zitadel

1
issues:
2
  new-from-rev: main
3
  # Set to 0 to disable.
4
  max-issues-per-linter: 0
5
  # Set to 0 to disable.
6
  max-same-issues: 0
7

8
run:
9
  concurrency: 4
10
  timeout: 10m
11
  go: '1.22'
12
  skip-dirs:
13
    - .artifacts
14
    - .backups
15
    - .codecov
16
    - .github
17
    - .keys
18
    - .vscode
19
    - build
20
    - console
21
    - deploy
22
    - docs
23
    - guides
24
    - internal/api/ui/login/static
25
    - openapi
26
    - proto
27
    - tools
28
linters:
29
  enable:
30
    # Simple linter to check that your code does not contain non-ASCII identifiers [fast: true, auto-fix: false]
31
    - asciicheck
32
    # checks whether HTTP response body is closed successfully [fast: false, auto-fix: false]
33
    - bodyclose
34
    # check the function whether use a non-inherited context [fast: false, auto-fix: false]
35
    - contextcheck
36
    # Computes and checks the cognitive complexity of functions [fast: true, auto-fix: false]
37
    - gocognit
38
    # Checks Go code for unused constants, variables, functions and types [fast: false, auto-fix: false]
39
    - unused
40
    # Errcheck is a program for checking for unchecked errors in go programs. These unchecked errors can be critical bugs in some cases [fast: false, auto-fix: false]
41
    - errcheck
42
    # Checks that sentinel errors are prefixed with the `Err` and error types are suffixed with the `Error`. [fast: false, auto-fix: false]
43
    - errname
44
    # errorlint is a linter for that can be used to find code that will cause problems with the error wrapping scheme introduced in Go 1.13. [fast: false, auto-fix: false]
45
    - errorlint
46
    # check exhaustiveness of enum switch statements [fast: false, auto-fix: false]
47
    - exhaustive
48
    # Gci controls golang package import order and makes it always deterministic. [fast: true, auto-fix: false]
49
    - gci
50
    # Provides diagnostics that check for bugs, performance and style issues. [fast: false, auto-fix: false]
51
    - gocritic
52
    # Linter for Go source code that specializes in simplifying a code [fast: false, auto-fix: false]
53
    - gosimple
54
    # Vet examines Go source code and reports suspicious constructs, such as Printf calls whose arguments do not align with the format string [fast: false, auto-fix: false]
55
    - govet
56
    # Detects when assignments to existing variables are not used [fast: true, auto-fix: false]
57
    - ineffassign
58
    # Finds commonly misspelled English words in comments [fast: true, auto-fix: true]
59
    - misspell
60
    # Finds naked returns in functions greater than a specified function length [fast: true, auto-fix: false]
61
    - nakedret
62
    # Staticcheck is a go vet on steroids, applying a ton of static analysis checks [fast: false, auto-fix: false]
63
    - staticcheck
64
    # Like the front-end of a Go compiler, parses and type-checks Go code [fast: false, auto-fix: false]
65
    - typecheck
66
    # Reports ill-formed or insufficient nolint directives [fast: true, auto-fix: false]
67
    - nolintlint
68
    # Checks for misuse of Sprintf to construct a host with port in a URL.
69
    - nosprintfhostport
70
    # checks whether Err of rows is checked successfully in `sql.Rows` [fast: false, auto-fix: false]
71
    - rowserrcheck
72
    # Checks that sql.Rows and sql.Stmt are closed. [fast: false, auto-fix: false]
73
    - sqlclosecheck
74
    # Remove unnecessary type conversions [fast: false, auto-fix: false]
75
    - unconvert
76
  disable:
