qubes-air/.golangci.yml at main · slchris/qubes-air · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
version: "2"
run:
  go: "1.25"
  tests: true
linters:
  enable:
    - bodyclose
    - dogsled
    - dupl
    - funlen
    - gochecknoinits
    - goconst
    - gocritic
    - gocyclo
    - goprintffuncname
    - gosec
    - misspell
    - nakedret
    - noctx
    - nolintlint
    - prealloc
    - revive
    - staticcheck
    - unconvert
    - unparam
    - whitespace
  settings:
    errcheck:
      check-type-assertions: true
      # check-blank stays off. `_ = f()` is how Go says "I looked at this error
      # and chose to drop it" — flagging it leaves no way to express a reviewed
      # decision, so the only escape is a //nolint comment, which is strictly
      # worse: it silences the linter without recording the reasoning. The
      # unchecked returns this flagged were all deliberate (job-store updates on
      # a path that is already failing, a query param that falls back to 0).
      check-blank: false
    funlen:
      lines: 100
      statements: 50
    goconst:
      # min-len 3 / min-occurrences 3 flagged 27 sites, and every one was a JSON
      # response key — "error" (26×), "total", "note", "version". Those literals
      # ARE the wire format; hoisting them to constants hides the contract the
      # handler implements behind an indirection. Longer and rarer strings are
      # where a stray copy is a real bug, so that is what this now looks for.
      min-len: 6
      min-occurrences: 5
      # Regexes, and this must be a list — a bare string passes `run` with only
      # a deprecation warning but fails `config verify`, which is what the
      # GitHub action executes before linting.
      ignore-string-values:
        - '^(error|total|note|version|status|message|count|provider|offset|running)$'
    gocyclo:
      min-complexity: 15
    gosec:
      excludes:
        - G104
      config:
        G306: "0644"
    # govet runs its default set. `shadow` is deliberately NOT enabled: it is
    # experimental upstream and off by default, and all 23 hits here were the
    # idiomatic `if err := f(); err != nil` inside a function that already has an
    # err. That is the pattern Go recommends, not a bug.
    govet: {}
    misspell:
      locale: US
    revive:
      rules:
        - name: exported
          severity: warning
        - name: var-naming
          severity: warning
  exclusions:
    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:
      - linters:
          - dupl
          - errcheck
          - funlen
          - goconst
          - gocritic
          - noctx
          # gosec judges production risk. A fixture written 0666 into t.TempDir()
          # is not an exposure — the directory is per-test and removed after.
          - gosec
          # A helper whose every caller passes the same name is how a readable
          # test reads; unparam calling that a dead parameter is not useful here.
          - unparam
          # A table-driven test is one long function by design, and branchy
          # setup is what makes it cover the cases it claims to.
          - gocyclo
        path: _test\.go
      - linters:
          - gochecknoinits
        path: main\.go
    paths:
      - vendor
      - bin
      - third_party$
      - builtin$
      - examples$
issues:
  max-issues-per-linter: 50
  max-same-issues: 10
formatters:
  enable:
    - gofmt
    - goimports
  exclusions:
    generated: lax
    paths:
      - vendor
      - bin
      - third_party$
      - builtin$
      - examples$