.golangci.yml

version: "2"

# Options for analysis running.
run:
  # If set we pass it to "go list -mod={option}". From "go help modules":
  # If invoked with -mod=readonly, the go command is disallowed from the implicit
  # automatic updating of go.mod described above. Instead, it fails when any changes
  # to go.mod are needed. This setting is most useful to check that go.mod does
  # not need updates, such as in a continuous integration and testing system.
  # If invoked with -mod=vendor, the go command assumes that the vendor
  # directory holds the correct copies of dependencies and ignores
  # the dependency descriptions in go.mod.
  #
  # Allowed values: readonly|vendor|mod
  # By default, it isn't set.
  modules-download-mode: readonly
  tests: true
  # Allow multiple parallel golangci-lint instances running.
  # If false (default) - golangci-lint acquires file lock on start.
  allow-parallel-runners: false

output:
  formats:
    text:
      path: stdout
    checkstyle:
      path: golangci-lint-report.json

# This configures the release linters at tyk.
#
# The guideline is simple: keep linters you want to track in release
# code. This includes any quality gates or refactors that apply to
# testing code, including updating practices with new Go releases.

# Tag linters with: testing, dev, or message with reason.
linters:
  enable:
    - forbidigo # debt: measure API leaks / dev: extend the list
    - govet # debt: don't want these defects in product
    - gochecknoinits # same, but exclusions apply for tests
    - errcheck # debt: measure checking errors
    - errorlint # debt: measure error handling improvements
    - nilerr # debt: measure code that returns nil on non-nil error
    - revive # keep - measured for stats, shows code smells
    - gomodguard # keep - for dependency management/enforcement
  disable:
    - varnamelen # disabled, opinionated on anarchy with variable names
    - tagliatelle # disabled, no naming double checks
    - testpackage # testing/dev (structural lint, unconfigured!)
    - paralleltest # testing
    - thelper # testing
    - ireturn # dev
    - misspell # dev
    - noctx # dev
    - unused # dev
    - dupl # dev
  settings:
    errcheck:
      check-type-assertions: true
      check-blank: true
      exclude-functions:
        - (*github.com/TykTechnologies/tyk/gateway.Test).Run
        - time.Parse
        - strconv.ParseBool
        - strconv.ParseInt
    forbidigo:
      forbid:
        - pattern: ^fmt\.Print.*$
          msg: Do not commit print statements, use t.Log or Logrus.
        - pattern: ^net\/http\.(Get|Head|Post|Form).*$
          msg: Do not use top level http package functions, NewRequestWithContext is encouraged.
      exclude-godoc-examples: false
      analyze-types: true
    # https://golangci-lint.run/usage/linters/#gomodguard
    gomodguard:
      blocked:
        modules:
          - github.com/xeipuuv/gojsonschema:
              recommendations:
                - github.com/TykTechnologies/internal/service/gojsonschema
              reason: import pollution, unmaintained package
    # https://golangci-lint.run/usage/linters/#gomoddirectives
    gomoddirectives:
      # replaces are undesired due to CGO/plugins
      replace-local: true
    govet:
      disable:
        - fieldalignment
        - shadow
      enable-all: true
    revive:
      severity: error
      enable-all-rules: false
      rules:
        - name: unused-parameter
          arguments:
            - allowRegex: ^_
          disabled: false
        - name: import-shadowing
          disabled: false
        - name: exported
          disabled: false
  exclusions:
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    # The `exclude-rules` configuration below configures
    # more particular exclusion rules, mostly aimed at tests
    # or some structurally known areas like testutil and test
    # folders which are not part of product packages.
    #
    # Development doesn't carry these exclusions, as we have
    # testing concerns that are being excluded here.
    rules:
      # cli package uses fmt.Print by design
      - linters:
          - forbidigo
        path: ^cli/
      # we don't want to silence test, but we want to silence
      # some known issues in them which rank lower than product.
      # generally no test code impacts the quality of product
      # code, if the test is deleted. Whatever test metrics we
      # measure are to our benefit.
      - linters:
          - errcheck
        path: (^test/|^tests/|/testutil.go|_test\.go)
        text: error return value of `[^`]+` is not checked # unsafe typecasts are common
      - linters:
          - errcheck
        path: (^test/|^tests/|/testutil.go|_test\.go)
        text: Error return value is not checked
      - linters:
          - dupl # many functions looks like dupes
          - gocyclo # many functions can be very long
          - funlen # many functions can be very long
          - gosec # tests don't have CVEs
        path: _test\.go
      - linters:
          - gomodguard
        path: ^internal/service/
      - path: (.+)\.go$
        text: G404 # Use of weak random number generator (math/rand instead of crypto/rand)
      - path: (.+)\.go$
        text: SA9004 # only the first constant in this group has an explicit type
      - path: (.+)\.go$
        text: SA1019 # Warning on deprecated imports (stdlib ioutil, grpc import)
      - path: (.+)\.go$
        text: SA1029 # should not use built-in type string as key for value; define your own type to avoid collision
    paths:
      - .*\.pb\.go$
      - .*/mock/.+\.go$
      - .*/bindata.go$
      - ci
      - bin
      - webclient
      - portal
      - tests/streams/scripts
      - third_party$
      - builtin$
      - examples$
issues:
  max-issues-per-linter: 0
  max-same-issues: 0
formatters:
  enable:
    - gci # using for import formatting instead of goimports
    - gofmt # standard Go formatting
  settings:
    gci:
      sections:
        - standard  # std packages
        - default   # third-party packages
        - prefix(github.com/TykTechnologies)  # same org, different repos
        - prefix(github.com/TykTechnologies/tyk)  # same repo
        - blank     # blank imports
        - dot       # dot imports
  exclusions:
    paths:
      - third_party$
      - builtin$
      - examples$