.golangci.yml

# Options for analysis running.
run:
  timeout: 20m
  tests: true

  # Be as complete as possible when reporting issues
  max-issues-per-linter: 0
  max-same-issues: 0

  # If set we pass it to "go list -mod={option}". From "go help modules":
  # If invoked with -mod=readonly, the go command is disallowed from the implicit
  # automatic updating of go.mod described above. Instead, it fails when any changes
  # to go.mod are needed. This setting is most useful to check that go.mod does
  # not need updates, such as in a continuous integration and testing system.
  # If invoked with -mod=vendor, the go command assumes that the vendor
  # directory holds the correct copies of dependencies and ignores
  # the dependency descriptions in go.mod.
  #
  # Allowed values: readonly|vendor|mod
  # By default, it isn't set.
  modules-download-mode: readonly

  # Allow multiple parallel golangci-lint instances running.
  # If false (default) - golangci-lint acquires file lock on start.
  allow-parallel-runners: false

# This configures the release linters at tyk.
#
# The guideline is simple: keep linters you want to track in release
# code. This includes any quality gates or refactors that apply to
# testing code, including updating practices with new Go releases.

# Tag linters with: testing, dev, or message with reason.
linters:
  disable:
    - varnamelen # disabled, opinionated on anarchy with variable names
    - tagliatelle # disabled, no naming double checks
    - testpackage # testing/dev (structural lint, unconfigured!)
    - paralleltest # testing
    - thelper # testing
    - ireturn # dev
    - goimports # using goimports-revive (`task -l`: fmt, lint, lint:imports targets)
    - misspell # dev
    - noctx # dev
    - unused # dev
    - dupl # dev
  enable:
    - forbidigo # debt: measure API leaks / dev: extend the list
    - govet # debt: don't want these defects in product
    - gochecknoinits # same, but exclusions apply for tests
    - errcheck # debt: measure checking errors
    - errorlint # debt: measure error handling improvements
    - nilerr # debt: measure code that returns nil on non-nil error
    - revive # keep - measured for stats, shows code smells

linters-settings:
  fobidigo:
    forbid:
      - p: ^fmt\.Print.*$
        msg: Do not commit print statements, use t.Log or Logrus.
      - p: ^net\/http\.(Get|Head|Post|Form).*$
        msg: Do not use top level http package functions, NewRequestWithContext is encouraged.
    exclude-godoc-examples: false
    analyze-types: true

  revive:
    ignore-generated-header: true
    severity: error
    enable-all-rules: false
    rules:
      - name: unused-parameter
        disabled: false
        arguments:
          - allowRegex: "^_"
      - name: import-shadowing
        disabled: false
      - name: exported
        disabled: false

  govet:
    enable-all: true
    disable:
      - fieldalignment
      - shadow

  errcheck:
    check-type-assertions: true
    check-blank: true
    exclude-functions:
      - (*github.com/TykTechnologies/tyk/gateway.Test).Run
      - time.Parse
      - strconv.ParseBool
      - strconv.ParseInt

issues:
  max-issues-per-linter: 0
  max-same-issues: 0
  exclude-generated: strict
  exclude-files:
    - ".*\\.pb\\.go$"
    - ".*/mock/.+\\.go$"
    - ".*/bindata.go$"
  exclude-dirs:
    - ci
    - bin
    - webclient
    - portal
  # The `exclude-rules` configuration below configures
  # more particular exclusion rules, mostly aimed at tests
  # or some structurally known areas like testutil and test
  # folders which are not part of product packages.
  #
  # Development doesn't carry these exclusions, as we have
  # testing concerns that are being excluded here.
  exclude-rules:
    # cli package uses fmt.Print by design
    - path: ^cli/
      linters:
        - forbidigo
    # we don't want to silence test, but we want to silence
    # some known issues in them which rank lower than product.
    # generally no test code impacts the quality of product
    # code, if the test is deleted. Whatever test metrics we
    # measure are to our benefit.
    - path: (^test/|^tests/|/testutil.go|_test\.go)
      linters:
        - errcheck
      text: "error return value of `[^`]+` is not checked" # unsafe typecasts are common
    - path: (^test/|^tests/|/testutil.go|_test\.go)
      linters:
        - errcheck
      text: "Error return value is not checked"
    - path: _test\.go
      linters:
        - dupl # many functions looks like dupes
        - gocyclo # many functions can be very long
        - funlen # many functions can be very long
        - gosec # tests don't have CVEs
  exclude:
    - G404    # Use of weak random number generator (math/rand instead of crypto/rand)
    - SA9004  # only the first constant in this group has an explicit type
    - SA1019  # Warning on deprecated imports (stdlib ioutil, grpc import)
    - SA1029  # should not use built-in type string as key for value; define your own type to avoid collision