basecamp-cli/.golangci.yml at main · basecamp/basecamp-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
# golangci-lint v2 configuration
version: "2"

run:
  timeout: 5m
  modules-download-mode: readonly

formatters:
  enable:
    - gofmt
    - goimports
  settings:
    goimports:
      local-prefixes:
        - github.com/basecamp/basecamp-cli

linters:
  enable:
    # Default linters (gosimple is merged into staticcheck in v2)
    - errcheck
    - govet
    - ineffassign
    - staticcheck
    - unused

    # HTTP/Context linters
    - bodyclose      # Checks whether HTTP response body is closed
    - noctx          # Find HTTP requests without context.Context

    # Error handling linters
    - errorlint      # Find code that will cause problems with error wrapping
    - nilerr         # Find code that returns nil even if it checks error is not nil

    # Code quality linters
    - misspell       # Check for misspelled English words
    - prealloc       # Find slice declarations that could use preallocation
    - unconvert      # Remove unnecessary type conversions
    - unparam        # Report unused function parameters
    - wastedassign   # Find wasted assignment statements

    # Security linter
    - gosec          # Security checker

    # Context and duration linters
    - contextcheck   # Check function context parameter usage
    - durationcheck  # Check for two durations multiplied together

    # Naming and completeness linters
    - errname        # Check error type naming conventions
    - exhaustive     # Check exhaustiveness of enum switch statements
    - predeclared    # Find shadowing of Go's predeclared identifiers
    - revive         # Extensible linting framework

  settings:
    errcheck:
      check-type-assertions: true
      check-blank: false  # Don't check explicitly ignored errors with _
      exclude-functions:
        - (io.Closer).Close
        - (*os.File).Close
        - (net/http.ResponseWriter).Write
        - (*bytes.Buffer).Write
        - (*bytes.Buffer).WriteString
        - (*strings.Builder).Write
        - (*strings.Builder).WriteString
        - io.ReadAll
        - (*net/http.Server).Serve
        - (github.com/zalando/go-keyring).Delete
        - (*github.com/spf13/pflag.FlagSet).MarkHidden
        - (*github.com/spf13/cobra.Command).MarkFlagRequired
        - (*github.com/spf13/cobra.Command).RegisterFlagCompletionFunc
        - (*github.com/spf13/pflag.FlagSet).GetBool
        - fmt.Sscanf

    govet:
      enable-all: true
      disable:
        - fieldalignment  # Too noisy for minimal gains
        - shadow          # Too noisy - variable shadowing is common in Go

    errorlint:
      asserts: false
      comparison: false

    gosec:
      excludes:
        - G104  # Unhandled errors (covered by errcheck)
        - G304  # File path provided as taint input (common in CLI tools)

    misspell:
      locale: US

    staticcheck:
      checks:
        - all
        - -SA1019  # Ignore deprecation warnings (handle separately)

    revive:
      rules:
        - name: blank-imports
        - name: context-as-argument
        - name: context-keys-type
        - name: dot-imports
        - name: error-return
        - name: error-strings
        - name: error-naming
        - name: increment-decrement
        - name: indent-error-flow
        - name: range
        - name: receiver-naming
        - name: time-naming
        - name: unexported-return
        - name: var-declaration

    exhaustive:
      default-signifies-exhaustive: true

  exclusions:
    presets:
      - comments
      - std-error-handling
    rules:
      # Test files have relaxed rules
      - path: _test\.go
        linters:
          - gosec
          - bodyclose
          - errcheck
          - unparam
      - path: _test\.go
        linters:
          - revive
        text: "dot-imports"
      # Newer gosec rules (G117/G703/G704) that appear with updated analyzers.
      # These are false positives for a CLI tool: field names match secret
      # patterns, paths derive from XDG/HOME, and HTTP targets are known APIs.
      - text: "G117:|G703:|G704:"
        linters:
          - gosec

issues:
  max-issues-per-linter: 0
  max-same-issues: 0