ci: add golangci-lint GitHub Actions workflow

.github/workflows/lint.yaml

@@ -0,0 +1,52 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Lint
+
+on:
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  lint:
+    name: Go
+    runs-on: ubuntu-latest
+    permissions:
+      # Required: allow read access to the content for analysis.
+      contents: read
+    steps:
+
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Go formatting
+        run: |
+          if [ -z "$(gofmt -l .)" ]; then
+            echo -e "All '*.go' files are properly formatted."
+          else
+            echo -e "Please run 'gofmt -w .' to fix. Some files need formatting:"
+            gofmt -d -l .
+            exit 1
+          fi
+
+      - name: Verify linter configuration and Lint go code
+        run: make lint

Makefile

@@ -27,6 +27,7 @@ GO := GO111MODULE=on go
 GO_PATH = $(shell $(GO) env GOPATH)
 GO_BUILD = $(GO) build
 GO_TEST = $(GO) test
+GOLANGCI_LINT_VERSION = v2.6.1
 GO_LINT = $(GO_PATH)/bin/golangci-lint
 GO_BUILD_LDFLAGS = -X github.com/apache/skywalking-eyes/commands.version=$(VERSION)
 GOOS ?= $(shell $(GO) env GOOS)
@@ -44,10 +45,11 @@ RELEASE_SRC = skywalking-$(PROJECT)-$(VERSION)-src
 all: clean lint license test build
 
 $(GO_LINT):
-	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GO_PATH)/bin v2.6.1
+	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GO_PATH)/bin $(GOLANGCI_LINT_VERSION)
 
 .PHONY: lint
 lint: $(GO_LINT)
+	$(GO_LINT) config verify
 	$(GO_LINT) run -v ./...
 
 .PHONY: fix-lint

commands/header_check.go

@@ -67,7 +67,8 @@ var CheckCommand = &cobra.Command{
 
 func writeSummaryQuietly(result *header.Result) {
 	if summaryFileName := os.Getenv("GITHUB_STEP_SUMMARY"); summaryFileName != "" {
-		if summaryFile, err := os.OpenFile(summaryFileName, os.O_WRONLY|os.O_APPEND, 0o644); err == nil {
+		summaryFile, err := os.OpenFile(summaryFileName, os.O_WRONLY|os.O_APPEND, 0o644) //nolint:gosec // path from GITHUB_STEP_SUMMARY env var
+		if err == nil {
 			defer summaryFile.Close()
 			_, _ = summaryFile.WriteString("# License Eye Summary\n")
 			_, _ = summaryFile.WriteString(result.String())

pkg/deps/golang_test.go

@@ -137,7 +137,7 @@ func TestResolvePackageLicense(t *testing.T) {
 func writeTempFile(t *testing.T, dir, name, content string) string {
 	t.Helper()
 	path := filepath.Join(dir, name)
-	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil { //nolint:gosec // path is under t.TempDir()
 		t.Fatalf("failed to write %v: %v", name, err)
 	}
 	return path

pkg/header/fix.go

@@ -63,7 +63,7 @@ func InsertComment(file string, style *comments.CommentStyle, config *ConfigHead
 
 	content = rewriteContent(style, content, licenseHeader, config.LicensePattern(style))
 
-	if err := os.WriteFile(file, content, stat.Mode()); err != nil {
+	if err := os.WriteFile(file, content, stat.Mode()); err != nil { //nolint:gosec // path from tool's own file scanner
 		return err
 	}
 

pkg/review/header.go

@@ -299,7 +299,7 @@ func GetSha() (string, error) {
 	if filepath == "" {
 		return "", fmt.Errorf("failed to get event path")
 	}
-	content, err := os.ReadFile(filepath)
+	content, err := os.ReadFile(filepath) //nolint:gosec // intentional: reading from a path from GITHUB_EVENT_PATH env var
 	if err != nil {
 		return "", err
 	}