Skip to content

feat(corpus): lock the ShareX TcpListener + StreamReader leaks as reg… #351

feat(corpus): lock the ShareX TcpListener + StreamReader leaks as reg…

feat(corpus): lock the ShareX TcpListener + StreamReader leaks as reg… #351

Triggered via push June 21, 2026 07:24
Status Success
Total duration 1m 38s
Artifacts –

ci.yml

on: push
lint (ruff + mypy --strict)
10s
lint (ruff + mypy --strict)
extended codegen fuzz
35s
extended codegen fuzz
golden C# compiles & runs (.NET)
14s
golden C# compiles & runs (.NET)
C# leak extractor (Roslyn) -> OwnIR -> core
35s
C# leak extractor (Roslyn) -> OwnIR -> core
own-check repo scan (github + msbuild) + composite action
48s
own-check repo scan (github + msbuild) + composite action
own-check SARIF -> GitHub code scanning (dog-food)
28s
own-check SARIF -> GitHub code scanning (dog-food)
corpus benchmark (real C# recall + specificity)
1m 34s
corpus benchmark (real C# recall + specificity)
Matrix: tests
Fit to window
Zoom out
Zoom in

Annotations

25 errors and 36 warnings
OWN002: frontend/roslyn/samples/FlowLocalsSample.cs#L15
[OWN002] IDisposable local 'uad' is used after it is disposed [resource: disposable]
OWN001: frontend/roslyn/samples/DisposableFieldViewModel.cs#L10
[OWN001] IDisposable field '_cts' (type 'CancellationTokenSource') is never disposed — its owner 'ReportViewModel' leaks it (leak) [resource: disposable field]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L72
[DI001] singleton 'PrimaryCtorService' captures scoped service 'AppDbContext' (captive dependency: PrimaryCtorService -> AppDbContext) [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L69
[DI001] singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo) [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L61
[DI001] singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext) [resource: DI lifetime]
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L87
IDisposable local 'forLeak' is never disposed (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L75
IDisposable local 'foreachLeak' is never disposed (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L64
IDisposable local 'whileLeak' is never disposed (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L24
IDisposable local 'leak' may not be disposed on every path (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L15
IDisposable local 'uad' is used after it is disposed
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DisposableFieldViewModel.cs#L10
IDisposable field '_cts' (type 'CancellationTokenSource') is never disposed — its owner 'ReportViewModel' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L72
singleton 'PrimaryCtorService' captures scoped service 'AppDbContext' (captive dependency: PrimaryCtorService -> AppDbContext)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L69
singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L61
singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext)
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L87
[OWN001] IDisposable local 'forLeak' is never disposed (leak) [resource: disposable]
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L75
[OWN001] IDisposable local 'foreachLeak' is never disposed (leak) [resource: disposable]
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L64
[OWN001] IDisposable local 'whileLeak' is never disposed (leak) [resource: disposable]
OWN003: frontend/roslyn/samples/FlowLocalsSample.cs#L34
[OWN003] IDisposable local 'dbl' is disposed more than once [resource: disposable]
OWN001: frontend/roslyn/samples/FlowLocalsSample.cs#L24
[OWN001] IDisposable local 'leak' may not be disposed on every path (leak) [resource: disposable]
OWN002: frontend/roslyn/samples/FlowLocalsSample.cs#L15
[OWN002] IDisposable local 'uad' is used after it is disposed [resource: disposable]
OWN001: frontend/roslyn/samples/DisposableFieldViewModel.cs#L10
[OWN001] IDisposable field '_cts' (type 'CancellationTokenSource') is never disposed — its owner 'ReportViewModel' leaks it (leak) [resource: disposable field]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L72
[DI001] singleton 'PrimaryCtorService' captures scoped service 'AppDbContext' (captive dependency: PrimaryCtorService -> AppDbContext) [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L69
[DI001] singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo) [resource: DI lifetime]
DI001: frontend/roslyn/samples/DiCaptiveSample.cs#L61
[DI001] singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext) [resource: DI lifetime]
tests (py3.13)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
tests (py3.12)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
tests (py3.11)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
lint (ruff + mypy --strict)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
golden C# compiles & runs (.NET)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
own-check SARIF -> GitHub code scanning (dog-food)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
own-check SARIF -> GitHub code scanning (dog-food): frontend/roslyn/OwnSharp.Extractor/Program.cs#L1104
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
extended codegen fuzz
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
C# leak extractor (Roslyn) -> OwnIR -> core
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
C# leak extractor (Roslyn) -> OwnIR -> core: frontend/roslyn/OwnSharp.Extractor/Program.cs#L1104
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
