.golangci.yml

version: "2"

# To lint the windows sources on a linux host, you need to cross-build and
# disable the C-based sqlite driver:
#
# GOOS=windows golangci-lint run --build-tags=windows,sqlite_modernc
#
# In the CI, the linters are run on both linux and windows hosts.

run:
  build-tags:
    - expr_debug

linters:
  default: all
  disable:
    #
    # Redundant
    #
    - cyclop    # revive
    - funlen    # revive
    - gocognit  # revive
    - gocyclo   # revive
    - lll       # revive
    - wsl       # wsl_v5

    # Disabled atm, likely to be enabled later

    - funcorder
    - exhaustive
    - errname      # Checks that sentinel errors are prefixed with the `Err` and error types are suffixed with the `Error`.
    - unparam      # Reports unused function parameters
    - errchkjson   # Checks types passed to the json encoding functions. Reports unsupported types and reports occasions, where the check for the returned error can be omitted.
    - unqueryvet   # Detects SELECT * in SQL queries and SQL builders, preventing performance issues and encouraging explicit column selection.

    # we allow named returns (to improve readability, in the function signatures)
    # but disallow implicit (or "naked") returns, to improve readability in the actual code.
    #
    # Implicit returns are still useful with deferred functions, in which case they can be //nolinted.
    # https://go.dev/wiki/CodeReviewComments#named-result-parameters
    - nonamedreturns

    - dogsled               # Checks assignments with too many blank identifiers (e.g. x, _, _, _, := f())
    - gosec                 # (gas): Inspects source code for security problems
    - musttag               # enforce field tags in (un)marshaled structs
    - promlinter            # Check Prometheus metrics naming via promlint
    - tagalign              # check that struct tags are well aligned
    - thelper               # thelper detects tests helpers which do not start with t.Helper() method.
    - wrapcheck             # Checks that errors returned from external packages are wrapped
    - embeddedstructfieldcheck

    - ireturn               # Accept Interfaces, Return Concrete Types
    - mnd                   # An analyzer to detect magic numbers.
    - nilnil                # Checks that there is no simultaneous return of `nil` error and an invalid value.
    - dupl                  # Tool for code clone detection
    - forcetypeassert       # finds forced type assertions
    - godox                 # Tool for detection of FIXME, TODO and other comment keywords
    - err113                # Go linter to check the errors handling expressions
    - paralleltest          # Detects missing usage of t.Parallel() method in your Go test
    - testpackage           # linter that makes you use a separate _test package
    - exhaustruct           # Checks if all structure fields are initialized
    - gochecknoglobals      # Check that no global variables exist.
    - goconst               # Finds repeated strings that could be replaced by a constant
    - tagliatelle           # Checks the struct tags.
    - varnamelen            # checks that the length of a variable's name matches its scope
    - prealloc
    - noinlineerr
    - iotamixing
    - godoclint

    #
    # Formatting only, useful in IDE but should not be forced on CI
    #

    - godot      # Check if comments end in a period
    - nlreturn   # nlreturn checks for a new line before return and branch statements to increase code clarity
    - whitespace # Whitespace is a linter that checks for unnecessary newlines at the start and end of functions, if, for, etc.
    - wsl_v5     # add or remove empty lines

  settings:

    decorder:
      # Required order of `type`, `const`, `var` and `func` declarations inside a file.
      # Default: types before constants before variables before functions.
      dec-order:
        - type
        - const
        - var
        - func
      # If true, underscore vars (vars with "_" as the name) will be ignored at all checks.
      # Default: false (underscore vars are not ignored)
      ignore-underscore-vars: false
      # If true, order of declarations is not checked at all.
      # Default: true (disabled)
      disable-dec-order-check: true
      # If true, `init` func can be anywhere in file (does not have to be declared before all other functions).
      # Default: true (disabled)
      disable-init-func-first-check: true
      # If true, multiple global `type`, `const` and `var` declarations are allowed.
      # Default: true (disabled)
      disable-dec-num-check: true
      # If true, type declarations will be ignored for dec num check.
      # Default: false (type statements are not ignored)
      disable-type-dec-num-check: false
      # If true, const declarations will be ignored for dec num check.
      # Default: false (const statements are not ignored)
      disable-const-dec-num-check: false
      # If true, var declarations will be ignored for dec num check.
      # Default: false (var statements are not ignored)
      disable-var-dec-num-check: false

