Add deadmut linter

[mickamy]

Repository URL

https://github.com/go-by-value/deadmut

Analyzer Requirements

• The analyzer must be more than one month old.
• The usage of AI must be explicitly expressed inside the readme.
• It must use go/analysis.
• It must not be a duplicate or too close to an existing analyzer.
• It must have a Go version inside the go.mod <= 1.25.0.
• The dependencies must be minimal.
• It must be available as a plugin.

Analyzer Goal

Finds bugs

Analyzer Description

Reports writes to a range loop value copy that have no effect: direct field writes, pointer-receiver method calls, and &v arguments, when the copy is never read afterwards. Whether a callee writes through its pointer receiver or parameter is computed as a fact across packages, so read-only methods are not reported.

Analyzer License

MIT

Analyzer License Checks

• The file must start with LICENSE (capitalized).
• The file(s) must contain the required information by the license, e.g.: author, year, etc.

Analyzer Details

• It must have tests.
• It must not contain init().
• It must not contain panic().
• It must not contain log.Fatal().
• It must not contain os.Exit().
• It must not modify the AST.
• The configuration must not rely on external files.

Repository Details

• It must have a semver tag, e.g.: v1.0.0, v0.1.0 (0.0.x are not valid).
• I understand that tags must never be deleted or recreated once published.
• It must have a readme.
• The repository must have a CI.
• The CI must run on PR.
• The CI must run on the default branch.

Repository Recommendations

• It should have linting.
• It should have a .gitignore (IDE files, binaries, OS files, etc. should not be committed).
• Use main as the default branch name.

Pull Request

• Yes, I will wait for the approval of a maintainer before creating a PR.

[mickamy]

A few notes that I expect to come up:

Relation to govet's unusedwrite. unusedwrite also reports the first form, a direct field write to a copy. deadmut differs in scope: it also reports pointer-receiver method calls (v.SetName("x")) and &v arguments (if err := update(&v); err != nil) on a range copy, but only when the callee is known to write to the storage owned by the copy. That knowledge is computed per function and exported as a fact, so it crosses package boundaries: bytes.Buffer.WriteString on a copy is reported, bytes.Buffer.Len is not. Writes that go through pointer, slice, or map fields are shared with the original element and are not reported. The README has a comparison table.

False positives. deadmut stays quiet unless the mutation is certainly lost: any later read, including in defer, go, or a closure, suppresses the report; candidates inside nested loops or closures, bodies with goto, calls whose results are consumed (other than error), and callees whose behavior is unknown (interface-typed parameters, function values, no source) are skipped. Running it over the standard library and 25 local modules produced no reports, and the testdata covers the negative cases.

init(). The only init() is in plugin/, where register.Plugin requires it for the module plugin system. The analyzer package has none.

History. The repository dates from February 2026 (as mickamy/deadmut) and was moved to the go-by-value organization in August 2026, when the analyzer was rewritten around the fact-based design described above.