.golangci.yml

# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
# SPDX-License-Identifier: Apache-2.0

run:
  issues-exit-code: 1
  timeout: 5m

linters-settings:
  lll:
    line-length: 130
  gocyclo:
    min-complexity: 15
  gci:
    sections:
      - standard
      - default
      - prefix(github.com/mindersec/minder)
  revive:
    # see https://github.com/mgechev/revive#available-rules for details.
    ignore-generated-header: true
    severity: warning
    errorCode: 0
    warningCode: 0
    rules:
      - name: blank-imports
        severity: warning
      - name: context-as-argument
      - name: context-keys-type
      - name: duplicated-imports
      - name: error-naming
      # - name: error-strings #BDG: This was enabled for months, but it suddenly started working on 3/2/2022.. come to find out we have TONS of error messages starting with capital... disabling for now(ever?)
      - name: error-return
      - name: exported
        severity: error
      - name: if-return
      # - name: get-return // BDG: We have a lot of API endpoint handlers named like getFoos but write to response vs return... maybe later can figure that out
      - name: identical-branches
      - name: indent-error-flow
      - name: import-shadowing
      - name: package-comments
      # NOTE: range-val-address and range-val-in-closure are irrelevant in Go 1.22 and later
      - name: redefines-builtin-id
      - name: struct-tag
      - name: unconditional-recursion
      - name: unnecessary-stmt
      - name: unreachable-code
      - name: unused-parameter
      - name: unused-receiver
      - name: unhandled-error
        disabled: true
  gosec:
    excludes:
      - G114 # for the moment we need to use listenandserve that has no support for timeouts
      - G404 # use unsafe random generator until logic change is discussed
      - G307 # Deferring unsafe method "Close" on type "io.ReadCloser"
      - G601 # Irrelevant for Go 1.22 and later, see: https://github.com/securego/gosec/issues/1099

  depguard:
    rules:
      prevent_unmaintained_packages:
        list-mode: lax # allow unless explicitely denied
        files:
          - $all
          - "!$test"
        deny:
          - pkg: "log"
            desc: "We should use zerolog instead"
          - pkg: io/ioutil
            desc: "this is deprecated"

linters:
  disable-all: true
  enable:
    - lll
    - exhaustive
    - depguard
    - goconst
    - gocyclo
    - gofmt
    - gosec
    - gci
    - unparam
    - gosimple
    - govet
    - ineffassign
    - paralleltest
    - promlinter
    - revive
    - staticcheck
    - unused
    - thelper
    - tparallel

issues:
  exclude-use-default: false
  exclude-rules:
    - path: '(.+)_test\.go'
      linters:
        - lll

output:
  formats:
    - format: colored-line-number
  print-issued-lines: true
  print-linter-name: true
  sort-results: true