    depguard:
      rules:
        wrap:
          deny:
            - pkg: github.com/pkg/errors
              desc: errors.Wrap() is deprecated in favor of fmt.Errorf()
        yaml:
          files:
            - '!**/pkg/acquisition/modules/loki/timestamp_test.go'
            - '!**/pkg/appsec/appsec.go'
            - '!**/pkg/appsec/loader.go'
            - '!**/pkg/csplugin/broker.go'
            - '!**/pkg/leakybucket/bucketstore_test.go'
            - '!**/pkg/leakybucket/manager_load.go'
            - '!**/pkg/parser/node_config.go'
            - '!**/pkg/parser/node_subnodes_test.go'
            - '!**/pkg/parser/node_test.go'
            - '!**/pkg/parser/parsing_test.go'
            - '!**/pkg/parser/stage.go'
          deny:
            - pkg: gopkg.in/yaml.v2
              desc: yaml.v2 is deprecated for new code in favor of yaml.v3

    embeddedstructfieldcheck:
      empty-line: false
      forbid-mutex: true

    errcheck:
      # Report about not checking of errors in type assertions: `a := b.(MyStruct)`.
      # Such cases aren't reported by default.
      check-type-assertions: false
      # List of functions to exclude from checking, where each entry is a single function to exclude.
      # See https://github.com/kisielk/errcheck#excluding-functions for details.
      exclude-functions:
        - (*bytes.Buffer).ReadFrom          # TODO
        - golang.org/x/sys/windows.FreeLibrary
        - golang.org/x/sys/windows.CloseHandle
        - golang.org/x/sys/windows.ResetEvent
        - (*golang.org/x/sys/windows/svc/eventlog.Log).Info
        - (*golang.org/x/sys/windows/svc/mgr.Mgr).Disconnect

        - (github.com/bluele/gcache.Cache).Set
        - (github.com/gin-gonic/gin.ResponseWriter).WriteString
        - (*github.com/segmentio/kafka-go.Reader).SetOffsetAt

        - (*github.com/crowdsecurity/crowdsec/pkg/appsec.ReqDumpFilter).FilterArgs
        - (*github.com/crowdsecurity/crowdsec/pkg/appsec.ReqDumpFilter).FilterBody
        - (*github.com/crowdsecurity/crowdsec/pkg/appsec.ReqDumpFilter).FilterHeaders
        - (*github.com/crowdsecurity/crowdsec/pkg/longpollclient.LongPollClient).Stop

    errorlint:
      # Check whether fmt.Errorf uses the %w verb for formatting errors.
      # See the https://github.com/polyfloyd/go-errorlint for caveats.
      # Default: true
      errorf: false
      errorf-multi: true
      asserts: true
      comparison: true

    exhaustive:
      # Program elements to check for exhaustiveness.
      # Default: [ switch ]
      check:
        - switch
        - map
      # Presence of "default" case in switch statements satisfies exhaustiveness,
      # even if all enum members are not listed.
      # Default: false
      default-signifies-exhaustive: true
      # Enum members matching the supplied regex do not have to be listed in
      # switch statements to satisfy exhaustiveness.
      # Default: ""
      ignore-enum-members: "Example.+"
      # Enum types matching the supplied regex do not have to be listed in
      # switch statements to satisfy exhaustiveness.
      # Default: ""
      ignore-enum-types: "Example.+"
      # Consider enums only in package scopes, not in inner scopes.
      # Default: false
      package-scope-only: true
      # Only run exhaustive check on switches with "//exhaustive:enforce" comment.
      # Default: false
      explicit-exhaustive-switch: true
      # Only run exhaustive check on map literals with "//exhaustive:enforce" comment.
      # Default: false
      explicit-exhaustive-map: true
      # Switch statement requires default case even if exhaustive.
      # Default: false
      default-case-required: true

