.golangci.yml

version: "2"
linters:
  default: none
  enable:
    - asciicheck
    - bidichk
    - bodyclose
    - containedctx
    - copyloopvar
    # - contextcheck
    - decorder
    # - depguard
    - dogsled
    - errcheck
    - exhaustruct
    - forbidigo
    - forcetypeassert
    - gochecknoinits
    - goheader
    - gomodguard
    - goprintffuncname
    - gosec
    - govet
    - grouper
    - importas
    - ineffassign
    - loggercheck
    - makezero
    - mirror
    - misspell
    - modernize
    - nakedret
    - nilerr
    - nolintlint
    - nosprintfhostport
    - paralleltest
    - predeclared
    - promlinter
    - reassign
    - rowserrcheck
    - staticcheck
    - unconvert
    - unused
    - usetesting
    - wastedassign
    - whitespace
  settings:
    errcheck:
      check-type-assertions: true
    forbidigo:
      forbid:
        # Use private/pkg/thread.Parallelize
        - pattern: ^errgroup\.
        # Use buf.build/go/standard/xos/xexec
        - pattern: ^exec\.Cmd$
        - pattern: ^exec\.Command$
        - pattern: ^exec\.CommandContext$
        # os.Rename does not work across filesystem boundaries
        # See https://github.com/bufbuild/buf/issues/639
        - pattern: ^os\.Rename$
        # Use private/pkg/osext.Getwd
        - pattern: ^os\.Getwd$
        # Use private/pkg/osext.Chdir
        - pattern: ^os\.Chdir$
        # Ban debug statements
        - pattern: ^fmt\.Print
        - pattern: ^log\.
        - pattern: ^print$
        - pattern: ^println$
        # Use private/pkg/protoencoding Marshalers and Unmarshalers
        - pattern: ^(proto|prototext|protojson|protoyaml).Marshal$
        - pattern: ^(proto|prototext|protojson|protoyaml).Unmarshal$
        - pattern: ^(proto|prototext|protojson|protoyaml).MarshalOptions$
        - pattern: ^(proto|prototext|protojson|protoyaml).UnmarshalOptions$
        - pattern: ^proto\.Clone$
          msg: please use proto.CloneOf
    govet:
      enable:
        - nilness
    importas:
      alias:
        - pkg: github.com/bufbuild/buf/private/gen/proto/go/buf/alpha/image/v1
          alias: imagev1
        - pkg: github.com/bufbuild/buf/private/gen/proto/go/buf/alpha/module/v1
          alias: modulev1
        - pkg: github.com/bufbuild/buf/private/gen/proto/go/buf/alpha/registry/v1alpha1
          alias: registryv1alpha1
    nolintlint:
      require-explanation: true
      require-specific: true
      allow-unused: false
    usetesting:
      context-background: true
      context-todo: true
  exclusions:
    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:
      - linters:
          - staticcheck
        # No need to require embedded fields from selector expression, they could help with
        # more expressive code.
        text: "QF1008"
      - linters:
          - staticcheck
        # Whether or not to apply De Morgan's law is contextual and should be handled during
        # code review.
        text: "QF1001"
      - linters:
          - paralleltest
        # We use chdir in these tests.
        path: cmd/buf/workspace_subdir_test.go
        text: missing the call to method parallel
      - linters:
          - paralleltest
        # TestWorkspaceArchiveDir, TestWorkspaceWithInvalidArchivePathFail
        # and TestWorkspaceWithInvalidArchiveAbsolutePathFail cannot run in parallel
        # because they all call createZipFromDir on the same path, writing to the same file.
        path: cmd/buf/workspace_test.go
        text: missing the call to method parallel
      - linters:
          - paralleltest
        # This test shouldn't run in parallel as it needs osext.Getwd.
        path: cmd/buf/internal/command/config/configmigrate/configmigrate_test.go
        text: missing the call to method parallel
      - linters:
