145 lines
3.3 KiB
YAML
145 lines
3.3 KiB
YAML
version: "2"
|
||
|
||
run:
|
||
timeout: 5m
|
||
tests: true
|
||
|
||
linters:
|
||
default: none
|
||
enable:
|
||
- bidichk
|
||
- bodyclose
|
||
- copyloopvar
|
||
- durationcheck
|
||
- errcheck
|
||
- errorlint
|
||
- gocritic
|
||
- gocyclo
|
||
- gosec
|
||
- govet
|
||
- ineffassign
|
||
- misspell
|
||
# - modernize
|
||
- nilerr
|
||
- noctx
|
||
# - promlinter
|
||
- staticcheck
|
||
# - testifylint
|
||
- thelper
|
||
- unconvert
|
||
# - unparam
|
||
- unused
|
||
- usestdlibvars
|
||
settings:
|
||
gocyclo:
|
||
min-complexity: 5
|
||
gosec:
|
||
# Full gosec rule set (G101–G6xx), including Slowloris checks G112/G114.
|
||
enable-all-rules: true
|
||
govet:
|
||
enable-all: true
|
||
exclusions:
|
||
paths:
|
||
- gen
|
||
rules:
|
||
# Noise / fixtures in tests and local tooling.
|
||
- path: _test\.go
|
||
linters:
|
||
- gosec
|
||
- path: _test\.go
|
||
text: "fieldalignment:"
|
||
linters:
|
||
- govet
|
||
- path: scripts/
|
||
linters:
|
||
- gosec
|
||
# Local config-tool CLI: operator-supplied path and 0644 config backups.
|
||
- path: cmd/config-tool/main\.go
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: cmd/config-tool/main\.go
|
||
text: "G306:"
|
||
linters:
|
||
- gosec
|
||
- path: cmd/config-tool/main\.go
|
||
text: "G703:"
|
||
linters:
|
||
- gosec
|
||
|
||
# OliveTin's purpose is controlled command execution from config.
|
||
- path: internal/executor/
|
||
text: "G204:"
|
||
linters:
|
||
- gosec
|
||
|
||
# Operator-configured filesystem paths (entity files, touch/write helpers, persisted logs).
|
||
- path: internal/entities/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/filehelper/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/configcheck/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/executor/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/auth/otjwt/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/httpservers/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
|
||
# Legacy GitHub webhook HMAC-SHA1 is still a supported authType.
|
||
- path: internal/webhooks/auth\.go
|
||
text: "G505:"
|
||
linters:
|
||
- gosec
|
||
|
||
# InsecureSkipVerify is an explicit OAuth2 provider config option.
|
||
- path: internal/auth/otoauth2/
|
||
text: "G402:"
|
||
linters:
|
||
- gosec
|
||
|
||
# Secure is set dynamically from TLS / ForceSecureCookies; gosec wants a literal true.
|
||
- path: internal/api/api\.go
|
||
text: "G124:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/auth/otoauth2/
|
||
text: "G124:"
|
||
linters:
|
||
- gosec
|
||
|
||
# Protobuf / process exit codes and collection sizes mapped into int32 fields.
|
||
- path: internal/api/apiActions\.go
|
||
text: "G115:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/api/api_entities_list\.go
|
||
text: "G115:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/api/api_queue\.go
|
||
text: "G115:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/api/config_issues\.go
|
||
text: "G115:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/executor/executor\.go
|
||
text: "G115:"
|
||
linters:
|
||
- gosec
|