.golangci.yml

version: "2"
run:
  allow-parallel-runners: true
  modules-download-mode: readonly
  go: "1.26.4"
formatters:
  enable:
    - gci
    - gofmt
    - gofumpt
    - goimports
    - golines
    - swaggo
linters:
  default: all
  enable:
    - wsl_v5
  disable:
    - exhaustruct
    - wsl
    - ireturn
  exclusions:
    paths:
      - ".*mocks.*\\.go$"
      - "^vsce/node_modules/.*\\.go$"
    rules:
      # Tests that mutate shared global state (SetClusterStabilityCheckForTests) cannot run in parallel
      - linters:
          - paralleltest
        path: pkg/cli/setup/post_cni_internal_test.go
      # Tests that modify env vars cannot run in parallel
      - linters:
          - paralleltest
        path: pkg/svc/detector/cluster/cluster_test.go
      # Tests that modify env vars cannot run in parallel
      - linters:
          - paralleltest
        path: pkg/k8s/rest_config_test.go
      # Tests that mutate the global go-keyring mock provider cannot run in parallel
      - linters:
          - paralleltest
        path: pkg/svc/credentials/store_test.go
      # Bubbletea requires context in the Model struct
      - linters:
          - containedctx
        path: pkg/cli/ui/chat/
      # lipgloss style variables must be package-level globals
      - linters:
          - gochecknoglobals
        path: pkg/cli/ui/chat/
      # repairer package uses a process-wide registry singleton and an
      # immutable byte-pattern constant that cannot be expressed as a Go
      # const because of its []byte type.
      - linters:
          - gochecknoglobals
        path: pkg/svc/repairer/
      # Package names that conflict with stdlib or are too generic cannot be renamed without breaking changes
      - linters:
          - revive
        text: "var-naming: avoid package names that conflict with Go standard library package names"
        path: pkg/(io|cli/cmd/cipher|svc/image)/
      - linters:
          - revive
        text: "var-naming: avoid meaningless package names"
        path: pkg/utils/doc.go
  settings:
    goconst:
      # Repeated string literals in table-driven tests (distribution names, config
      # field paths, fixture cluster names) are idiomatic and clearer inline than
      # behind shared constants; only flag duplicated literals in production code.
      ignore-tests: true
    recvcheck:
      # Some methods have their receiver style dictated by an external contract, not by choice:
      # controller-gen emits DeepCopy* methods and json.Unmarshaler requires a pointer receiver for
      # UnmarshalJSON. Exclude them so types with value-receiver domain methods (e.g. ClusterSpec,
      # LocalRegistry, AutoscalerExpanderList) are not flagged as mixing receiver styles.
      exclusions:
        - "*.DeepCopyInto"
        - "*.DeepCopy"
        - "*.DeepCopyObject"
        - "*.UnmarshalJSON"
    tagalign:
      align: false
      sort: true
    gomoddirectives:
      replace-local: true
      replace-allow-list:
        - github.com/docker/docker
        - github.com/docker/cli
        - github.com/opencontainers/runtime-spec
        - github.com/loft-sh/log
        - github.com/anchore/grype
        - github.com/kubescape/kubescape/v3
        - github.com/moby/go-archive
    wsl_v5:
      allow-first-in-block: true
      allow-whole-block: false
      branch-max-lines: 2
    depguard:
      rules:
        main:
          files:
            - "$all"
            - "!$test"
          list-mode: strict
          allow:
            - $gostd
            # wails is the native desktop module's UI runtime (desktop/ is a separate Go module). The
            # CLI binary never imports it; allowing it here lets the desktop module lint under this
            # shared config without per-import nolint:depguard directives.
            - github.com/wailsapp/wails
            - github.com/apricote
            - github.com/atotto
            - github.com/devantler-tech
            - github.com/charmbracelet
            - github.com/cli
            - github.com/derailed/k9s
            - github.com/fluxcd
            - github.com/getsops/sops
            - github.com/github/copilot-sdk
            - github.com/go-viper/mapstructure/v2
            - github.com/google/go-containerregistry
            - github.com/google/go-github
            - github.com/hetznercloud
            - github.com/invopop/jsonschema
            - github.com/Masterminds/semver
            - github.com/mitchellh
            - github.com/wk8/go-ordered-map
            - github.com/samber/do/v2
            - github.com/containerd
            - github.com/coreos/go-oidc
            - github.com/cosi-project
            - github.com/docker
            - github.com/opencontainers/image-spec
            - github.com/fatih/color
            - github.com/fsnotify/fsnotify
            - github.com/fluxcd
            - github.com/gkampitakis/go-snaps
            - github.com/coder/websocket
            - github.com/gorilla/websocket
            - github.com/jinzhu/copier
            - github.com/k3d-io
            - github.com/kubescape
            - github.com/rancher
            - github.com/mittwald
            - github.com/modelcontextprotocol
            - github.com/spf13/cobra
            - github.com/spf13/pflag
            - github.com/spf13/viper
            - github.com/stretchr/testify
            - github.com/siderolabs
            # sigstore-go (+ the sigstore signature helpers) powers cosign/sigstore plugin verification
            # in pkg/svc/pluginsig. The CLI binary already links these transitively (via the kubescape
            # client); they are confined to pluginsig (wired in only at the `ksail open web` command
            # layer) so clusterapi and the desktop module stay sigstore-free. The org prefix covers both
            # github.com/sigstore/sigstore-go and github.com/sigstore/sigstore (the signature helpers).
            - github.com/sigstore
            - github.com/sirupsen/logrus
            - github.com/loft-sh/log
            - github.com/loft-sh/vcluster
            - github.com/yannh
            - github.com/zalando/go-keyring
            - filippo.io/age
            - golang.design/x
            - golang.org/x/oauth2
            - golang.org/x/sync
            - golang.org/x/term
            - golang.org/x/text
            - gopkg.in/yaml.v3
            - helm.sh/helm
            - k8s.io
            - sigs.k8s.io