77
    # Checks for dangerous unicode character sequences [fast: true, auto-fix: false]
78
    # not needed because github does that out of the box
79
    - bidichk
80
    # containedctx is a linter that detects struct contained context.Context field [fast: true, auto-fix: false]
81
    # using contextcheck which looks more active
82
    - containedctx
83
    # checks function and package cyclomatic complexity [fast: false, auto-fix: false]
84
    # not use because gocognit is used
85
    - cyclop
86
    # The owner seems to have abandoned the linter. Replaced by unused.
87
    # deprecated, replaced by unused
88
    - deadcode
89
    # check declaration order and count of types, constants, variables and functions [fast: true, auto-fix: false]
90
    # FUTURE: IMO it sometimes makes sense to declare consts or types after a func
91
    - decorder
92
    # Go linter that checks if package imports are in a list of acceptable packages [fast: false, auto-fix: false]
93
    # not required because of dependabot
94
    - depguard
95
    # Checks assignments with too many blank identifiers (e.g. x, _, _, _, := f()) [fast: true, auto-fix: false]
96
    # FUTURE: old code is not compatible
97
    - dogsled
98
    # Tool for code clone detection [fast: true, auto-fix: false]
99
    # FUTURE: old code is not compatible
100
    - dupl
101
    # checks for duplicate words in the source code
102
    # not sure if it makes sense
103
    - dupword
104
    # check for two durations multiplied together [fast: false, auto-fix: false]
105
    # FUTURE: checks for accident `1 * time.Second * time.Second`
106
    - durationcheck
107
    # Checks types passed to the json encoding functions. Reports unsupported types and optionally reports occations, where the check for the returned error can be omitted. [fast: false, auto-fix: false]
108
    # FUTURE: use asap, because we use json alot. nice feature is possiblity to check if err check is required
109
    - errchkjson
110
    # execinquery is a linter about query string checker in Query function which reads your Go src files and warning it finds
