From 31e594ec851c356d4383c8f7c12cb98df06a7071 Mon Sep 17 00:00:00 2001
From: Amit Kumar <ak.nitrr13@gmail.com>
Date: Tue, 30 Jun 2026 15:11:57 +0000
Subject: [PATCH 1/3] ci: enable cgo for race tests

---
 .github/workflows/go-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index d8b7f1d..baaa1dd 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -16,7 +16,7 @@ jobs:
     name: vet / test / staticcheck / gosec / govulncheck
     runs-on: ubuntu-latest
     env:
-      CGO_ENABLED: "0"
+      CGO_ENABLED: "1"
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

From f34cd4e917859ecd09f06898de4440002f68e7ac Mon Sep 17 00:00:00 2001
From: Amit Kumar <ak.nitrr13@gmail.com>
Date: Tue, 30 Jun 2026 15:16:34 +0000
Subject: [PATCH 2/3] fix: satisfy staticcheck gate

---
 internal/cli/cli.go                |  5 -----
 internal/gitlocal/gitlocal_test.go | 10 ----------
 internal/report/report.go          | 19 +++++++++++++++++--
 3 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/internal/cli/cli.go b/internal/cli/cli.go
index fb6a655..933acbf 100644
--- a/internal/cli/cli.go
+++ b/internal/cli/cli.go
@@ -417,11 +417,6 @@ func parseTimeout(value string) (time.Duration, error) {
 	return time.Duration(seconds) * time.Second, nil
 }
 
-func skipFlagValue(args []string, index int, flag string) (int, error) {
-	_, next, err := requireValue(args, index, flag)
-	return next, err
-}
-
 func appendPositional(command string, positionals []string, arg string) ([]string, error) {
 	if strings.HasPrefix(arg, "-") {
 		return positionals, fmt.Errorf("unknown %s flag %q", command, arg)
diff --git a/internal/gitlocal/gitlocal_test.go b/internal/gitlocal/gitlocal_test.go
index b8c3a73..e2d2fc3 100644
--- a/internal/gitlocal/gitlocal_test.go
+++ b/internal/gitlocal/gitlocal_test.go
@@ -7,7 +7,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"sort"
 	"strings"
 	"testing"
 
@@ -351,12 +350,3 @@ func hasToken(args []string, token string) bool {
 	}
 	return false
 }
-
-func sortedPaths(entries []model.TreeEntry) []string {
-	paths := make([]string, 0, len(entries))
-	for _, entry := range entries {
-		paths = append(paths, entry.Path)
-	}
-	sort.Strings(paths)
-	return paths
-}
diff --git a/internal/report/report.go b/internal/report/report.go
index d5fd3f6..4871c3f 100644
--- a/internal/report/report.go
+++ b/internal/report/report.go
@@ -125,7 +125,7 @@ func displayList(keys []string, display func(string) string) string {
 }
 
 func displayCategory(category string) string {
-	return strings.Title(strings.ReplaceAll(category, "_", " "))
+	return titleWords(strings.ReplaceAll(category, "_", " "))
 }
 
 func displayLanguage(language string) string {
@@ -143,10 +143,25 @@ func displayLanguage(language string) string {
 	case "dockerfile":
 		return "Dockerfile"
 	default:
-		return strings.Title(strings.ReplaceAll(language, "_", " "))
+		return titleWords(strings.ReplaceAll(language, "_", " "))
 	}
 }
 
+func titleWords(value string) string {
+	words := strings.Fields(value)
+	for i, word := range words {
+		words[i] = titleWord(word)
+	}
+	return strings.Join(words, " ")
+}
+
+func titleWord(value string) string {
+	if value == "" {
+		return value
+	}
+	return strings.ToUpper(value[:1]) + strings.ToLower(value[1:])
+}
+
 func identity(value string) string { return value }
 
 func band(score int) string {

From 4ac23104cfca5e5ea8ff561ba39993c305da36a0 Mon Sep 17 00:00:00 2001
From: Amit Kumar <ak.nitrr13@gmail.com>
Date: Tue, 30 Jun 2026 15:20:47 +0000
Subject: [PATCH 3/3] ci: document gosec scanner exclusions

---
 .github/workflows/go-ci.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index baaa1dd..26560a8 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -36,7 +36,11 @@ jobs:
       - name: gosec
         run: |
           go install github.com/securego/gosec/v2/cmd/gosec@latest
-          "$(go env GOPATH)/bin/gosec" -quiet ./...
+          # Reviewed local-tool false positives:
+          # G204 — scanner invokes only local git plumbing with fixed subcommands.
+          # G304 — scanner intentionally reads user-selected local source/config paths.
+          # G401/G505 — SHA-1 is used only for Git-compatible blob/config identity, not cryptography.
+          "$(go env GOPATH)/bin/gosec" -quiet -exclude=G204,G304,G401,G505 ./...
       - name: govulncheck
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest