLog.Print("Detected bash from BASH_VERSION")
 		return ShellBash
 	}
-	if os.Getenv("FISH_VERSION") != "" {
+	if os.Getenv("FISH_VERSION") != "" { //nolint:osgetenvlibrary
 		shellCompletionLog.Print("Detected fish from FISH_VERSION")
 		return ShellFish
 	}
 
 	// Fall back to $SHELL environment variable
-	shell := os.Getenv("SHELL")
+	shell := os.Getenv("SHELL") //nolint:osgetenvlibrary
 	if shell == "" {
 		shellCompletionLog.Print("SHELL environment variable not set, checking platform")
 		// On Windows, check for PowerShell
@@ -143,7 +143,7 @@ func installBashCompletion(verbose bool, cmd *cobra.Command) error {
 	// Try to determine the best location for bash completions
 	if runtime.GOOS == "darwin" {
 		// macOS with Homebrew
-		brewPrefix := os.Getenv("HOMEBREW_PREFIX")
+		brewPrefix := os.Getenv("HOMEBREW_PREFIX") //nolint:osgetenvlibrary
 		if brewPrefix == "" {
 			// Try common locations
 			for _, prefix := range []string{constants.HomebrewPrefix, constants.UsrLocalPrefix} {
@@ -425,7 +425,7 @@ func uninstallBashCompletion(verbose bool) error {
 
 	// macOS with Homebrew
 	if runtime.GOOS == "darwin" {
-		brewPrefix := os.Getenv("HOMEBREW_PREFIX")
+		brewPrefix := os.Getenv("HOMEBREW_PREFIX") //nolint:osgetenvlibrary
 		if brewPrefix == "" {
 			for _, prefix := range []string{constants.HomebrewPrefix, constants.UsrLocalPrefix} {
 				if fileutil.DirExists(filepath.Join(prefix, "etc", "bash_completion.d")) {
diff --git a/pkg/cli/update_check.go b/pkg/cli/update_check.go
index 35bcbb1979e..907a898f117 100644
--- a/pkg/cli/update_check.go
+++ b/pkg/cli/update_check.go
@@ -74,7 +74,7 @@ func shouldCheckForUpdate(noCheckUpdate bool) bool {
 // This is a heuristic - we can't reliably detect this, so we're conservative
 func isRunningAsMCPServer() bool {
 	// Check for MCP_SERVER environment variable that could be set by the MCP server
-	return os.Getenv("GH_AW_MCP_SERVER") != ""
+	return os.Getenv("GH_AW_MCP_SERVER") != "" //nolint:osgetenvlibrary
 }
 
 var (
diff --git a/pkg/workflow/process_env_lookup.go b/pkg/workflow/process_env_lookup.go
index 80180433ce0..791adcc2e05 100644
--- a/pkg/workflow/process_env_lookup.go
+++ b/pkg/workflow/process_env_lookup.go
@@ -5,6 +5,6 @@ import "os"
 func lookupProcessEnv(key string) string {
 	// Intentionally ignore the existence flag to preserve os.Getenv semantics:
 	// missing variables and explicitly empty variables are both treated as "".
-	value, _ := os.LookupEnv(key)
+	value, _ := os.LookupEnv(key) //nolint:osgetenvlibrary
 	return value
 }