          - forbidigo
        # This is a legacy usage of os.Getwd we're not bothering to port yet.
        path: cmd/buf/internal/command/alpha/protoc/protoc_test.go
        text: os.Getwd
      - linters:
          - forbidigo
        # This is a legacy usage of os.Getwd we're not bothering to port yet.
        path: cmd/buf/internal/command/generate/generate_test.go
        text: os.Getwd
      - linters:
          - exhaustruct
        # We didn't turn on exhaustruct historically, but we really want to make sure it is turned on
        # for this file, as we do conversion between v1beta1 and v1 registry-proto types.
        path-except: private/bufpkg/bufmodule/bufmoduleapi/convert.go
      - linters:
          - gosec
        # G101 checks for hardcoded credentials, and the variables named "*Password*
        # trip this off.
        path: private/buf/bufcli/env.go
        text: "G101:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/file.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/diagnostic.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/image.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/server.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/symbol.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/semantic_tokens.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/cel.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/folding_range.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/completion.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/organize_imports.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/buf_yaml.go
        text: "G115:"
      - linters:
          - gosec
        # G115 checks for use of truncating conversions.
        path: private/buf/buflsp/buf_yaml_hover.go
        text: "G115:"
      - linters:
          - containedctx
        # Type must implement an interface whose methods do not accept context. But this
        # implementation makes RPC calls, which need a context. So we allow creator of the
        # type to provide a context at value creation (instead of using context.Background()).
        path: private/buf/bufcurl/reflection_resolver.go
      - linters:
          - gosec
        # We verify manually so that we can emit verbose output while doing so.
        path: private/buf/bufcurl/tls.go
        text: "G402:"
      - linters:
          - gosec
        # InsecureSkipVerify mirrors the value of the --insecure flag chosen by the user.
        path: cmd/buf/internal/command/curl/curl.go
        text: "G402:"
      - linters:
          - paralleltest
        # This test shouldn't run in parallel as it needs osext.Getwd.
        path: private/buf/buffetch/internal/reader_test.go
        text: missing the call to method parallel
      - linters:
          - paralleltest
        # Parallelizing TestPlainPostHandlerTLS and TestPlainPostHandlerH2C
        # makes this test flaky.
        path: private/buf/bufstudioagent/bufstudioagent_test.go
        text: missing the call to method parallel
      - linters:
          - gochecknoinits
        # we actually want to use init here
        path: private/bufpkg/bufconfig/module_config.go
      - linters:
          - gosec
        # We don't need a cryptographically secure RNG for these tests, and a
        # deterministic RNG is actually nice for test repeatability.
        path: private/bufpkg/bufimage/bufimageutil/.*_test\.go
        text: "G404:"
      - linters:
          - paralleltest
        # This test shouldn't run in parallel as it allocates a lot of memory.
        path: private/bufpkg/bufimage/build_image_unix_test.go
        text: missing the call to method parallel
      - linters:
          - containedctx
        # we actually want to embed a context here
        path: private/bufpkg/bufimage/module_file_resolver.go
      - linters:
          - containedctx
        # we actually want to embed a context here
        path: private/bufpkg/bufmodule/module.go
      - linters:
          - containedctx
        # we actually want to embed a context here
        path: private/bufpkg/bufmodule/module_set_builder.go
      - linters:
          - gochecknoinits
        # we actually want to use init here
        path: private/bufpkg/bufmodule/paths.go
      - linters:
          - gosec
        # We should be able to use net/http/cgi in a unit test, in addition the CVE mentions
        # only versions of go < 1.6.3 are affected.
        path: private/pkg/git/git_test.go
        text: "G504:"
      - linters:
          - forbidigo
        # We cache os.Getwd in osext, osext is the entrypoint.
        path: private/pkg/osext/osext.go
        text: os.Getwd
      - linters:
