Add golangci-lint Github Action formatter and lint checks #140
Conversation
Add the action and set up an initial configuration that passes on the codebase at this point in time.
.github/workflows/golangci-lint.yml
Outdated
| name: lint | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
These should always be pinned to a hash to avoid compromised deps.
https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash
There was a problem hiding this comment.
Good catch. I filed #142 which, AFAIU, includes a check for this.
There was a problem hiding this comment.
Came from https://github.com/marketplace/actions/golangci-lint#how-to-use the Simple Example
There was a problem hiding this comment.
Do you know where to find the hash to use?
https://github.com/actions/checkout/releases If i click on 4.2.2 the current latest release, I see
actions/checkout@11bd719 which I am guessing is the hash I want to use.
There was a problem hiding this comment.
actions/checkout@11bd719 seems right to me. It's the last commit here:
actions/checkout@v4.2.1...v4.2.2
jmr
changed the title
Invalid Go toolchain version (1 result)
* go.mod#L0C0:0: As of Go 1.21, toolchain versions [must use the 1.N.P syntax](https://go.dev/doc/toolchain#version).
`1.21` in `go.mod` does not match this syntax and there is no additional `toolchain` directive, which may cause some `go` commands to fail.
(with comments on what the hash is representing
I couldn't find a better resource than https://github.com/dependabot/dependabot-core/blob/main/github_actions/spec/fixtures/workflow_files/pinned_sources_version_comments.yml to document what formats work.
|
The push failed because I wasn't sycned up. Now, for really real it is pushed. |
| - master | ||
| pull_request: | ||
|
|
||
| permissions: |
There was a problem hiding this comment.
| settings: | ||
| gofmt: | ||
| # Simplify code: gofmt with `-s` option. | ||
| # Default: true |
There was a problem hiding this comment.
Why not simplify if that's the default?
This adds a basic configuration that has gofmt and some basic lints enabled.
staticcheck is currently turned off because there are a number of outstanding code elements it flagged in the existing code that need to be fixed up before it should be turned on.