fix: prevent nil pointer panic in profiling, unchecked JSON decode, and index out of bounds in lint

[magic-peach]

Summary

This PR fixes three bugs that can cause crashes or silent data loss:

1. Nil pointer panic in stopProfiling (pkg/cmd/profiling.go)

When os.Create(memProfilePath) fails, f is nil. The code registered defer f.Close() unconditionally, and also called pprof.WriteHeapProfile(f) on the nil writer. This causes a nil pointer dereference panic when the deferred Close() runs.

Fix: Move the defer f.Close() and WriteHeapProfile call inside an else block that only executes when os.Create succeeds.

2. Unchecked JSON decode in SearchWithContext (internal/monocular/search.go)

The error from json.NewDecoder(res.Body).Decode(result) was completely discarded. If the server returns malformed JSON (e.g., an HTML error page), the function silently returns (nil, nil), making it impossible for callers to distinguish "no results" from a parse error.

Fix: Check and return the decode error with a descriptive message.

3. Index out of bounds panic in lintChart (pkg/action/lint.go)

After extracting a .tgz to tempDir, the code accesses files[0] without checking if the slice is empty. A malformed tarball that produces an empty directory causes an index out of range runtime error.

Fix: Add a bounds check for empty directory before accessing files[0].

Related Issues

Testing

Each fix handles its edge case correctly:

• Profiling gracefully reports errors instead of crashing
• Search returns parse errors instead of silent nil
• Lint returns a descriptive error instead of panicking

Checklist

• DCO sign-off included
• Code follows the project's coding style
• Changes are minimal and focused
• No unrelated changes included

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.