    forbidigo:
      forbid:
      # prefer fprint to print calls, keep the latter for debugging
      # so they're not comitted by mistake.
      - pattern: ^print(ln)?$
      - pattern: ^fmt\.Print.*$
        msg: use the Fprint equivalent in production code

    gocritic:
      enable-all: true
      disabled-checks:
        - paramTypeCombine
        - hugeParam
        - commentedOutCode
        - commentedOutImport
        - unnamedResult
        - sloppyReassign
        - appendCombine
        - commentFormatting
        - whyNoLint
        - equalFold               #
        - unnecessaryBlock        #
        - tooManyResultsChecker
        - docStub
        - preferFprint
        - importShadow

      settings:
        ifElseChain:
          minThreshold: 4

    gomoddirectives:
      replace-allow-list:
        - golang.org/x/time
        - github.com/corazawaf/coraza/v3

    govet:
      disable:
        - fieldalignment
      enable-all: true

    iface:
      enable:
        # Identifies interfaces in the same package that have identical method sets.
        - identical
        # Identifies interfaces that are not used anywhere in the same package where the interface is defined.
        # - unused
        # Identifies functions that return interfaces, but the actual returned value is always a single concrete implementation.
        - opaque
        # Identifies interfaces that are not exported but are used in exported functions or methods.
        # - unexported

    interfacebloat:
      max: 7

    maintidx:
      # raise this after refactoring
      under: 21

    misspell:
      locale: US

    modernize:
      disable:
        - any
        - fmtappendf
        - forvar
        - omitzero
        - stringsbuilder
        - waitgroup

    nestif:
      # lower this after refactoring
      min-complexity: 15

    nlreturn:
      block-size: 6

    nolintlint:
      # don't require an explanation for nolint directives
      require-explanation: false
      # don't require nolint directives to be specific about which linter is being skipped
      require-specific: true
      # report any unused nolint directives
      allow-unused: false

    perfsprint:
      # Enable/disable optimization of integer formatting.
      # Default: true
      integer-format: false
      # Optimizes even if it requires an int or uint type cast.
      # Default: true
      int-conversion: false
      # Enable/disable optimization of error formatting.
      # Default: true
      error-format: true
      # Optimizes into `err.Error()` even if it is only equivalent for non-nil errors.
      # Default: false
      err-error: true
      # Optimizes `fmt.Errorf`.
      # Default: true
      errorf: true
      # Enable/disable optimization of string formatting.
      # Default: true
      string-format: false
      # Optimizes `fmt.Sprintf` with only one argument.
      # Default: true
      sprintf1: true
      # Optimizes into strings concatenation.
      # Default: true
      strconcat: false
      # Enable/disable optimization of bool formatting.
      # Default: true
      bool-format: true
      # Enable/disable optimization of hex formatting.
      # Default: true
      hex-format: false
      # Enable/disable optimization of concat loop.
      # Default: true
      concat-loop: false
      # Optimization of `concat-loop` even with other operations.
      # Default: false
      loop-other-ops: false

    recvcheck:
      # Disables the built-in method exclusions:
      # - `MarshalText`
      # - `MarshalJSON`
      # - `MarshalYAML`
      # - `MarshalXML`
      # - `MarshalBinary`
      # - `GobEncode`
      disable-builtin: false
      # User-defined method exclusions.
      # The format is `struct_name.method_name` (ex: `Foo.MethodName`).
      # A wildcard `*` can use as a struct name (ex: `*.MethodName`).
      exclusions:
        - "HCLogAdapter.SetLevel"

