102 lines
2.2 KiB
YAML
102 lines
2.2 KiB
YAML
version: "2"
|
||
|
||
run:
|
||
timeout: 5m
|
||
tests: true
|
||
|
||
linters:
|
||
default: none
|
||
enable:
|
||
- bidichk
|
||
- bodyclose
|
||
- durationcheck
|
||
- errcheck
|
||
- errorlint
|
||
- gocritic
|
||
- gocyclo
|
||
- gosec
|
||
- govet
|
||
- ineffassign
|
||
- misspell
|
||
- nilerr
|
||
- noctx
|
||
- staticcheck
|
||
- unconvert
|
||
- unused
|
||
settings:
|
||
gocyclo:
|
||
min-complexity: 5
|
||
gosec:
|
||
# Full gosec rule set (G101–G6xx), including Slowloris checks G112/G114.
|
||
enable-all-rules: true
|
||
govet:
|
||
enable-all: true
|
||
exclusions:
|
||
paths:
|
||
- gen
|
||
rules:
|
||
# Noise / fixtures in tests and local tooling.
|
||
- path: _test\.go
|
||
linters:
|
||
- gosec
|
||
- path: scripts/
|
||
linters:
|
||
- gosec
|
||
- path: cmd/
|
||
linters:
|
||
- gosec
|
||
|
||
# OliveTin's purpose is controlled command execution from config.
|
||
- path: internal/executor/
|
||
text: "G204:"
|
||
linters:
|
||
- gosec
|
||
|
||
# Operator-configured filesystem paths (entity files, touch/write helpers, persisted logs).
|
||
- path: internal/entities/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/filehelper/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/configcheck/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/executor/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/auth/otjwt/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
- path: internal/httpservers/
|
||
text: "G304:"
|
||
linters:
|
||
- gosec
|
||
|
||
# Legacy GitHub webhook HMAC-SHA1 is still a supported authType.
|
||
- path: internal/webhooks/auth\.go
|
||
text: "G505:"
|
||
linters:
|
||
- gosec
|
||
|
||
# InsecureSkipVerify is an explicit OAuth2 provider config option.
|
||
- path: internal/auth/otoauth2/
|
||
text: "G402:"
|
||
linters:
|
||
- gosec
|
||
|
||
# Secure is set dynamically from TLS / ForceSecureCookies; gosec wants a literal true.
|
||
- text: "G124:"
|
||
linters:
|
||
- gosec
|
||
|
||
# Protobuf / process exit codes mapped into int32 fields.
|
||
- text: "G115:"
|
||
linters:
|
||
- gosec
|