.golangci.yml

version: "2"

output:
  formats:
    text:
      path: stderr

linters:
  default: all
  disable:
    # These are linters we'd like to enable, but that will be labor intensive to
    # make existing code compliant.
    - wrapcheck
    - varnamelen
    - testpackage
    - paralleltest
    - nilnil
    - funcorder

    # Below are linters that lint for things we don't value. Each entry below
    # this line must have a comment explaining the rationale.

    # These linters add whitespace in an attempt to make code more readable.
    # This isn't a widely accepted Go best practice, and would be laborious to
    # apply to existing code.
    - wsl
    - wsl_v5
    - nlreturn

    # Warns about uses of fmt.Sprintf that are less performant than alternatives
    # such as string concatenation. We value readability more than performance
    # unless performance is measured to be an issue.
    - perfsprint

    # This linter:
    #
    # 1. Requires errors.Is/errors.As to test equality.
    # 2. Requires all errors be wrapped with fmt.Errorf specifically.
    # 3. Disallows errors.New inline - requires package level errors.
    #
    # 1 is covered by other linters. 2 is covered by wrapcheck, which can also
    # handle our use of crossplane-runtime's errors package. 3 is more strict
    # than we need. Not every error needs to be tested for equality.
    - err113

    # These linters duplicate gocognit, but calculate complexity differently.
    - gocyclo
    - cyclop
    - nestif
    - funlen
    - maintidx

    # Enforces max line length. It's not idiomatic to enforce a strict limit on
    # line length in Go. We'd prefer to lint for things that often cause long
    # lines, like functions with too many parameters or long parameter names
    # that duplicate their types.
    - lll

    # Warns about struct instantiations that don't specify every field. Could be
    # useful in theory to catch fields that are accidentally omitted. Seems like
    # it would have many more false positives than useful catches, though.
    - exhaustruct

    # Warns about TODO comments. The rationale being they should be issues
    # instead. We're okay with using TODO to track minor cleanups for next time
    # we touch a particular file.
    - godox

    # Warns about duplicated code blocks within the same file. Could be useful
    # to prompt folks to think about whether code should be broken out into a
    # function, but generally we're less worried about DRY and fine with a
    # little copying. We don't want to give folks the impression that we require
    # every duplicated code block to be factored out into a function.
    - dupl

    # Warns about returning interfaces rather than concrete types. We do think
    # it's best to avoid returning interfaces where possible. However, at the
    # time of writing enabling this linter would only catch the (many) cases
    # where we must return an interface.
    - ireturn

    # Warns about returning named variables. We do think it's best to avoid
    # returning named variables where possible. However, at the time of writing
    # enabling this linter would only catch the (many) cases where returning
    # named variables is useful to document what the variables are. For example
    # we believe it makes sense to return (ready bool) rather than just (bool)
    # to communicate what the bool means.
    - nonamedreturns

    # Warns about using magic numbers. We do think it's best to avoid magic
    # numbers, but we should not be strict about it.
    - mnd

    # Warns about if err := Foo(); err != nil style error checks. Seems to go
    # against idiomatic Go programming, which encourages this approach - e.g.
    # to scope errors.
    - noinlineerr
  settings:
    depguard:
      rules:
        no_third_party_test_libraries:
          list-mode: lax
          files:
            - $test
          deny:
            - pkg: github.com/stretchr/testify
              desc: See https://go.dev/wiki/TestComments#assert-libraries
            - pkg: github.com/onsi/ginkgo
              desc: See https://go.dev/wiki/TestComments#assert-libraries
            - pkg: github.com/onsi/gomega
              desc: See https://go.dev/wiki/TestComments#assert-libraries
    dupl:
      threshold: 100
    errcheck:
      check-type-assertions: false
      check-blank: false
    goconst:
      min-len: 3
      min-occurrences: 5
    gocritic:
      enabled-tags:
        - performance
      settings:
        captLocal:
          paramsOnly: true
        rangeValCopy:
          sizeThreshold: 32
    gomoddirectives:
      # Allow replace for the local ./apis module.
      replace-local: true
    govet:
      disable:
        - shadow
    interfacebloat:
      max: 5
    lll:
      tab-width: 1
    nakedret:
      max-func-lines: 30
    nolintlint:
      require-explanation: true
      require-specific: true
    prealloc:
      simple: true
      range-loops: true
      for-loops: false
    tagliatelle:
      case:
        rules:
          json: goCamel
    unparam:
      check-exported: false
    unused:
      exported-fields-are-used: true
  exclusions:
    generated: lax
    rules:
      - linters:
          - containedctx
          - errcheck
          - forcetypeassert
          - gochecknoglobals
          - gochecknoinits
          - gocognit
          - gosec
          - noctx
          - scopelint
          - unparam
          - embeddedstructfieldcheck
        path: _test(ing)?\.go

