moat/.golangci.yml at main · majorcontext/moat · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
# golangci-lint configuration
# Opinionated defaults focused on catching real bugs

version: "2"

run:
  timeout: 5m
  modules-download-mode: readonly

linters:
  default: none
  enable:
    # Essential - catch real bugs
    - errcheck      # Unchecked errors are bugs waiting to happen
    - govet         # Official Go vet checks
    - staticcheck   # High-quality static analysis (includes SA* checks)
    - gosec         # Security-focused checks
    - ineffassign   # Detects unused assignments

    # Code quality
    - revive        # Fast, configurable linter (replaces golint)
    - misspell      # Catches typos in comments/strings
    - unconvert     # Unnecessary type conversions
    - unparam       # Unused function parameters
    - unused        # Unused code detection
    - bodyclose     # HTTP response body must be closed
    - prealloc      # Slice preallocation for performance

  settings:
    errcheck:
      check-type-assertions: true
      check-blank: false
      exclude-functions:
        - fmt.Print
        - fmt.Println
        - fmt.Printf
        - fmt.Fprint
        - fmt.Fprintln
        - fmt.Fprintf

    govet:
      enable-all: true
      disable:
        - fieldalignment  # Too noisy for minimal benefit

    staticcheck:
      checks:
        - all
        - -ST1005   # We allow capitalized/punctuated error strings for user-facing messages
        - -QF1001   # De Morgan's law rewrites reduce readability
        - -QF1003   # if/else vs switch is a style preference
        - -QF1011   # Explicit type declarations can aid readability
        - -QF1012   # WriteString(Sprintf()) vs Fprintf() is a style preference

    gosec:
      excludes:
        - G104  # Audit errors not checked (overlaps with errcheck)
        - G204  # Subprocess with variable args (safe: binary from LookPath, args are internal)
        - G304  # File path from variable (we do this intentionally for workspaces)
        - G306  # WriteFile permissions >0600 (acceptable for non-sensitive data)
        - G505  # sha1 import (used for X.509 subject key IDs per RFC 5280)
        - G401  # sha1 usage (used for X.509 subject key IDs per RFC 5280)
        - G101  # Hardcoded credentials (false positive on URL constants)
        - G602  # Slice bounds out of range (false positives on Read() buffers)

    revive:
      rules:
        - name: blank-imports
        - name: context-as-argument
        - name: context-keys-type
        - name: dot-imports
        - name: error-return
        - name: error-strings
          disabled: true  # Allow multi-line helpful error messages
        - name: error-naming
        - name: exported
        - name: if-return
        - name: increment-decrement
        - name: var-naming
        - name: var-declaration
        - name: package-comments
          disabled: true  # We don't require package comments
        - name: range
        - name: receiver-naming
        - name: time-naming
        - name: unexported-return
        - name: indent-error-flow
        - name: errorf
        - name: empty-block
        - name: superfluous-else
        - name: unreachable-code

    misspell:
      locale: US

    unparam:
      check-exported: false  # Only check unexported functions

  exclusions:
    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:
      # Test files are more permissive
      - path: _test\.go
        linters:
          - errcheck  # Unchecked errors OK in tests
          - unparam   # Unused parameters OK in tests
          - govet     # Shadow warnings OK in tests

      # Allow dot imports in test files (for testify, etc.)
      - path: _test\.go
        linters:
          - revive
        text: "dot-imports"

      # E2E tests can have longer functions
      - path: e2e/
        linters:
          - revive
        text: "function-length"

      # Allow util package name for internal provider utilities
      - path: internal/provider/util/
        linters:
          - revive
        text: "var-naming: avoid meaningless package names"

    paths:
      - vendor

issues:
  max-issues-per-linter: 0
  max-same-issues: 0

formatters:
  enable:
    - gofmt         # Formatting (canonical)
    - goimports     # Import organization
  exclusions:
    generated: lax
    paths:
      - vendor