Migrate golangci-lint to GitHub Actions (#1351)

* Migrate golangci-lint to GitHub Actions

* `golangci-lint migrate`

* Fix golangci-lint issues

Author: roger2hk

.github/workflows/golangci-lint.yml

@@ -0,0 +1,23 @@
+name: golangci-lint
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: go.mod
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        with:
+          version: v2.5.0
+          args: --timeout=8m

.golangci.yaml

@@ -1,38 +1,41 @@
+version: "2"
 run:
-  # timeout for analysis, e.g. 30s, 5m, default is 1m
-  deadline: 90s
   build-tags:
     - lint
-
-linters-settings:
-  gocyclo:
-    # minimal code complexity to report, 30 by default (but we recommend 10-20)
-    min-complexity: 25
-  depguard:
-    packages:
-      - golang.org/x/net/context
-      - github.com/gogo/protobuf/proto
-      - encoding/asn1
-      - crypto/x509
-
-issues:
-  # Don't turn off any checks by default. We can do this explicitly if needed.
-  exclude-use-default: false
-  # List of regexps of issue texts to exclude.
-  #
-  # But independently of this option we use default exclude patterns,
-  # it can be disabled by `exclude-use-default: false`.
-  # To list all excluded by default patterns execute `golangci-lint run --help`
-  #
-  # Default: https://golangci-lint.run/usage/false-positives/#default-exclusions
-  exclude:
-    - "package-comments: should have a package comment"
-
-  exclude-rules:
-    # The following grpc linters are excluded because grpc.Dial, grpc.DialContext and grpc.WithBlock will be supported throughout 1.x.
-    - linters: [staticcheck]
-      text: 'SA1019: grpc.Dial is deprecated: use NewClient instead'
-    - linters: [staticcheck]
-      text: 'SA1019: grpc.DialContext is deprecated: use NewClient instead'
-    - linters: [staticcheck]
-      text: 'SA1019: grpc.WithBlock is deprecated: this DialOption is not supported by NewClient'
+linters:
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: golang.org/x/net/context
+            - pkg: github.com/gogo/protobuf/proto
+            - pkg: encoding/asn1
+            - pkg: crypto/x509
+    gocyclo:
+      min-complexity: 25
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - staticcheck
+        text: 'SA1019: grpc.Dial is deprecated: use NewClient instead'
+      - linters:
+          - staticcheck
+        text: 'SA1019: grpc.DialContext is deprecated: use NewClient instead'
+      - linters:
+          - staticcheck
+        text: 'SA1019: grpc.WithBlock is deprecated: this DialOption is not supported by NewClient'
+      - path: (.+)\.go$
+        text: 'package-comments: should have a package comment'
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

binary_transparency/firmware/cmd/ft_witness/impl/ft_witness.go

@@ -42,7 +42,7 @@ type WitnessOpts struct {
 // Main kickstarts the witness
 func Main(ctx context.Context, opts WitnessOpts) error {
 	if len(opts.WSFile) == 0 {
-		return errors.New("Witness Store file is required")
+		return errors.New("witness store file is required")
 	}
 
 	ws, err := ws.NewStorage(opts.WSFile)

binary_transparency/firmware/internal/crypto/signature.go

@@ -158,6 +158,6 @@ func ClaimantForType(t api.StatementType) (*Claimant, error) {
 	case api.MalwareStatementType:
 		return &AnnotatorMalware, nil
 	default:
-		return nil, fmt.Errorf("Unknown Claimant type %v", t)
+		return nil, fmt.Errorf("unknown Claimant type %v", t)
 	}
 }

clone/cmd/sumdbverify/verify.go

@@ -194,7 +194,7 @@ func (v sumdbVerifier) verifyLeaves(ctx context.Context) (uint64, error) {
 		return 0, fmt.Errorf("GetRootHash(): %v", err)
 	}
 	if !bytes.Equal(rootHash, cp.Hash) {
-		return 0, fmt.Errorf("Data corruption: checkpoint from DB has hash %x but calculated hash %x from leaves", cp.Hash, rootHash)
+		return 0, fmt.Errorf("data corruption: checkpoint from DB has hash %x but calculated hash %x from leaves", cp.Hash, rootHash)
 	}
 	return index, nil
 }

experimental/batchmap/ctmap/cmd/build/build.go

@@ -222,7 +222,7 @@ func (w *writeCheckpointFn) ProcessElement(ctx context.Context, t *batchmap.Tile
 		return err
 	}
 