    revive:
      severity: error
      enable-all-rules: true
      rules:
        - name: argument-limit
          arguments: [9]
        - name: add-constant
          disabled: true
        - name: cognitive-complexity
          arguments:
            # lower this after refactoring
            - 73
        - name: comment-spacings
          disabled: true
        - name: confusing-results
          disabled: true
        - name: cyclomatic
          arguments:
            # lower this after refactoring
            - 36
        - name: empty-block
          disabled: true
        - name: empty-lines
          disabled: true
        - name: enforce-switch-style
          disabled: true
        - name: error-naming
          disabled: true
        - name: exported
          disabled: true
        - name: flag-parameter
          disabled: true
        - name: function-result-limit
          arguments:
            - 6
        - name: function-length
          arguments:
            # lower this after refactoring
            - 86
            - 174
        - name: get-return
          disabled: true
        - name: identical-ifelseif-branches
          disabled: true
        - name: identical-switch-branches
          disabled: true
        - name: import-alias-naming
          disabled: true
        - name: import-shadowing
          disabled: true
        - name: increment-decrement
          disabled: true
        - name: line-length-limit
          arguments:
            # lower this after refactoring
            - 219
        - name: max-control-nesting
          arguments:
            # lower this after refactoring
            - 5
        - name: max-public-structs
          disabled: true
        - name: nested-structs
          disabled: true
        - name: package-comments
          disabled: true
        - name: package-directory-mismatch
          disabled: true
        - name: redundant-import-alias
          disabled: true
        - name: redundant-test-main-exit
          disabled: true
        - name: var-naming
          disabled: true
        - name: unchecked-type-assertion
          disabled: true
        - name: unexported-naming
          disabled: true
        - name: unexported-return
          disabled: true
        - name: unhandled-error
          arguments:
            - fmt.Print
            - fmt.Printf
            - fmt.Println
          disabled: true
        - name: unnecessary-stmt
          disabled: true
        - name: unsecure-url-scheme
          disabled: true
        - name: unused-parameter
          disabled: true
        - name: use-any
          disabled: true
        - name: use-waitgroup-go
          disabled: true
        - name: useless-break
          disabled: true

    staticcheck:
      checks:
        - all
        - -ST1003  # should not use underscores in Go names
        - -ST1005  # error strings should not be capitalized
        - -ST1012  # error var ... should have name of the form ...
        - -QF1003  # could use tagged switch on ...
        - -QF1012  # QF1012: Use fmt.Fprintf(...) instead of ...

    unused:
      # Mark all struct fields that have been written to as used.
      # Default: true
      field-writes-are-uses: false
      # Treat IncDec statement (e.g. `i++` or `i--`) as both read and write operation instead of just write.
      # Default: false
      post-statements-are-reads: false
      # Mark all exported identifiers as used.
      # Default: true
      # exported-is-used: false
      # Mark all exported fields as used.
      # default: true
      exported-fields-are-used: false
      # Mark all function parameters as used.
      # default: true
      parameters-are-used: true
      # Mark all local variables as used.
      # default: true
      local-variables-are-used: false
      # Mark all identifiers inside generated files as used.
      # Default: true
      generated-is-used: false

    usestdlibvars:
      # Suggest the use of http.MethodXX.
      # Default: true
      http-method: true
      # Suggest the use of http.StatusXX.
      # Default: true
      http-status-code: true
      # Suggest the use of time.Month in time.Date.
      # Default: false
      time-date-month: false
      # Suggest the use of time.Weekday.String().
      # Default: true
      time-weekday: false
      # Suggest the use of time.Month.String().
      # Default: false
      time-month: false
      # Suggest the use of time.Layout.
      # Default: false
      time-layout: false
      # Suggest the use of crypto.Hash.String().
      # Default: false
      crypto-hash: true
      # Suggest the use of rpc.DefaultXXPath.
      # Default: false
      default-rpc-path: true
      # Suggest the use of sql.LevelXX.String().
      # Default: false
      sql-isolation-level: true
      # Suggest the use of tls.SignatureScheme.String().
      # Default: false
      tls-signature-scheme: true
      # Suggest the use of constant.Kind.String().
      # Default: false
      constant-kind: true

    usetesting:
      os-temp-dir: false
      context-background: true
      context-todo: true

  exclusions:
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:

      # `err` is often shadowed, we may continue to do it

      - linters:
          - govet
        text: 'shadow: declaration of "(err|ctx)" shadows declaration'

      - linters:
          - revive
        path: pkg/leakybucket/manager_load.go
        text: 'confusing-naming: Field ''.*'' differs only by capitalization to other field in the struct type BucketFactory'

      - linters:
          - revive
        path: pkg/exprhelpers/helpers.go
        text: 'confusing-naming: Method ''flatten'' differs only by capitalization to function ''Flatten'' in the same source file'

