version: "2"
run:
  tests: false
  # keep in sync with buildTags in .make/main.go
  build-tags:
    - containers_image_openpgp
    - exclude_graphdriver_btrfs
linters:
  default: none
  enable:
    - asciicheck
    - bodyclose
    - copyloopvar
    - depguard
    - dogsled
    - dupl
    - errcheck
    - funlen
    - gocognit
    - goconst
    - gocritic
    - gocyclo
    - goprintffuncname
    - gosec
    - govet
    - ineffassign
    - misspell
    - nakedret
    - nolintlint
    - revive
    - staticcheck
    - unconvert
    - unparam
    - unused
    - whitespace
  settings:
    depguard:
      rules:
        yaml:
          deny:
            # gopkg.in/yaml.v3 is unmaintained and panics on some malformed input (see #5327)
            - pkg: gopkg.in/yaml.v3
              desc: use go.yaml.in/yaml/v3 instead
    funlen:
      lines: 70
      statements: 50
    goconst:
      # the default of 3 turns every repeated literal in a lookup table or a test fixture into a finding.
      # 5 keeps the ones worth hoisting without flagging data that reads better written out.
      min-occurrences: 5
    gocritic:
      enabled-checks:
        - deferInLoop
        - ruleguard
      settings:
        ruleguard:
          rules: test/rules/rules.go
    gosec:
      excludes:
        - G115
  exclusions:
    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:
      # we have multiple packages in syft that might overlap with the stblib; their names reflect their purpose
      - linters:
          - revive
        text: "var-naming: avoid package names that conflict"
      # cpegenerate is almost entirely lookup tables mapping artifact names to vendors, products, and
      # maven group ids. The repeated strings are the data itself, so hoisting them to constants would
      # replace a readable table with indirection for no gain.
      - linters:
          - goconst
        path: syft/pkg/cataloger/internal/cpegenerate/
    paths:
      - third_party$
      - builtin$
      - examples$

# do not enable...
#    - deadcode          # The owner seems to have abandoned the linter. Replaced by "unused".
#    - goprintffuncname  # does not catch all cases and there are exceptions
#    - nakedret          # does not catch all cases and should not fail a build
#    - gochecknoglobals
#    - gochecknoinits    # this is too aggressive
#    - rowserrcheck disabled per generics https://github.com/golangci/golangci-lint/issues/2649
#    - godot
#    - godox
#    - goerr113
#    - golint      # deprecated
#    - gomnd       # this is too aggressive
#    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives
#    - lll         # without a way to specify per-line exception cases, this is not usable
#    - maligned    # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
#    - nestif
#    - prealloc     # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
#    - rowserrcheck # not in a repo with sql, so this is not useful
#    - scopelint    # deprecated
#    - structcheck  # The owner seems to have abandoned the linter. Replaced by "unused".
#    - testpackage
#    - varcheck     # The owner seems to have abandoned the linter. Replaced by "unused".
#    - wsl          # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)

issues:
  max-same-issues: 25
  uniq-by-line: false

# TODO: enable this when we have coverage on docstring comments
#  # The list of ids of default excludes to include or disable.
#  include:
#    - EXC0002 # disable excluding of issues about comments from golint

formatters:
  enable:
    - gci
    - gofmt
  exclusions:
    generated: lax
    paths:
      - third_party$
      - builtin$
      - examples$
  settings:
    gci:
      # See https://golangci-lint.run/docs/formatters/configuration/#gci
      sections:
        - standard # Standard section: captures all standard packages.
        - default  # Default section: contains all imports that could not be matched to another section type.
        - prefix(github.com/anchore)