.golangci.yml

# golangci-lint v2 configuration schema. A v1 file is not read by v2, so the
# version line is load-bearing rather than decorative.
version: "2"

run:
  timeout: 5m
  # Tests are linted too. Much of a security tool's file handling lives in its
  # tests, and a test that leaks a fixture still leaks.
  tests: true

linters:
  # `standard` is errcheck, govet, ineffassign, staticcheck and unused. They are
  # named again below so this file states the whole set instead of half of it
  # plus an implicit default a reader has to already know about.
  default: standard
  enable:
    - errcheck
    - govet
    - staticcheck
    - revive
    - gosec
    - bodyclose
    - contextcheck
    - errorlint
    - nilerr

  settings:
    errcheck:
      check-type-assertions: true

  exclusions:
    generated: lax

    # The linter's own curated set for deferred Close, Fprintf to a buffer and
    # the other cases where the returned error carries nothing a caller could
    # act on. A published list, not a hand-drawn one.
    presets:
      - std-error-handling

    # Every exclusion below names a rule and a place. No linter is switched off
    # wholesale, and nothing here weakens gosec on production code -- which is
    # the point of running gosec in a tool that holds cluster PKI.
    rules:
      # Test files create wrong-permission files and traversal-shaped paths on
      # purpose: that is how the permission guard and the key validation are
      # proven to reject them, so flagging the fixture inverts the finding.
      # Response bodies in tests live for the length of one test binary.
      - path: _test\.go$
        linters:
          - gosec
          - bodyclose

      # The simulator's job is to behave like a real Talos node, and
      # `common.Metadata` -- the hostname every reply carries -- is deprecated
      # in machinery v1.14's protos and still sent by every real node, because
      # deprecated is not removed. A simulator that dropped it would stop
      # matching the thing it simulates, and the client code that reads it
      # would then be tested against a reply shape no node produces.
      #
      # Named by rule, by place and by message: SA1019 stays on everywhere
      # else in this package, so a different deprecation here is still a
      # finding. When Talos removes the field, this exclusion stops matching
      # and the sites it covers become errors, which is the right moment to
      # deal with them.
      - path: internal/talossim/
        linters:
          - staticcheck
        text: "common.Metadata"

      # G304 is "file path from a variable". Three packages own files by design:
      # the store is the only thing allowed to touch state records, the audit log
      # owns its append-only archive, and tlsx owns the TLS material. Taking a
      # path in a variable is their whole job. Everywhere else G304 stays on,
      # which is what keeps it worth reading when it does fire.
      - path: internal/(store|audit|tlsx)/
        linters:
          - gosec
        text: "G304"

      # G104 re-reports unchecked errors that errcheck already owns, and it does
      # not honour the std-error-handling list above, so the two disagree about
      # the same lines. errcheck is the one kept.
      - linters:
          - gosec
        text: "G104"

      # contextcheck cannot see through budgetedContext, which is the one
      # helper every route in this package derives its deadline with:
      # context.WithTimeout(r.Context(), budget). It is a derivation and the
      # linter reads it as a fresh context, so every route that applies its own
      # budget -- which is every route that talks to a node, by design -- is
      # reported. The property it is trying to protect is held by
      # cmd/holzkube-managerd/budget_test.go instead, which checks the actual
      # arithmetic against the write timeout rather than the shape of the call.
      - path: internal/httpapi/handlers/
        linters:
          - contextcheck
        text: "Non-inherited new context"

      # Two deliberate detachments, both of them lifetimes rather than calls.
      # A node's supervisor lives as long as the inventory service, never as
      # long as the request that adopted the node -- that was a real bug, fixed
      # in v1.15 phase 2 and held by a regression test. A job runs on the
      # engine's lifetime for the same reason: a job cancelled because its
      # submitter's HTTP connection closed is a half-applied configuration.
      - path: internal/(inventory|jobs)/
        linters:
          - contextcheck
        text: "should pass the context parameter"
      - path: internal/httpapi/handlers/inventory.go
        linters:
          - contextcheck
        text: "should pass the context parameter"

      # The bootstrap lease is a file whose path is derived from a cluster id
      # this process holds a record for, opened O_EXCL at 0600. Taking the path
      # in a variable is the mechanism: the lease is per cluster.
      - path: internal/provision/bootstrap.go
        linters:
          - gosec
        text: "G304"

      # The subcommands take paths from the operator on the command line --
      # that is what a backup, a restore and an export are. There is no user
      # input here and no privilege to escalate to: the process already runs as
      # whoever typed the command, and it reads and writes what they named.
      - path: cmd/holzkube-managerd/commands.go
        linters:
          - gosec
        text: "G304|G703"

      # The jitter on the heartbeat spreads a fleet's reads across an interval.
      # It decides nothing, authenticates nothing and is not a secret; every
      # value in this product that has to be unguessable comes from crypto/rand
      # by way of internal/tlsx and internal/auth, where G404 stays on.
      - path: internal/inventory/observe.go
        linters:
          - gosec
        text: "G404"

      # The talosconfig download: the bytes are assembled by this process from
      # the cluster's own stored PKI, served as an attachment with nosniff and
      # a Content-Disposition, and never interpreted as a document. gosec's
      # taint analysis follows the store read and cannot see that.
      - path: internal/httpapi/handlers/inventory.go
        linters:
          - gosec
        text: "G705"

      # The cluster-template export, and the same argument as the two
      # configuration downloads above it: the bytes are YAML this process
      # generated from its own stored records, served as an attachment with
      # nosniff and a Content-Disposition. The taint analysis follows the store
      # read into the response and cannot see the encoder in between.
      - path: internal/httpapi/handlers/templates.go
        linters:
          - gosec
        text: "G705"

      # A test starting a simulated node inside a subtest is starting a
      # process-lifetime fixture, not making a call: talossim.New listens and
      # serves until the test cleans it up, and handing it the subtest's
      # context would tear the node down at the wrong moment.
      - path: _test\.go$
        linters:
          - contextcheck

      # The simulator derives a stable fake identifier by folding a hash into
      # bytes. The truncation is the algorithm, not an accident, and nothing it
      # produces leaves internal/talossim.
      - path: internal/talossim/
        linters:
          - gosec
        text: "G115"

formatters:
  enable:
    - gofmt

issues:
  # Report everything. The defaults cap output at 50 per linter and 3 per rule,
  # which turns "the lint is nearly clean" into a statement about the cap.
  max-issues-per-linter: 0
  max-same-issues: 0