.golangci.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
run:
  concurrency: 2
  deadline: 5m
  timeout: 5m
issues:
  # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): revive `package-comments` and `exported` rules.
  include:
    - EXC0012
    - EXC0013
    - EXC0014
  # - EXC0015
  # Maximum issues count per one linter.
  # Set to 0 to disable.
  # Default: 50
  max-issues-per-linter: 0
  # Maximum count of issues with the same text.
  # Set to 0 to disable.
  # Default: 3
  max-same-issues: 0
  new-from-rev: ""
linters:
  disable-all: true
  enable:
    # Some linters have been removed because of the go 1.18 issues.
    # https://github.com/golangci/golangci-lint/issues/2649
    - asciicheck
    - depguard
    - dogsled
    - errcheck
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable errorlint
    # - errorlint
    - exhaustive
    - exportloopref
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable gci
    # - gci
    - gochecknoinits
    - gocognit
    - goconst
    - gocritic
    - gocyclo
    - godot
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable godox
    # - godox
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable goerr113
    # - goerr113
    - gofmt
    - gofumpt
    - goheader
    - goimports
    - gomodguard
    - goprintffuncname
    - gosec
    - gosimple
    - govet
    - ineffassign
    - lll
    - makezero
    - misspell
    - nakedret
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable nestif
    # - nestif
    - nolintlint
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable paralleltest
    # - paralleltest
    - predeclared
    - revive
    - staticcheck
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable stylecheck
    # - stylecheck
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable thelper
    # - thelper
    - typecheck
    - unconvert
    - unused
    - whitespace
    # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable thelper
    # - wrapcheck
linters-settings:
  depguard:
    rules:
      all:
        files:
          - $all
        allow:
          - $gostd

          # Approved orgs.
          - "github.com/slsa-framework"
          - "github.com/in-toto"
          - "github.com/google"
          - "github.com/sigstore"
          - "github.com/secure-systems-lab"
          - "github.com/go-openapi"

          # Approved packages.
          - "github.com/spf13/cobra" # For CLI
          - "github.com/coreos/go-oidc" # For verifying OIDC tokens.

          # Allowed packages in container-based builder.
          - "github.com/pelletier/go-toml" # For container-based builder config.
        deny:
          - pkg: "reflect"
            desc: Please don't use reflect package
          - pkg: "unsafe"
            desc: Please don't use unsafe package

      main:
        files:
          - $all
          # This is an exception for the container-based builder to allow it to use go-cmp.
          # TODO(#2247): Don't allow go-cmp in non-test code.
          - "!**/internal/builders/docker/commands.go"
          # NOTE: test code is allowed to use github.com/google/go-cmp (there is no
          #       deny for it) but non-test code is not.
          - "!$test"
        deny:
          - pkg: "github.com/google/go-cmp"
            desc: Please don't use go-cmp for non-test code.

  errcheck:
    check-type-assertions: true
    check-blank: true
  gocognit:
    # Minimal code complexity to report
    # Increased beyond default to support table-driven tests.
    min-complexity: 35
  govet:
    enable:
      - fieldalignment
  godox:
    keywords:
      - BUG
      - FIXME
      - HACK
  gci:
    sections:
      - standard
      - default
      - prefix(github.com/slsa-framework/slsa-github-generator)
  gocritic:
    enabled-checks:
      # Diagnostic
      - appendAssign
      - argOrder
      - badCond
      - caseOrder
      - codegenComment
      - commentedOutCode
      - deprecatedComment
      - dupArg
      - dupBranchBody
      - dupCase
      - dupSubExpr
      - exitAfterDefer
      - flagDeref
      - flagName
      - nilValReturn
      - offBy1
      - sloppyReassign
      - weakCond
      - octalLiteral

      # Performance
      - appendCombine
      - equalFold
      - hugeParam
      - indexAlloc
      - rangeExprCopy
      - rangeValCopy

      # Style
      - assignOp
      - boolExprSimplify
      - captLocal
      - commentFormatting
      - commentedOutImport
      - defaultCaseOrder
      - docStub
      - elseif
      - emptyFallthrough
      - emptyStringTest
      - hexLiteral
      - ifElseChain
      - methodExprCall
      - regexpMust
      - singleCaseSwitch
      - sloppyLen
      - stringXbytes
      - switchTrue
      - typeAssertChain
      - typeSwitchVar
      - underef
      - unlabelStmt
      - unlambda
      - unslice
      - valSwap
      - wrapperFunc
      - yodaStyleExpr

      # Opinionated
      - builtinShadow
      - importShadow
      - initClause
      - nestingReduce
      - paramTypeCombine
      - ptrToRefParam
      - typeUnparen
      - unnecessaryBlock