agent-deck/.golangci.yml at main · Jonesxq/agent-deck · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
version: "2"
linters:
  enable:
    - gosec
    - forbidigo
  settings:
    forbidigo:
      # Issue #1163: raw os.Environ() in a spawn path leaks the conductor's
      # CLAUDE_CONFIG_DIR (telegram=true scratch) + TELEGRAM_* into child
      # claude/MCP processes, which then load the telegram plugin and fire
      # duplicate bun pollers (409 storm). The single chokepoint is
      # internal/childenv (ChildLaunchEnv / ForLaunch) — build child env there.
      forbid:
        - pattern: os\.Environ
          msg: "build child-process env via internal/childenv (ChildLaunchEnv / ForLaunch); raw os.Environ() leaks the conductor's CLAUDE_CONFIG_DIR + TELEGRAM_* into children (#1163)"
    gosec:
      excludes:
        - G104 # errors.New / fmt.Errorf — errcheck already covers real cases
        - G306 # 0o644 on cache/log files is intentional; files containing
        # secrets explicitly use 0o600 (see vapid_keys.go, gmail.go writeTokenAtomic).
        - G703 # Path traversal via taint analysis — false-positive prone for
        # internal-only path operations (worktree includes, Claude project
        # dirs, mcppool log dirs). Real path validation lives at boundary
        # entry points.
    staticcheck:
      # Only run bug-finding (SA*) checks. The quickfix (QF*), stylistic (ST*),
      # and simplification (S1*) checks are noisy and not security-relevant; we
      # keep them out of strict CI to focus on real correctness issues.
      checks:
        - SA*
  exclusions:
    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:
      - linters:
          - errcheck
          - gosec
        path: _test\.go
      # SA5011 ("possible nil pointer dereference") false-positives in tests.
      # The idiomatic table-test guard `if ptr == nil { t.Fatal(...) }` followed
      # by `ptr.Field` is safe because t.Fatal terminates the goroutine, but
      # staticcheck's flow analysis (as resolved by golangci-lint-action's
      # bundled version) does not always model t.Fatal as terminating and flags
      # the later deref. This had cycled the lint workflow repeatedly because the
      # `max-same-issues: 3` cap hid sites until they were fixed one batch at a
      # time. Suppress SA5011 in test files permanently — these are never real
      # bugs in production code.
      - linters:
          - staticcheck
        path: _test\.go
        text: 'SA5011'
      # forbidigo (os.Environ ban, #1163) applies to spawn paths. Test files,
      # the childenv chokepoint itself, and non-spawn helpers are exempt:
      #   - internal/childenv: the one allow-listed home for os.Environ()
      #   - internal/git: worktree setup script runner (not a claude child)
      #   - internal/web: tmux PTY bridge env (not a claude child)
      #   - internal/testutil + tests/eval: test scaffolding
      - linters:
          - forbidigo
        path: _test\.go
      - linters:
          - forbidigo
        path: internal/childenv/
      - linters:
          - forbidigo
        path: internal/git/
      - linters:
          - forbidigo
        path: internal/web/
      - linters:
          - forbidigo
        path: internal/testutil/
      - linters:
          - forbidigo
        path: tests/eval/
      - linters:
          - gosec
        path: docs/
      # Test infrastructure helpers — G204 (subprocess) and G115 (cast) are
      # expected; these are internal-only test fixtures, never reachable in
      # production binaries.
      - linters:
          - gosec
        path: internal/testutil/
      # Eval harness fakes (shim binaries, scripted PTY runners) — gosec
      # subprocess/perm warnings are intentional for test scaffolding.
      - linters:
          - gosec
        path: tests/eval/
      # Docker container management — every exec.CommandContext takes "docker"
      # as a fixed binary and an internal container name; G204 is a consistent
      # false positive across this package.
      - linters:
          - gosec
        path: internal/docker/
      # tmux package wraps the tmux CLI: every exec.Command is "tmux" with
      # agent-deck-constructed args (subcommand + internal -L socket plumbing).
      # G204 fires on each call but the inputs are never external.
      - linters:
          - gosec
        text: G204
        path: internal/tmux/
    paths:
      - third_party$
      - builtin$
      - examples$
formatters:
  enable:
    - gofmt
  exclusions:
    generated: lax
    paths:
      - third_party$
      - builtin$
      - examples$