.golangci.yml

version: "2"
run:
  go: "1.26"
  tests: true
  timeout: 5m  # Prevent linter from hanging indefinitely
  modules-download-mode: readonly  # Use cached modules only, skip downloads

linters:
  enable:
    - misspell
    - gomoddirectives  # Forbid replace, retract, and excludes directives in go.mod
    # gosec disabled in golangci-lint due to configuration bugs in v2
    # It's run separately via 'make security-gosec' with proper exclusions
    # - gosec
    # godot linter disabled - too pedantic about comment punctuation
    - unconvert      # Remove unnecessary conversions
    - testifylint    # Enforce testify best practices
    - intrange       # Suggest integer range in for loops
    - modernize      # Modernize Go code using modern language features
    - errorlint      # Find error wrapping issues (type assertions, comparisons)
    - usestdlibvars  # Use standard library variables/constants (e.g. http.MethodGet)
    - mirror         # Avoid unnecessary allocations in bytes/strings operations
    - nolintlint     # Report ill-formed or insufficient nolint directives
    - wastedassign   # Find wasted assignment statements
    - makezero       # Find slice declarations with non-zero initial length followed by append
    - perfsprint     # Replace fmt.Sprintf with faster alternatives where possible
    - bodyclose      # Check HTTP response bodies are closed
    - gocheckcompilerdirectives  # Validate go compiler directive comments
    - copyloopvar    # Detect loop variable copies
    - exptostd       # Replace golang.org/x/exp functions with std equivalents
    - durationcheck  # Check for two durations multiplied together
    - fatcontext     # Detect nested contexts in loops and function literals
    - nosprintfhostport  # Check for misuse of Sprintf to construct host:port URLs
    - reassign       # Check that package variables are not reassigned
    - depguard       # Forbid imports of disallowed packages (see settings below)
  disable:
    - errcheck       # Disabled due to exclude-functions not working properly in golangci-lint v2
    - gocritic       # Disabled due to disabled-checks not working properly in golangci-lint v2
    - revive         # Disabled due to exclude-rules not working properly in golangci-lint v2
    - recvcheck      # Value MarshalJSON and pointer mutation methods are both required
  settings:
    modernize:
      disable:
        - errorsastype
        - reflecttypeassert
        - stringscut
    depguard:
      rules:
        # golang.org/x/crypto is a direct dependency (used for nacl/box), which
        # pulls the unmaintained openpgp subpackage into the module graph.
        # openpgp carries advisory GO-2026-5932 with no upstream fix available,
        # so nothing in this repository may import it.
        openpgp:
          deny:
            - pkg: golang.org/x/crypto/openpgp
              desc: "golang.org/x/crypto/openpgp is unmaintained and unsafe (GO-2026-5932, no fix available); use a maintained OpenPGP implementation instead"
    gomoddirectives:
      # Forbid replace directives except where necessary for tool-dependency compatibility.
      replace-local: false       # Forbid local replace directives (e.g., replace foo => ../foo)
      replace-allow-list:
        # actionlint@v1.7.12 requires yaml/v4@rc.3, which exposes yaml.ParserError
        # and related types that were removed in rc.6. gosec@v2.29.0 pulls in rc.6
        # transitively, so we pin the whole module to rc.3 here.
        - go.yaml.in/yaml/v4

linters-settings:
  gomoddirectives:
    # Forbid replace directives except where necessary for tool-dependency compatibility.
    replace-local: false       # Forbid local replace directives (e.g., replace foo => ../foo)
    replace-allow-list:
      # actionlint@v1.7.12 requires yaml/v4@rc.3, which exposes yaml.ParserError
      # and related types that were removed in rc.6. gosec@v2.29.0 pulls in rc.6
      # transitively, so we pin the whole module to rc.3 here.
      - go.yaml.in/yaml/v4
  errcheck:
    exclude-functions:
      - (*os.File).Close
      - (*os.File).Sync
      - os.Chdir
      - os.Chmod
      - os.Chtimes
      - os.MkdirAll
      - os.Remove
      - os.RemoveAll
      - os.WriteFile
  gocritic:
    enable-all: true
    disabled-checks:
      - ifElseChain      # else-if chains are often clearer than switches
      - singleCaseSwitch # Single case switches can be intentional for consistency
      - appendAssign     # Appending to different variable is often intentional
      - unlambda         # Explicit lambdas can be clearer than direct function refs
      - elseif           # else-if pattern is acceptable
      - assignOp         # Long form assignment can be clearer
      - argOrder         # False positives on string contains
      - dupBranchBody    # Duplicate branches can be intentional for clarity
      - deprecatedComment # Allow existing deprecated comment format
      - commentFormatting # Allow commented out code
      - badCall           # filepath.Join with 1 arg is acceptable
  testifylint:
    enable-all: true

issues:
  exclusions:
    generated: lax
    rules:
      - linters:
          - staticcheck
        text: "ST1005: error strings should not end with punctuation or newlines" # Allow multiline user-facing error messages with formatting
        path: pkg/workflow/compiler_orchestrator\.go
      - linters:
          - staticcheck
        text: "ST1005: error strings should not end with punctuation or newlines" # Allow multiline user-facing error messages with formatting
        path: pkg/workflow/dispatch_workflow_validation\.go
      - linters:
          - unconvert
        path: _test\.go # Allow explicit conversions in tests for clarity

formatters:
  enable:
    - gofmt
    - goimports