Bump golangci-lint to v2.12.2 and quiet new findings

Author: mboersma

.custom-gcl.yml

@@ -1,4 +1,4 @@
-version: v2.7.0
+version: v2.12.2
 name: golangci-lint-kube-api-linter
 destination: ./hack/tools/bin
 plugins:

.github/workflows/pr-golangci-lint.yaml

@@ -34,7 +34,7 @@ jobs:
         if: matrix.working-directory == ''
         run: |
           make golangci-lint
-          hack/tools/bin/golangci-lint-v2.7.0 custom
+          hack/tools/bin/golangci-lint-v2.12.2 custom
 
       - name: golangci-lint (root with kube-api-linter)
         if: matrix.working-directory == ''
@@ -45,5 +45,5 @@ jobs:
         uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # tag=v9.2.1
         with:
           # update the version when updating golangci-lint
-          version: v2.7.0
+          version: v2.12.2
           working-directory: ${{matrix.working-directory}}

.golangci.yml

@@ -51,6 +51,10 @@ linters:
     - usetesting # reports uses of functions with replacement inside the testing package
     - whitespace # unnecessary newlines
   settings:
+    goconst:
+      # goconst now counts occurrences package-wide. Ignore common strings that
+      # are intentionally not constants to avoid noise from this newer behavior.
+      ignore-string-values: '^(1\.0|true|1\.28\.12|cncf-upstream|containerd|Cluster|vmss|azure\.json|AzureManagedMachinePool|MachinePool|test-cluster|custom-vnet|my-vnet|spec|name)$'
     exhaustruct:
       include:
         # Hub ASO agent pools should be fully defined to prevent unnecessary updates
@@ -260,6 +264,30 @@ linters:
       - linters:
           - staticcheck
         text: 'QF1008: could remove embedded field'
+      - linters:
+          - staticcheck
+        text: 'QF1012:'
+      # The govet "inline" analyzer only emits informational notes; ignore them.
+      - linters:
+          - govet
+        text: 'cannot inline'
+      # gosec credential/taint rules: false positives in test fixtures.
+      - linters:
+          - gosec
+        path: _test\.go
+        text: '(G101|G705):'
+      - linters:
+          - gosec
+        path: ^test/
+        text: 'G703:'
+      - linters:
+          - gosec
+        path: ^test/e2e/
+        text: 'G204:'
+      # images.go is a version-to-image data map; goconst noise on map values.
+      - linters:
+          - goconst
+        path: azure/services/virtualmachineimages/images\.go$
       # We don't care about defer in for loops in test files.
       - linters:
           - gocritic

azure/scope/identity_test.go

@@ -440,7 +440,7 @@ func TestGetTokenCredential(t *testing.T) {
 			},
 			cacheExpect: func(cache *mock_azure.MockCredentialCache) {
 				ctx := context.Background()
-				credsPath := "../../test/setup/credentials.json" //nolint:gosec
+				credsPath := "../../test/setup/credentials.json"
 				clientOptions := azcore.ClientOptions{
 					Cloud: cloud.Configuration{
 						ActiveDirectoryAuthorityHost: "https://login.microsoftonline.com/",

controllers/helpers_test.go

@@ -532,7 +532,6 @@ const (
     "useInstanceMetadata": true,
     "enableVmssFlexNodes": true
 }`
-	//nolint:gosec // Ignore "G101: Potential hardcoded credentials" check.
 	spWorkerNodeCloudConfig = `{
     "cloud": "AzurePublicCloud",
     "tenantId": "fooTenant",

internal/webhooks/azuremachine_validation.go

@@ -83,11 +83,11 @@ func validateAzureMachineSpec(spec infrav1.AzureMachineSpec) field.ErrorList {
 
 // ValidateNetwork validates the network configuration.
 func ValidateNetwork(subnetName string, acceleratedNetworking *bool, networkInterfaces []infrav1.NetworkInterface, fldPath *field.Path) field.ErrorList {
-	if (networkInterfaces != nil) && len(networkInterfaces) > 0 && subnetName != "" {
+	if len(networkInterfaces) > 0 && subnetName != "" {
 		return field.ErrorList{field.Invalid(fldPath, networkInterfaces, "cannot set both networkInterfaces and machine subnetName")}
 	}
 
-	if (networkInterfaces != nil) && len(networkInterfaces) > 0 && acceleratedNetworking != nil {
+	if len(networkInterfaces) > 0 && acceleratedNetworking != nil {
 		return field.ErrorList{field.Invalid(fldPath, networkInterfaces, "cannot set both networkInterfaces and machine acceleratedNetworking")}
 	}
 

pkg/ot/traces.go

@@ -42,7 +42,7 @@ func RegisterTracing(ctx context.Context, log logr.Logger) error {
 	otel.SetTracerProvider(tp)
 
 	// Give the tracer provider 5 seconds to shut down when the context closes.
-	go func() {
+	go func() { //nolint:gosec // G118: a fresh context is created below because the request context is already cancelled here.
 		<-ctx.Done()
 		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 		defer cancel()

test/.golangci.yml

@@ -261,6 +261,17 @@ linters:
       - linters:
           - staticcheck
         text: 'QF1008: could remove embedded field'
+      - linters:
+          - staticcheck
+        text: 'QF1012:'
+      # The govet "inline" analyzer only emits informational notes; ignore them.
+      - linters:
+          - govet
+        text: 'cannot inline'
+      # gosec taint rules: false positives in test code.
+      - linters:
+          - gosec
+        text: '(G204|G703):'
     paths:
       - zz_generated\.(\w*)\.go$
       - third_party$

test/e2e/azure_kuberay.go

@@ -262,7 +262,7 @@ func InstallHelmChart(ctx context.Context, clusterProxy framework.ClusterProxy,
 		"--timeout", "5m0s",
 	}
 	helmArgs = append(helmArgs, extraArgs...)
-	installCmd := exec.CommandContext(ctx, "helm", helmArgs...) //nolint:gosec
+	installCmd := exec.CommandContext(ctx, "helm", helmArgs...)
 	installCmd.Env = append(installCmd.Environ(), fmt.Sprintf("KUBECONFIG=%s", kubeconfigPath))
 	output, err = installCmd.CombinedOutput()
 	Logf("helm install output: %s", string(output))