.golangci.yml RawHistoryFolder

1version: "2"
2
3run:
4  timeout: 5m
5  tests: true
6
7linters:
8  enable:
9    - govet
10    - errcheck
11    - staticcheck
12    - unused
13    - ineffassign
14    - misspell
15    - gosec
16    - unconvert
17    - gocyclo
18  settings:
19    gocyclo:
20      min-complexity: 15
21  exclusions:
22    rules:
23      - path: _test\.go
24        linters:
25          - gocyclo
26          - errcheck
27          - dupl
28          - gosec
29      - text: "Error return value of `.*Close` is not checked"
30        linters:
31          - errcheck
32      - text: "Error return value of `.*Write` is not checked"
33        linters:
34          - errcheck
35      - text: "Error return value of `os.Remove.*` is not checked"
36        linters:
37          - errcheck
38      - text: "Error return value of `.*Publish` is not checked"
39        linters:
40          - errcheck
41      - text: "Error return value of `.*Stop` is not checked"
42        linters:
43          - errcheck
44      - text: "Error return value of `.*RemoveContainer` is not checked"
45        linters:
46          - errcheck
47      - text: "Error return value of `log.WrapErr` is not checked"
48        linters:
49          - errcheck
50      - text: "Error return value of `log.WrapErrWithFields` is not checked"
51        linters:
52          - errcheck
53      # gosec: file operations with variables are intentional in storage layer
54      - text: "G304:"
55        linters:
56          - gosec
57      # gosec: G104 duplicates errcheck
58      - text: "G104:"
59        linters:
60          - gosec
61      # gosec G117: exported struct fields matching secret-name patterns are intentional DTOs
62      # (OCI registry tokens, CLI credential request bodies, telemetry config, JWT response frames).
63      # These fields must be exported and carry credentials by design — they are not accidental leaks.
64      - text: "G117:"
65        linters:
66          - gosec
67      # gosec G703/G704/G705: taint-analysis false positives for a CLI tool and reverse proxy.
68      # G704 (SSRF): target URLs come from operator-configured routing tables or explicit CLI flags,
69      # not from untrusted user input. G703 (path traversal): XDG_RUNTIME_DIR is a trusted env var
70      # set by the login session, not user-supplied. G705 (XSS): registry manifest data is binary
71      # OCI content served with an explicit Content-Type, not rendered as HTML.
72      - text: "G703:"
73        linters:
74          - gosec
75      - text: "G704:"
76        linters:
77          - gosec
78      - text: "G705:"
79        linters:
80          - gosec
81
82formatters:
83  enable:
84    - gofmt
85
86issues:
87  max-same-issues: 50
88
89severity:
90  default: error