          - forbidigo
        # We cache os.Getwd in osext, osext has a Chdir that clears the cache.
        path: private/pkg/osext/osext.go
        text: os.Chdir
      - linters:
          - gochecknoinits
        # protoencoding calls detrand.Disable via go:linkname and and init function. See the comments
        # in the file for more details.
        path: private/pkg/protoencoding/detrand.go
      - linters:
          - forbidigo
        # we use os.Rename here to rename files in the same directory
        # This is safe (we aren't traversing filesystem boundaries).
        path: private/pkg/storage/storageos/bucket.go
        text: os.Rename
      - linters:
          - containedctx
        # connCtx is cancelled when the connection is done; the context lifetime is
        # tied to the struct, not passed per-call.
        path: private/buf/buflsp/buflsp.go
      - linters:
          - forbidigo
        # we actually want to use errgroup when starting an HTTP server
        path: private/pkg/transport/http/httpserver/httpserver.go
      - linters:
          - staticcheck
        text: "ST1005:"
      - linters:
          - staticcheck
        # This greatly simplifies creation of descriptors, and it's safe enough since
        # it's just test code.
        text: GetDeprecatedLegacyJsonFieldConflicts is deprecated
      - linters:
          - paralleltest
        # The LsModules tests call chdir and cannot be parallelized.
        path: cmd/buf/buf_test.go
        text: LsModules
      - linters:
          - gosec
        # G101 checks for hardcoded credentials, and the variables named "*Token*
        # trip this off.
        path: private/pkg/oauth2/device.go
        text: "G101:"
      # G115 checks for integer overflow from integer conversions. There are known false
      # positives from the check (https://github.com/securego/gosec/issues/1212) that are
      # actively being worked on. Each exemption below is a false positive or for a safe operation,
      # such as parsing indices from descriptors and/or images.
      - linters:
          - gosec
        # Loop index conversion to uint64.
        path: private/buf/bufgen/features.go
        text: "G115:"
      - linters:
          - gosec
        # Converting result from utf8.RuneCountInString to uint64.
        path: private/bufpkg/bufcheck/bufcheckserver/internal/buflintvalidate/field.go
        text: "G115:"
      - linters:
          - gosec
        # PluginReference revision is validated with a bounds check at construction time.
        path: private/bufpkg/bufremoteplugin/bufremoteplugin.go
        text: "G115:"
      - linters:
          - gosec
        # A bounds check has been added for int32 -> uint32 conversion this is being flagged
        # as a false positive.
        path: private/buf/bufcurl/reflection_resolver.go
        text: "G115:"
      - linters:
          - gosec
        # bufprotosource converts indices to int32 to form the source path. Since it is parsing
        # from the fileDescriptor set, the operation should be safe.
        path: private/bufpkg/bufprotosource/paths.go
        text: "G115:"
      - linters:
          - gosec
        # Bounds checks have been added with assertion statements to ensure safe int -> int32
        # conversions, this is a false positive.
        path: private/bufpkg/bufprotosource/option_extension_descriptor_test.go
        text: "G115:"
      - linters:
          - gosec
        # This converts results from strconv.ParseInt with the bit size set to 32 to int32,
        # so it should be a safe conversion, this is a false positive.
        path: private/buf/bufprotopluginexec/version.go
        text: "G115:"
      - linters:
          - gosec
        # This checks the cel constraints from an Image, and converts loop indices to int32
        # to set the source path for the location, this operation should be safe.
        path: private/bufpkg/bufcheck/bufcheckserver/internal/buflintvalidate/cel.go
        text: "G115:"