      - linters:
          - gocritic
        path: _test\.go
        text: (unnamedResult|exitAfterDefer)

      # It's idiomatic to register Kubernetes types with a package scoped
      # SchemeBuilder using an init function.
      - linters:
          - gochecknoglobals
          - gochecknoinits
        path: apis/

      # The omitzero check warns that omitempty has no effect on struct fields
      # in Go's encoding/json, which is true. However, kubebuilder uses
      # omitempty to determine whether fields are optional in CRD schemas.
      # Removing omitempty would incorrectly mark fields like status as required.
      - linters:
          - modernize
        text: 'omitzero:'

      # These are performance optimisations rather than style issues per se.
      # They warn when function arguments or range values copy a lot of memory
      # rather than using a pointer.
      - linters:
          - gocritic
        text: '(hugeParam|rangeValCopy):'

      # This "TestMain should call os.Exit to set exit code" warning is not clever
      # enough to notice that we call a helper method that calls os.Exit.
      - linters:
          - staticcheck
        text: 'SA3000:'

      # This is a "potential hardcoded credentials" warning. It's triggered by
      # any variable with 'secret' in the same, and thus hits a lot of false
      # positives in Kubernetes land where a Secret is an object type.
      - linters:
          - gosec
        text: 'G101:'

      # This is an 'errors unhandled' warning that duplicates errcheck.
      - linters:
          - gosec
        text: 'G104:'

      # This is about implicit memory aliasing in a range loop.
      # This is a false positive with Go v1.22 and above.
      - linters:
          - gosec
        text: 'G601:'

      # Some k8s dependencies do not have JSON tags on all fields in structs.
      - linters:
          - musttag
        path: k8s.io/

      # Various fields related to native patch and transform Composition are
      # deprecated, but we can't drop support from Crossplane 1.x. We ignore the
      # warnings globally instead of suppressing them with comments everywhere.
      - linters:
          - staticcheck
        text: 'SA1019: .+ is deprecated: Use Composition Functions instead.'

      # Various fields related to package dependencies are deprecated in favor
      # of specifying apiVersion and kind explicitly. External package authors
      # should use the new format, but Crossplane must support the old format
      # for backward compatibility.
      - linters:
          - staticcheck
        text: 'SA1019: .+ is deprecated: Specify an apiVersion'

      # controller-runtime has marked the events API we use as deprecated, and
      # it will be a big lift to move to the new API. We'll ignore the warnings
      # about this globally until we have time to introduce the new API
      # everywhere.
      - linters:
          - staticcheck
        text: 'SA1019: .+ is deprecated: this uses the old events API and will be removed in a future release. Please use GetEventRecorder instead.'

      # We include a 'common' package under crank, which revive doesn't like.
      - linters:
          - revive
        path: 'cmd/crank/common/*'
        text: 'var-naming: avoid meaningless package names'

    paths:
      - zz_generated\..+\.go$
      - .+\.pb.go$
      - third_party$
      - builtin$
      - examples$

issues:
  max-issues-per-linter: 0
  max-same-issues: 0
  new: false

formatters:
  enable:
    - gci
    - gofmt
    - gofumpt
    - goimports
  settings:
    gci:
      sections:
        - standard
        - default
        - prefix(github.com/crossplane/crossplane-runtime)
        - prefix(github.com/crossplane/crossplane)
        - blank
        - dot
      custom-order: true
    gofmt:
      simplify: true
  exclusions:
    generated: lax
    paths:
      - zz_generated\..+\.go$
      - .+\.pb.go$
      - third_party$
      - builtin$
      - examples$