feat(go): Replace hardcoded stdlib set with GoImportResolver struct (PR-09)

[shivasurya]

Summary

• Replaced the static goStdlibSet() hardcoded map with a dynamic GoImportResolver struct that uses StdlibLoader.ValidateStdlibImport() for version-aware, registry-backed stdlib detection
• Added ImportType enum (ImportUnknown, ImportStdlib, ImportThirdParty, ImportLocal) and public methods ClassifyImport / ResolveImports for structured import classification
• Implemented offline heuristic fallback (isStdlibImportFallback) for cases where no StdlibLoader is available — packages with no domain separator (.) in their path and not prefixed with internal/ are classified as stdlib
• Removed hardcoded StdlibPackages assertions from TestBuildGoModuleRegistry and deleted TestGoStdlibSet; added 10 new TestGoImportResolver_* tests covering nil registry, fallback heuristic, loader delegation, local module detection, relative paths, and batch resolution

Changes

sast-engine/graph/callgraph/resolution/go_imports.go

• Removed goStdlibSet() function (~124 lines of hardcoded map)
• Removed registry.StdlibPackages = goStdlibSet() call from BuildGoModuleRegistry
• Added ImportType enum with four constants
• Added GoImportResolver struct with NewGoImportResolver constructor
• Added isStdlibImport, isStdlibImportFallback, ClassifyImport, ResolveImports methods

sast-engine/graph/callgraph/resolution/go_imports_test.go

• Removed TestGoStdlibSet test
• Removed hardcoded StdlibPackages assertions from TestBuildGoModuleRegistry
• Added mockResolutionStdlibLoader in-package mock implementing StdlibLoaderInterface
• Added 10 new tests: TestGoImportResolver_NilRegistry, TestGoImportResolver_isStdlibImportFallback, TestGoImportResolver_isStdlibImport_WithLoader, TestGoImportResolver_isStdlibImport_NilLoader_FallsBackToHeuristic, TestGoImportResolver_ClassifyImport_Stdlib, TestGoImportResolver_ClassifyImport_ThirdParty, TestGoImportResolver_ClassifyImport_Local_RelativePath, TestGoImportResolver_ClassifyImport_Local_SameModule, TestGoImportResolver_ResolveImports, TestGoImportResolver_ResolveImports_Empty

Test plan

• All 10 new TestGoImportResolver_* tests pass
• Existing TestBuildGoModuleRegistry still passes
• TestExtractGoImports still passes (uses empty StdlibPackages map)
• No hardcoded stdlib package list remains in the resolver
• Nil registry / nil loader cases handled without panics
• Local module detection works for both relative paths and same-module prefix imports

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

_{This report is generated by SafeDep Github App}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.32%. Comparing base (fc68795) to head (899ef90).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #557      +/-   ##
==========================================
- Coverage   83.36%   83.32%   -0.04%     
==========================================
  Files         143      143              
  Lines       17820    17782      -38     
==========================================
- Hits        14855    14817      -38     
  Misses       2426     2426              
  Partials      539      539              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shivasurya]

• feat(go): Replace hardcoded stdlib set with GoImportResolver struct (PR-09) #557 👈 (View in Graphite)
• feat(go): Add stdlib metadata to MCP call graph tool responses (PR-08) #556
• feat(go): Close stdlib type inference gap in GetReturnType (PR-07b) #555
• feat(go): Resolve stdlib return types in variable extraction (PR-07) #554
• feat(go): Wire stdlib loader into builder pipeline (PR-06) #553
• feat(go): Add Go version detection and stdlib loader init (PR-05) #552
• feat(go): Add Go stdlib R2 publishing pipeline (PR-04) #551
• feat(go): Add Go stdlib remote registry loader with lazy caching (PR-03) #549
• feat(go): Add Go stdlib extraction tool for registry generation (PR-02) #548
• feat(go): Add Go stdlib registry data structures and types (PR-01) #546
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[shivasurya]

Merge activity

• Feb 25, 3:17 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Feb 25, 3:32 AM UTC: Graphite couldn't merge this pull request because a downstack PR feat(go): Close stdlib type inference gap in GetReturnType (PR-07b) #555 failed to merge.
• Feb 25, 3:54 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Feb 25, 3:57 AM UTC: Graphite rebased this pull request as part of a merge.
• Feb 25, 3:58 AM UTC: @shivasurya merged this pull request with Graphite.

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	2
Rules	38

---

_{Powered by Code Pathfinder}