111
    # FUTURE: might find some errors in sql queries
112
    - execinquery
113
    # Checks if all struct's fields are initialized [fast: false, auto-fix: false]
114
    # deprecated
115
    - exhaustivestruct
116
    # Checks if all structure fields are initialized
117
    # Not all fields have to be initialized
118
    - exhaustruct
119
    # checks for pointers to enclosing loop variables [fast: false, auto-fix: false]
120
    # FUTURE: finds bugs hard to find, could occur much later
121
    - exportloopref
122
    # Forbids identifiers [fast: true, auto-fix: false]
123
    # see no reason. allows to define regexp which are not allowed to use
124
    - forbidigo
125
    # finds forced type assertions [fast: true, auto-fix: false]
126
    # not used because we mostly use `_, _ = a.(int)` 
127
    - forcetypeassert
128
    # Tool for detection of long functions [fast: true, auto-fix: false]
129
    # not used because it ignores complexity
130
    - funlen
131
    # check that no global variables exist [fast: true, auto-fix: false]
132
    # We use some global variables which is ok IMO
133
    - gochecknoglobals
134
    # Checks that no init functions are present in Go code [fast: true, auto-fix: false]
135
    # we use inits for the database abstraction
136
    - gochecknoinits
137
    # Finds repeated strings that could be replaced by a constant [fast: true, auto-fix: false]
138
    # FUTURE: might be cool to check
139
    - goconst
140
    # Computes and checks the cyclomatic complexity of functions [fast: true, auto-fix: false]
141
    # not used because cyclop also checks complexity of package
142
    - gocyclo
143
    # Check if comments end in a period [fast: true, auto-fix: true]
144
    # FUTURE: checks if comments are written as specified
145
    - godot
146
    # Tool for detection of FIXME, TODO and other comment keywords [fast: true, auto-fix: false]
147
    # FUTURE: maybe makes sense later. IMO some view todos are ok for later tasks.
148
    - godox
149
    # Golang linter to check the errors handling expressions [fast: false, auto-fix: false]
150
    # Not used in favore of errorlint
151
    - goerr113
152
    # Gofmt checks whether code was gofmt-ed. By default this tool runs with -s option to check for code simplification [fast: true, auto-fix: true]
153
    # ignored in favor of goimports
154
    - gofmt
155
    # Gofumpt checks whether code was gofumpt-ed. [fast: true, auto-fix: true]
156
    # ignored in favor of goimports
157
    - gofumpt
158
    # Checks is file header matches to pattern [fast: true, auto-fix: false]
159
    # ignored because we don't write licenses as headers
160
    - goheader
161
    # In addition to fixing imports, goimports also formats your code in the same style as gofmt. [fast: true, auto-fix: true]
162
    # ignored in favor of gci
163
    - goimports
164
    #deprecated]: Golint differs from gofmt. Gofmt reformats Go source code, whereas golint prints out style mistakes [fast: false, auto-fix: false]
165
    # ignored in favor of goimports
166
    - golint
167
    # An analyzer to detect magic numbers. [fast: true, auto-fix: false]
168
    # FUTURE: not that critical at the moment
169
    - gomnd
170
    # Manage the use of 'replace', 'retract', and 'excludes' directives in go.mod. [fast: true, auto-fix: false]
171
    # FUTURE: not a problem at the moment
172
    - gomoddirectives
173
    # Allow and block list linter for direct Go module dependencies. This is different from depguard where there are different block types for example version constraints and module recommendations. [fast: true, auto-fix: false]
174
    # FUTURE: maybe interesting because of licenses
175
    - gomodguard
176
    # Checks that printf-like functions are named with `f` at the end [fast: true, auto-fix: false]
177
    # FUTURE: not a problem at the moment
178
    - goprintffuncname
179
    # Inspects source code for security problems [fast: false, auto-fix: false]
180
    # TODO: I think it would be more interesting to integrate into gh code scanning: https://github.com/securego/gosec#integrating-with-code-scanning
181
    - gosec
182
    # An analyzer to analyze expression groups. [fast: true, auto-fix: false]
183
    # I think the groups (vars, consts, imports, ...) we have atm are ok
184
    - grouper
185
    # Checks that your code uses short syntax for if-statements whenever possible [fast: true, auto-fix: false]
186
    # Dont't use its deprecated
187
    - ifshort
188
    # Enforces consistent import aliases [fast: false, auto-fix: false]
189
    # FUTURE: aliasing of imports is more or less consistent
190
    - importas
191
    # A linter that checks the number of methods inside an interface.
192
    # No need at the moment, repository abstraction was removed
193
    - interfacebloat
194
    # A linter that suggests interface types
195
    # Don't use it's archived
196
    - interfacer
197
    # Accept Interfaces, Return Concrete Types [fast: false, auto-fix: false]
198
    # FUTURE: check if no interface is returned
199
    - ireturn
200
    # Reports long lines [fast: true, auto-fix: false]
201
    # FUTURE: would make code more readable
202
    - lll
203
    # Checks key valur pairs for common logger libraries (kitlog,klog,logr,zap).
204
    # FUTURE: useable as soon as we switch logger library
205
    - loggercheck
206
    # maintidx measures the maintainability index of each function. [fast: true, auto-fix: false]
207
    # not used because volume of halstead complexity feels strange as measurement https://en.wikipedia.org/wiki/Halstead_complexity_measures
208
    - maintidx
209
    # Finds slice declarations with non-zero initial length [fast: false, auto-fix: false]
210
    # I would prefer to use https://github.com/alexkohler/prealloc
211
    - makezero
212
    # Reports deeply nested if statements [fast: true, auto-fix: false]
213
    # focus only on if's
214
    - nestif
215
    # Finds the code that returns nil even if it checks that the error is not nil. [fast: false, auto-fix: false]
216
    # FUTURE: check if it is allowed to return nil partially in error catch
217
    - nilerr
218
    # Checks that there is no simultaneous return of `nil` error and an invalid value. [fast: false, auto-fix: false]
219
    # FUTURE: would reduce checks and panics
220
    - nilnil
221
    # nlreturn checks for a new line before return and branch statements to increase code clarity [fast: true, auto-fix: false]