      # No obvious deprecated replacement.
      - linters:
          - staticcheck
        path: private/pkg/protoencoding/reparse_extensions_test.go
        text: "SA1019:"
      - linters:
          - staticcheck
        # We still need to strip the "weak" option from fields until it is fully deprecated
        path: private/pkg/protoencoding/strip_legacy_options.go
      # Allow marshal and unmarshal functions in protoencoding only
      - linters:
          - forbidigo
        path: private/pkg/protoencoding
        text: proto.Marshal
      - linters:
          - forbidigo
        path: private/pkg/protoencoding
        text: proto.Unmarshal
      - linters:
          - forbidigo
        path: private/pkg/protoencoding
        text: protojson.Marshal
      - linters:
          - forbidigo
        path: private/pkg/protoencoding
        text: protojson.Unmarshal
      - linters:
          - forbidigo
        path: private/pkg/protoencoding
        text: protoyaml.Marshal
      - linters:
          - forbidigo
        path: private/pkg/protoencoding
        text: protoyaml.Unmarshal
      - linters:
          - forbidigo
        path: private/pkg/protoencoding
        text: prototext.Marshal
      - linters:
          - forbidigo
        path: private/pkg/protoencoding
        text: prototext.Unmarshal
      - linters:
          - gosec
        # This checks the cel constraints for predefined rules from an Image, and converts loop indices to int32
        # to set the source path for the location, this operation should be safe.
        path: private/bufpkg/bufcheck/bufcheckserver/internal/buflintvalidate/predefined_rules.go
        text: "G115:"
      - linters:
          - gosec
        # This converts slice indexes in a FileDescriptorProto to int32,
        # which are not an actual risk of overflow.
        path: private/bufpkg/bufimage/bufimageutil/image_filter.go
        text: "G115:"
      - linters:
          - gosec
        # G115: int32->uint32 reinterpretation (same width, no data loss) passed
        # to binary.LittleEndian.PutUint32 to encode protobuf source path elements
        # as a byte-string map key. gosec flags same-width signed->unsigned casts.
        path: private/bufpkg/bufimage/bufimagemodify/internal/marksweeper.go
        text: "G115:"
      - linters:
          - gosec
        # G115: same int32->uint32 reinterpretation as marksweeper.go above.
        path: private/bufpkg/bufprotosource/location_store.go
        text: "G115:"
      - linters:
          - gosec
        # G115: uintptr->int conversion for passing a terminal file descriptor
        # to term.IsTerminal/term.ReadPassword, which require int. Safe on all
        # supported platforms; fd values fit in int.
        path: private/buf/bufcli/prompt.go
        text: "G115:"
      - linters:
          - gosec
        # G115: uintptr->int conversion to pass a writer's file descriptor to
        # term.IsTerminal. Safe on all supported platforms.
        path: private/pkg/slogapp/console.go
        text: "G115:"
      - linters:
          - gosec
        # G115: uintptr->int conversion for passing a terminal file descriptor
        # to term.IsTerminal, which requires int. Safe on all supported platforms;
        # fd values fit in int.
        path: private/buf/bufctl/controller.go
        text: "G115:"
      - linters:
          - gosec
        # G602: false positive — the loop index i is bounded by the length of
        # both slices, which are verified equal before the loop.
        path: private/bufpkg/bufimage/build_image_test.go
        text: "G602:"
      - linters:
          - gosec
        # G602: false positive — the loop index i is bounded by the length of
        # both slices, which are verified equal before the loop.
        path: private/pkg/slogapp/console_test.go
        text: "G602:"
      - linters:
          - gosec
        # G117: the Password field is intentionally marshaled — this struct
        # exists specifically to encode Docker registry credentials for the
        # X-Registry-Auth header.
        path: private/bufpkg/bufremoteplugin/bufremoteplugindocker/registry_auth_config.go
        text: "G117:"
      - linters:
          - gosec
        # G117: test for registry_auth_config.go; same reasoning as above.
        path: private/bufpkg/bufremoteplugin/bufremoteplugindocker/registry_auth_config_test.go
        text: "G117:"
      - linters:
          - gosec
        # G703: the filename comes from walking the filesystem with os.Stat,
        # not from user input, so path traversal is not a realistic risk here.
        path: private/pkg/licenseheader/cmd/license-header/main.go
        text: "G703:"

issues:
  max-same-issues: 0
formatters:
  enable:
    - gci
    - gofmt
  exclusions:
    generated: lax