graith/.golangci.yml at main · d0ugal/graith · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
version: "2"

run:
  timeout: 5m
  go: "1.26.4"
  # Compile and lint build-tagged files too (e.g. the //go:build integration
  # test suite). Without this, golangci-lint skips them entirely and lint drift
  # in the integration tests goes unnoticed in CI. The libghostty tag is covered
  # by Makefile's focused lint-libghostty target so the default !libghostty
  # fail-closed files keep their normal lint coverage.
  build-tags:
    - integration

linters:
  # Use fast linters for better performance
  default: fast
  enable:
    - contextcheck
    - dupl
    - errcheck
    - gosec
    - govet
    - staticcheck
    - ineffassign
    - unused
    - wsl_v5
    # Bug-finding linters (see .golangci.yml history / PR enabling these).
    - sqlclosecheck  # SQL rows/stmts must be closed
    - rowserrcheck  # rows.Err() must be checked after iteration
    - errorlint  # %w wrapping + errors.As; comparison check off (see settings)
    - errchkjson  # unchecked json.Marshal on unsafe types
    - recvcheck  # consistent pointer/value receivers
    - unconvert  # no unnecessary type conversions
    - wastedassign  # no wasted assignments
    # Zero-finding regression guards.
    - durationcheck  # catch time.Duration multiplication mistakes
    - nilnesserr  # nil error returned alongside non-nil err check
    - makezero  # slice make with non-zero len then append
    - fatcontext  # context stored in a loop / struct
    - perfsprint  # prefer faster alternatives to fmt.Sprintf
    - spancheck  # OTel/opencensus spans must be ended
    - gomodguard_v2  # direct go.mod dependency allow/block list checks

  disable:
    # The pinned golangci-lint v2.12.x image exposes both gomodguard_v2 and the
    # deprecated gomodguard alias under the fast set; keep only the v2 linter.
    - gomodguard
    # Failing under the shared config on this repo; temporarily disabled so the
    # standardized config can land now. Each will be fixed and re-enabled in a
    # dedicated follow-up PR.
    - cyclop  # Too strict
    - depguard  # Allow internal imports
    - err113  # Allow dynamic errors
    - exhaustruct  # Too strict for tests
    - forcetypeassert  # Allow in tests
    - funcorder  # Not critical
    - funlen  # Allow longer functions
    - gocognit  # Too strict
    - goconst  # Not critical
    - godot  # Not critical
    - intrange  # Go 1.22+ feature
    - lll  # Line length not critical
    - mnd  # Magic numbers acceptable
    - nestif  # Allow nested if
    - nlreturn  # Not critical
    - noinlineerr  # Allow inline errors
    - paralleltest  # Not critical
    - revive  # Too many false positives
    - tagliatelle  # YAML tags fine
    - testpackage  # Allow test packages
    - usetesting  # Not critical
    - varnamelen  # Variable names fine
    - wsl  # Use wsl_v5 instead
    - gocyclo  # Allow complex functions
    - maintidx  # Allow complex functions

  settings:
    dupl:
      # Flag token sequences duplicated across ≥100 tokens, in both production
      # and test code.
      threshold: 100
    errorlint:
      # The framed protocol reader (internal/protocol) returns a *bare* io.EOF at
      # a clean frame boundary but a *wrapped* EOF on a truncated read, and the
      # read loops deliberately compare `err == io.EOF` to tell a clean close
      # apart from a truncated frame (see internal/cli/check_inbox.go and its
      # regression test). errorlint's comparison check flags that intentional
      # bare-EOF idiom, so it's disabled. The high-value checks stay on: errorf
      # (%w wrapping) and asserts (errors.As over a type assertion).
      comparison: false
      errorf: true
      asserts: true
    gosec:
      # Allow some security warnings
      excludes:
        - G204  # Subprocess launched with variable - inputs are validated and sanitized
        - G304  # Potential file inclusion via variable - path is validated and comes from trusted config

formatters:
  enable:
    - gci
    - gofmt