222
    # DISCUSS: IMO the readability of does not always increase using more empty lines
223
    - nlreturn
224
    # noctx finds sending http request without context.Context [fast: false, auto-fix: false]
225
    # only interesting if using http
226
    - noctx
227
    # Reports all names returns
228
    # Named returns are not allowed which IMO reduces readability of code
229
    - nonamedreturns
230
    # detects snake case of variable naming and function name.
231
    # has not been a problem in our code and deprecated
232
    - nosnakecase
233
    # paralleltest detects missing usage of t.Parallel() method in your Go test [fast: true, auto-fix: false]
234
    # FUTURE: will break all of our tests
235
    - paralleltest
236
    # Finds slice declarations that could potentially be preallocated [fast: true, auto-fix: false]
237
    # FUTURE: would improve performance
238
    - prealloc
239
    # find code that shadows one of Go's predeclared identifiers [fast: true, auto-fix: false]
240
    # FUTURE: checks for overwrites
241
    - predeclared
242
    # Check Prometheus metrics naming via promlint [fast: true, auto-fix: false]
243
    # Not interesting at the moment
244
    - promlinter
245
    # Checks that package variables are not reassigned
246
    # FUTURE: checks if vars like Err's are reassigned which might break code
247
    - reassign
248
    # Fast, configurable, extensible, flexible, and beautiful linter for Go. Drop-in replacement of golint. [fast: false, auto-fix: false]
249
    # Linter aggregator, would allow to use less other linters
250
    - revive
251
    # checks for unpinned variables in go programs
252
    # deprecated
253
    - scopelint
254
    # Finds unused struct fields [fast: false, auto-fix: false]
255
    # deprecated, replaced by unused
256
    - structcheck
257
    # Stylecheck is a replacement for golint [fast: false, auto-fix: false]
258
    # we use goimports
259
    - stylecheck
260
    # Checks the struct tags. [fast: true, auto-fix: false]
261
    # FUTURE: would help for new structs
262
    - tagliatelle
263
    # tenv is analyzer that detects using os.Setenv instead of t.Setenv since Go1.17 [fast: false, auto-fix: false]
264
    # FUTURE: currently are no env vars set
265
    - tenv
266
    # linter checks if examples are testable (have an expected output)
267
    # FUTURE: as soon as examples are added
268
    - testableexamples
269
    # linter that makes you use a separate _test package [fast: true, auto-fix: false]
270
    # don't use because we test some unexported functions
271
    - testpackage
272
    # thelper detects golang test helpers without t.Helper() call and checks the consistency of test helpers [fast: false, auto-fix: false]
273
    # FUTURE: nice to improve test quality
274
    - thelper
275
    # tparallel detects inappropriate usage of t.Parallel() method in your Go test codes [fast: false, auto-fix: false]
276
    # FUTURE: nice to improve test quality
277
    - tparallel
278
    # Reports unused function parameters [fast: false, auto-fix: false]
279
    # DISCUSS: nice idea and would improve code quality, but how to handle false positives?
280
    - unparam
281
    # A linter that detect the possibility to use variables/constants from the Go standard library.
282
    # FUTURE: improves code quality
283
    - usestdlibvars
284
    # Finds unused global variables and constants [fast: false, auto-fix: false]
285
    # deprecated, replaced by unused
286
    - varcheck
287
    # checks that the length of a variable's name matches its scope [fast: false, auto-fix: false]
288
    # I would not use it because it more or less checks if var lenght matches
289
    - varnamelen
290
    # wastedassign finds wasted assignment statements. [fast: false, auto-fix: false]
291
    # FUTURE: would improve code quality (maybe already checked by vet?)
292
    - wastedassign
293
    # Tool for detection of leading and trailing whitespace [fast: true, auto-fix: true]
294
    # Not sure if it improves code readability
295
    - whitespace
296
    # Checks that errors returned from external packages are wrapped [fast: false, auto-fix: false]
297
    # FUTURE: improves UX because all the errors will be ZITADEL errors
298
    - wrapcheck
299
    # Whitespace Linter - Forces you to use empty lines! [fast: true, auto-fix: false]
300
    # FUTURE: improves code quality by allowing and blocking line breaks
301
    - wsl
302
linters-settings:
303
  gci:
304
    sections:
305
      - standard # Standard section: captures all standard packages.
306
      - default # Default section: contains all imports that could not be matched to another section type.
307
      - prefix(github.com/zitadel/zitadel) # Custom section: groups all imports with the specified Prefix.
308
    custom-order: true
309