OWN001: frontend/roslyn/samples/ExternalRefSubscription.cs#L20
[OWN001] event '_bus.Changed' is subscribed (handler 'OnChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ExternalRefSubscription' alive (possible leak) [resource: subscription token]
DI003: frontend/roslyn/samples/DiCaptiveSample.cs#L85
[DI003] singleton 'ConnectionWarmer' captures transient IDisposable 'PooledConnection': it is promoted to application lifetime and disposed only when the root provider is disposed (ConnectionWarmer -> PooledConnection) [resource: DI lifetime]
OWN001: frontend/roslyn/samples/CustomerViewModel.cs#L15
[OWN001] event 'bus.CustomerChanged' is subscribed (handler 'OnCustomerChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CustomerViewModel' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
[OWN001] event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak) [resource: subscription token]
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L24
IDisposable local 'leak' may not be disposed on every path (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/FlowLocalsSample.cs#L15
IDisposable local 'uad' is used after it is disposed
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/ExternalRefSubscription.cs#L20
event '_bus.Changed' is subscribed (handler 'OnChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ExternalRefSubscription' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DisposableFieldViewModel.cs#L10
IDisposable field '_cts' (type 'CancellationTokenSource') is never disposed — its owner 'ReportViewModel' leaks it (leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L85
singleton 'ConnectionWarmer' captures transient IDisposable 'PooledConnection': it is promoted to application lifetime and disposed only when the root provider is disposed (ConnectionWarmer -> PooledConnection)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L72
singleton 'PrimaryCtorService' captures scoped service 'AppDbContext' (captive dependency: PrimaryCtorService -> AppDbContext)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L69
singleton 'CacheService' captures scoped service 'IRepo' (captive dependency: CacheService -> IRepo)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L61
singleton 'EmailSender' captures scoped service 'AppDbContext' (captive dependency: EmailSender -> AppDbContext)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/CustomerViewModel.cs#L15
event 'bus.CustomerChanged' is subscribed (handler 'OnCustomerChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CustomerViewModel' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/LambdaHandlerViewModel.cs#L21
event 'bus.CustomerChanged' is subscribed (handler '(s, e) => _count++') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'LambdaHandlerViewModel' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/ExternalRefSubscription.cs#L20
event '_bus.Changed' is subscribed (handler 'OnChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ExternalRefSubscription' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/DiCaptiveSample.cs#L85
singleton 'ConnectionWarmer' captures transient IDisposable 'PooledConnection': it is promoted to application lifetime and disposed only when the root provider is disposed (ConnectionWarmer -> PooledConnection)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/CustomerViewModel.cs#L15
event 'bus.CustomerChanged' is subscribed (handler 'OnCustomerChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CustomerViewModel' alive (possible leak)
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak)
OWN001: frontend/roslyn/samples/LambdaHandlerViewModel.cs#L21
[OWN001] event 'bus.CustomerChanged' is subscribed (handler '(s, e) => _count++') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'LambdaHandlerViewModel' alive (possible leak — and being an inline lambda it has no '-=' handle, so it could never be detached) [resource: subscription token]
OWN001: frontend/roslyn/samples/ExternalRefSubscription.cs#L20
[OWN001] event '_bus.Changed' is subscribed (handler 'OnChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'ExternalRefSubscription' alive (possible leak) [resource: subscription token]
DI003: frontend/roslyn/samples/DiCaptiveSample.cs#L85
[DI003] singleton 'ConnectionWarmer' captures transient IDisposable 'PooledConnection': it is promoted to application lifetime and disposed only when the root provider is disposed (ConnectionWarmer -> PooledConnection) [resource: DI lifetime]
OWN001: frontend/roslyn/samples/CustomerViewModel.cs#L15
[OWN001] event 'bus.CustomerChanged' is subscribed (handler 'OnCustomerChanged') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'CustomerViewModel' alive (possible leak) [resource: subscription token]
OWN001: frontend/roslyn/samples/AliasedSourceViewModel.cs#L23
[OWN001] event 'src.CustomerChanged' is subscribed (handler 'OnAliased') but never unsubscribed; its source is an injected dependency whose lifetime is unknown, so it may outlive and keep 'AliasedSourceViewModel' alive (possible leak) [resource: subscription token]
own-check repo scan (github + msbuild) + composite action: frontend/roslyn/OwnSharp.Extractor/Program.cs#L1104
Argument of type 'IEnumerable<string?>' cannot be used for parameter 'collection' of type 'IEnumerable<string>' in 'HashSet<string>.HashSet(IEnumerable<string> collection, IEqualityComparer<string>? comparer)' due to differences in the nullability of reference types.
corpus benchmark (real C# recall + specificity)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/