      - linters:
          - revive
        path: pkg/appsec/query_utils.go
        text: 'confusing-naming: Method ''parseQuery'' differs only by capitalization to function ''ParseQuery'' in the same source file'

      - linters:
          - revive
        path: pkg/acquisition/modules/loki/internal/lokiclient/loki_client.go
        text: 'confusing-naming: Method ''QueryRange'' differs only by capitalization to method ''queryRange'' in the same source file'

      - linters:
          - revive
        path: pkg/acquisition/modules/victorialogs/internal/vlclient/vl_client.go
        text: 'confusing-naming: Method ''QueryRange'' differs only by capitalization to method ''queryRange'' in the same source file'

      # tolerate complex functions in tests for now
      - linters:
          - maintidx
        path: (.+)_test.go

      # tolerate print in tests for now
      - linters:
          - forbidigo
        path: (.+)_test.go
        text: 'use the Fprint equivalent in production code'

      # tolerate long functions in tests
      - linters:
          - revive
        path: (.+)_test.go
        text: 'function-length: .*'

      # tolerate long lines in tests
      - linters:
          - revive
        path: (.+)_test.go
        text: 'line-length-limit: .*'

      # we use t,ctx instead of ctx,t in tests
      - linters:
          - revive
        path: (.+)_test.go
        text: 'context-as-argument: context.Context should be the first parameter of a function'

      # tolerate deep exit in cobra's OnInitialize, for now
      - linters:
          - revive
        path: cmd/crowdsec-cli/main.go
        text: 'deep-exit: .*'

      - linters:
          - revive
        path: cmd/crowdsec/crowdsec.go
        text: 'deep-exit: .*'

      - linters:
          - revive
        path: cmd/crowdsec/api.go
        text: 'deep-exit: .*'

      - linters:
          - revive
        path: cmd/crowdsec/win_service.go
        text: 'deep-exit: .*'

      - linters:
          - revive
        path: cmd/crowdsec-cli/clisetup/setup/systemd_test.go
        text: 'deep-exit: .*'

      - linters:
          - gocritic
        path: cmd/crowdsec-cli
        text: 'rangeValCopy: .*'

      - linters:
          - gocritic
        path: pkg/(cticlient|hubtest)
        text: 'rangeValCopy: .*'

      - linters:
          - gocritic
        path: (.+)_test.go
        text: 'rangeValCopy: .*'

      - linters:
          - gocritic
        path: pkg/(appsec|acquisition|dumps|alertcontext|leakybucket|exprhelpers)
        text: 'rangeValCopy: .*'

      - linters:
          - usetesting
        path: pkg/apiserver/(.+)_test.go
        text: os.MkdirTemp.* could be replaced by t.TempDir.*

      - linters:
          - usetesting
        path: pkg/apiserver/(.+)_test.go
        text: os.CreateTemp.* could be replaced by os.CreateTemp.*

      - linters:
          - containedctx
        path: cmd/notification-file/main.go
        text: found a struct that contains a context.Context field

      - linters:
          - containedctx
        path: pkg/acquisition/modules/s3/source.go
        text: found a struct that contains a context.Context field

      # migrate over time

      - linters:
          - noctx
        path: pkg/parser/enrich_dns.go
        text: "net.LookupAddr must not be called"

      - linters:
          - noctx
        path: pkg/exprhelpers/helpers.go
        text: "net.LookupHost must not be called"

      - linters:
          - embeddedstructfieldcheck
        text: "embedded fields should be listed before regular fields"

      # TODO: remove when NodeConfig is not embedded anymore
      - linters:
          - staticcheck
        path: pkg/parser/(.+).go
        text: 'QF1008: could remove embedded field "NodeConfig" from selector'

    paths:
      - third_party$
      - builtin$
      - examples$

issues:
  max-issues-per-linter: 0
  max-same-issues: 0

formatters:
  settings:
    gci:
      sections:
        - standard
        - default
        - prefix(github.com/crowdsecurity)
        - prefix(github.com/crowdsecurity/crowdsec)

  exclusions:
    paths:
      - third_party$
      - builtin$
      - examples$