.golangci.yml

run:
  skip-dirs-use-default: false
linters-settings:
  errcheck:
    check-type-assertions: true
  forbidigo:
    forbid:
      # Use private/pkg/thread.Parallelize
      - '^errgroup\.'
      # Use private/pkg/command.Runner
      - '^exec\.Cmd$'
      - '^exec\.Command$'
      - '^exec\.CommandContext$'
      # os.Rename does not work across filesystem boundaries
      # See https://github.com/bufbuild/buf/issues/639
      - '^os\.Rename$'
      # Ban debug statements
      - '^fmt\.Print'
      - '^log\.'
      - '^print$'
      - '^println$'
  importas:
    alias:
      - pkg: github.com/bufbuild/buf/private/gen/proto/go/buf/alpha/image/v1
        alias: imagev1
      - pkg: github.com/bufbuild/buf/private/gen/proto/go/buf/alpha/module/v1
        alias: modulev1
      - pkg: github.com/bufbuild/buf/private/gen/proto/go/buf/alpha/registry/v1alpha1
        alias: registryv1alpha1
linters:
  enable:
    - asciicheck
    - bidichk
    - bodyclose
    - containedctx
    # - contextcheck
    - decorder
    # - depguard
    - dogsled
    - errcheck
    - execinquery
    - exportloopref
    - forbidigo
    - forcetypeassert
    - gci
    - gochecknoinits
    - gofmt
    - goheader
    # - goimports
    - gomodguard
    - goprintffuncname
    - gosec
    - gosimple
    - govet
    - grouper
    - importas
    - ineffassign
    - logrlint
    - makezero
    - mirror
    - misspell
    - nakedret
    - nilerr
    - nolintlint
    - nosprintfhostport
    - paralleltest
    - predeclared
    - promlinter
    - reassign
    - rowserrcheck
    - staticcheck
    - stylecheck
    - typecheck
    - unconvert
    - unused
    - wastedassign
    - whitespace
  disable-all: true
issues:
  exclude-rules:
    - linters:
        - forbidigo
      # this is one of two files we want to allow exec.Cmd functions in
      path: private/pkg/command/runner.go
    - linters:
        - forbidigo
      # this is one of two files we want to allow exec.Cmd functions in
      path: private/pkg/command/process.go
    - linters:
        - forbidigo
      # we use os.Rename here to rename files in the same directory
      # This is safe (we aren't traversing filesystem boundaries).
      path: private/pkg/storage/storageos/bucket.go
      text: "os.Rename"
    - linters:
        - stylecheck
      text: "ST1005:"
    - linters:
        - errcheck
      # headers.go has casts with values from contexts that should fail if there
      # is no error, but it would be very unidiomatic to return an error from
      # the functions that do these casts, and we completely control the
      # context values within this file
      path: private/pkg/rpc/headers.go
    - linters:
        - gosec
      # G101 checks for hardcoded credentials, and the variables named "*Password*
      # trip this off.
      path: private/buf/bufcli/bufcli.go
      text: "G101:"
    - linters:
        - gosec
      # G204 checks that exec.Command is not called with non-constants.
      path: private/pkg/command/runner.go
      text: "G204:"
    - linters:
        - wastedassign
      # netrc/internal is a library largely copied in from an external repository with attribution.
      # We try to make minimal edits.
      path: private/pkg/netrc/internal/internal.go
      # we actually want to use this init to create a protovalidate.Validator
    - linters:
        - gochecknoinits
      path: private/bufpkg/bufcas/proto.go
      # we actually want to use this init in testing
    - linters:
        - gochecknoinits
      path: private/bufpkg/bufmodule/bufmoduletesting/bufmoduletesting.go
      # we actually want to use this init
    - linters:
        - gochecknoinits
      path: private/usage/usage.go
      # we actually want to embed a context here
    - linters:
        - containedctx
      path: private/bufpkg/bufmodule/bufmoduleprotoparse/path_resolver.go
      # we actually want to embed a context here
    - linters:
        - containedctx
      path: private/pkg/transport/grpc/grpcclient/client_conn_provider.go
      # we actually want to use errgroup when starting an HTTP server
    - linters:
        - forbidigo
      path: private/pkg/transport/http/httpserver/httpserver.go
      text: "use of `errgroup"
      # we want to use errgroup here
    - linters:
        - forbidigo
      path: private/bufpkg/bufplugin/bufplugindocker/docker.go
      text: "use of `errgroup"
    - linters:
        - containedctx
      path: private/bufpkg/bufmodule/bufmoduleprotocompile
      # We should be able to use net/http/cgi in a unit test, in addition the CVE mentions only versions of go < 1.6.3 are affected.
    - linters:
        - gosec
      path: private/pkg/git/git_test.go
      text: "G504:"
    - linters:
        - stylecheck
      path: private/bufpkg/bufapimodule/module_resolver_test.go
      text: "ST1003:"
    - linters:
        - dogsled
      # One function call doesn't care about most of the returned destructured values. The
      # dogsled linter complains about it. (Value of this linter is unclear...)
      path: private/buf/cmd/buf/command/curl/curl.go
    - linters:
        - containedctx
      # Type must implement an interface whose methods do not accept context. But this
      # implementation makes RPC calls, which need a context. So we allow creator of the
      # type to provide a context at value creation (instead of using context.Background()).
      path: private/buf/bufcurl/reflection_resolver.go
    # We deprecated all the definitions in plugin.proto but we still implement them.
    - linters:
        - staticcheck
      text: "buf/alpha/registry/v1alpha1/plugin.proto is marked as deprecated"
    # We deprecated all the definitions in generate.proto but we still implement them.
    - linters:
        - staticcheck
      text: "buf/alpha/registry/v1alpha1/generate.proto is marked as deprecated"
    # We need to handle this field in descriptor.proto.
    - linters:
        - staticcheck
      text: "GetDeprecatedLegacyJsonFieldConflicts is deprecated"
    # We verify manually so that we can emit verbose output while doing so.
    - linters:
        - gosec
      text: "G402:"
      path: private/buf/bufcurl/tls.go
    # We don't need a cryptographically secure RNG for these tests, and a
    # deterministic RNG is actually nice for test repeatability.
    - linters:
        - gosec
      text: "G404:"
      path: private/bufpkg/bufimage/bufimageutil/.*_test\.go
    # This test shouldn't run in parallel as it allocates a lot of memory.
    - linters:
        - paralleltest
      text: "missing the call to method parallel"
      path: private/bufpkg/bufimage/bufimagebuild/builder_unix_test.go
    # TestWorkspaceArchiveDir, TestWorkspaceWithInvalidArchivePathFail
    # and TestWorkspaceWithInvalidArchiveAbsolutePathFail cannot run in parallel
    # because they all call createZipFromDir on the same path, writing to the same file.
    - linters:
        - paralleltest
      text: "missing the call to method parallel"
      path: private/buf/cmd/buf/workspace_test.go
    # Parallelizing TestPlainPostHandlerTLS and TestPlainPostHandlerH2C
    # makes this test flaky.
    - linters:
        - paralleltest
      path: private/bufpkg/bufstudioagent/bufstudioagent_test.go
      text: "missing the call to method parallel"
    # Buf sync branches are not synced (nor tested) in parallel
    - linters:
        - paralleltest
      text: "missing the call to method parallel"
      path: private/buf/bufsync/commits_to_sync_test.go
    # A git repo is not safe to read concurrently, since it has a single object reader.
    - linters:
        - paralleltest
      text: "missing the call to method parallel"
      path: private/pkg/git/repository_test.go