-	if _, err := fd.Write([]byte(fmt.Sprintf("%d\n%x\n", w.EntryCount, root))); err != nil {
+	if _, err := fd.Write(fmt.Appendf(nil, "%d\n%x\n", w.EntryCount, root)); err != nil {
 		return err
 	}
 	if _, err := fd.Write(w.LogCheckpoint); err != nil {

experimental/batchmap/sumdb/build/pipeline/entries.go

@@ -65,17 +65,17 @@ func ParseStatementFn(l InputLogLeaf) Metadata {
 	lines := strings.Split(string(l.Data), "\n")
 
 	if len(lines) != 3 {
-		panic(fmt.Errorf("Expected 2 lines in log leaf, but got %d", len(lines)))
+		panic(fmt.Errorf("expected 2 lines in log leaf, but got %d", len(lines)))
 	}
 	line0Parts := line0RE.FindStringSubmatch(lines[0])
 	if got, want := len(line0Parts), 4; got != want {
-		panic(fmt.Errorf("Regexp: line0 expected %d submatches, but got %d", want, got))
+		panic(fmt.Errorf("regexp: line0 expected %d submatches, but got %d", want, got))
 	}
 	line0Module, line0Version, line0Hash := line0Parts[1], line0Parts[2], line0Parts[3]
 
 	line1Parts := line1RE.FindStringSubmatch(lines[1])
 	if got, want := len(line1Parts), 4; got != want {
-		panic(fmt.Errorf("Regexp: line1 expected %d submatches, but got %d (%q)", want, got, lines[1]))
+		panic(fmt.Errorf("regexp: line1 expected %d submatches, but got %d (%q)", want, got, lines[1]))
 	}
 	line1Module, line1Version, line1Hash := line1Parts[1], line1Parts[2], line1Parts[3]
 
@@ -113,7 +113,7 @@ type mapEntryFn struct {
 
 func (fn *mapEntryFn) ProcessElement(m Metadata, emit func(*batchmap.Entry)) {
 	h := hash.New()
-	h.Write([]byte(fmt.Sprintf("%s %s/go.mod", m.Module, m.Version)))
+	h.Write(fmt.Appendf(nil, "%s %s/go.mod", m.Module, m.Version))
 	modKey := h.Sum(nil)
 	modLeafID := node.NewID(string(modKey), uint(len(modKey)*8))
 
@@ -123,7 +123,7 @@ func (fn *mapEntryFn) ProcessElement(m Metadata, emit func(*batchmap.Entry)) {
 	})
 
 	h = hash.New()
-	h.Write([]byte(fmt.Sprintf("%s %s", m.Module, m.Version)))
+	h.Write(fmt.Appendf(nil, "%s %s", m.Module, m.Version))
 	repoKey := h.Sum(nil)
 	repoLeafID := node.NewID(string(repoKey), uint(len(repoKey)*8))
 

integration/Dockerfile

@@ -10,7 +10,6 @@ RUN echo "deb http://deb.debian.org/debian bookworm-backports main contrib non-f
 RUN apt-get update && apt-get -y install curl docker-compose lsof netcat-traditional unzip wget xxd
 
 RUN cd /usr/bin && curl -L -O https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 && mv jq-linux64 /usr/bin/jq && chmod +x /usr/bin/jq
-RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.64.6
 RUN mkdir protoc && \
     (cd protoc && \
     wget "https://github.com/google/protobuf/releases/download/v3.5.1/protoc-3.5.1-linux-x86_64.zip" && \

scripts/presubmit.sh

@@ -127,11 +127,6 @@ main() {
   fi
 
   if [[ "${run_lint}" -eq 1 ]]; then
-    check_cmd golangci-lint \
-      'have you installed github.com/golangci/golangci-lint?' || exit 1
-
-    echo 'running golangci-lint'
-    golangci-lint run --timeout=10m
     echo 'checking license headers'
     ./scripts/check_license.sh ${go_srcs}
   fi