feat: Go support, lockfile/license drift detectors, retry command, ARM64 release

[lohitkolluri]

This PR adds the core backend improvements identified in the recent product review:

• Go ecosystem support: hallucinated_imports and phantom_deps now verify Go imports and go.mod declarations against proxy.golang.org.
• lockfile_drift detector: flags deps declared in package.json, Cargo.toml, or go.mod that are missing from their lockfile.
• license_drift detector: fetches npm/PyPI/crates.io metadata and warns on copyleft-style licenses.
• @codasaurus retry: re-runs the latest review for the current PR.
• ARM64 Linux release binaries: adds aarch64-unknown-linux-gnu to the release workflow.
• Docs and changelog updated.

All non-Postgres tests pass; postgres_smoke and production_hardening require a running local database.

[codasaurus-e0a6]

Codasaurus

Advisory draft — soft findings only. Codasaurus will not request changes; a maintainer still decides merge.

feat: Go support, lockfile/license drift detectors, retry command, ARM64 release

This PR updates 19 files across src, (root), docs. I spotted 2 things worth a quick look (not blockers). See the list below.

Since last review

Resolved

• Repeated code in src/detectors/lockfile_drift.rs

Still open

• Extra abstraction that may not be needed in src/registry/mod.rs

New

• Repeated code in src/detectors/lockfile_drift.rs

What to do next

1. Please check [quality]: Repeated code in src/detectors/lockfile_drift.rs
2. Please check [quality]: Extra abstraction that may not be needed in src/registry/mod.rs

Copy this into your AI coding agent

Paste this prompt into Cursor, Copilot, or another coding agent:

You are fixing Codasaurus review findings on a GitHub pull request.

## Rules
- Change only what is required to resolve the findings below.
- Do not refactor unrelated code or add features.
- Prefer the smallest correct diff.
- `tests/fixtures/golden/` and `golden/*/input.*` files intentionally contain sample secrets/TODOs for detector tests — do not "fix" those unless the PR is explicitly changing the fixture contract.
- Workspace crate imports in `tests/` (e.g. `use codasaurus::…`) are expected — do not add them to Cargo.toml.
- If a finding is a false positive, say so instead of changing code.
- After edits, summarize what you changed and why.

## Findings (priority order)
### 1. [warning] Repeated code
- **Location:** `src/detectors/lockfile_drift.rs`
- **Detector:** `boilerplate`
- **Issue:** Repeated code blocks found (29 instances) — AI often generates repetitive code.
- **Fix:** Extract repeated blocks into reusable functions.


### 2. [warning] Extra abstraction that may not be needed
- **Location:** `src/registry/mod.rs`
- **Detector:** `over-engineering`
- **Issue:** Factory/Builder pattern with only 1 type(s) — unnecessary complexity.
- **Fix:** Use constructors directly. Factory/Builder patterns add value with 5+ variants.


## PR context
Title: feat: Go support, lockfile/license drift detectors, retry command, ARM64 release

Changes

Path	What changed
.github/workflows/release.yml	updated
CHANGELOG.md	updated
README.md	updated
docs/codasaurus-toml.md	updated
docs/commands.md	updated
src/bot/commands.rs	updated
src/config.rs	updated
src/detectors/hallucinated_imports.rs	updated
…11 more

All files (19)

• .github/workflows/release.yml (modified)
• CHANGELOG.md (modified)
• README.md (modified)
• docs/codasaurus-toml.md (modified)
• docs/commands.md (modified)
• src/bot/commands.rs (modified)
• src/config.rs (modified)
• src/detectors/hallucinated_imports.rs (modified)
• src/detectors/license_drift.rs (added)
• src/detectors/lockfile_drift.rs (added)
• src/detectors/mod.rs (modified)
• src/detectors/phantom_deps.rs (modified)
• src/registry/crates_io.rs (modified)
• src/registry/go.rs (added)
• src/registry/mod.rs (modified)
• src/registry/npm.rs (modified)
• src/registry/pypi.rs (modified)
• tests/detectors_integration.rs (modified)
• tests/golden_detectors.rs (modified)

[codasaurus-e0a6]

Context

Blast radius

Sensitive path: src/detectors/mod.rs (+1)

Blast details

High-sensitivity paths:

• src/detectors/mod.rs
• src/registry/mod.rs

Top imports in this PR:

• super:: (3 importers)
• crate::detectors::Finding (2 importers)
• crate::parser::ParsedFile (2 importers)

_{Bounded estimate from PR imports only.}

Related pull requests

• Review maturity: advisory gate, grounding, concerns, eval, learning guard #19: Review maturity: advisory gate, grounding, concerns, eval, learning guar (2 shared files)
• Opt-in PR title fix (suggest or auto) #18: Opt-in PR title fix (suggest or auto)
• Codebase sweep: wiring cleanup + Docker logo fix #9: Codebase sweep: wiring cleanup + Docker logo fix

[codasaurus-e0a6]

Checks

Before merge

• No blocking findings
• Warning budget within limit
  • At most 0 warnings allowed. Clear the notes on the Files tab, or ask a teammate.
• PR has a title

Reviewer time ~35 min (4/5 · Complex · 19 files)

Commands

Type as plain text (GitHub Apps are not @-mentionable):

review · describe · summarize · improve · security · ask … · ignore <fp> · help

_{Full list: @codasaurus help}

[codasaurus-e0a6]

Codasaurus

Commit da3631d: advisory notes only (soft findings). Codasaurus is not requesting changes — 1 inline comment.

[lohitkolluri]

Both rounds of advisory findings addressed. Where things stand:

Resolved

• license_drift.rs — the long function is split into two small helpers (registry_for, check_dep).
• lockfile_drift.rs — the three near-identical npm/cargo/go blocks are gone. Manifest scan and lockfile lookup are now one shared lookup each, so there's no copy-paste left to maintain. (Commit 65b0be9)

Still open

• registry/mod.rs — I'd push back on this one. The match registry { "npm" => .., "pypi" => .. } dispatch was already the style of this file before the PR; it's a plain lookup, not a factory pattern. Wrapping registries in a trait layer would add indirection with nothing to abstract. Happy to revisit if you see it differently.

Checks

• cargo fmt --check and cargo clippy -- -D warnings: clean
• Tests: 204 lib + 19 detectors integration + 3 golden, all pass
• postgres_smoke and production_hardening need a local PostgreSQL; they fail without one (pre-existing, unrelated to this PR)