.golangci.yml

version: "2"

run:
  tests: true
  modules-download-mode: readonly

linters:
  settings:
    cyclop:
      # Dispatchers and validation-heavy supply-chain code need some branching,
      # but values above this point should be split into auditable stages.
      max-complexity: 40
      package-average: 0.0
    gocyclo:
      # The second metric catches boolean-heavy validators that cyclop weighs
      # differently. Report functions above the shared complexity budget.
      min-complexity: 41
    gosec:
      excludes:
        # Executing reviewed command arrays and reading operator-selected,
        # digest-bound paths are core engine behavior. G703 remains enabled for
        # taint-aware traversal, while secret/public file modes are validated at
        # their domain boundaries rather than by blanket 0600/0750 rules.
        - G204
        - G301
        - G302
        - G304
        - G306
    revive:
      rules:
        # Public HTTP/JSON contracts use concise domain names; requiring a
        # doc comment on every exported DTO adds noise without improving the
        # package-level operational documentation.
        - name: exported
          disabled: true
  enable:
    - errcheck
    - govet
    - ineffassign
    - staticcheck
    - unused
    - misspell
    - revive
    - unconvert
    - unparam
    - gocritic
    - prealloc
    - bodyclose
    - cyclop
    - errorlint
    - exhaustive
    - gosec
    - gocyclo
  exclusions:
    rules:
      # Tests deliberately construct invalid paths, credentials, and large
      # branch matrices; production packages remain fully gated.
      - linters:
          - cyclop
          - gocyclo
          - gosec
        path: '(^|/)(tests/.*|.*_test\.go)$'
      # Operator-facing errors intentionally start with proper protocol,
      # product, environment-variable, and milestone names (PVE, GPG,
      # BINPKG_PATH, IMG-2, and similar).
      - linters:
          - staticcheck
        text: "ST1005"