gographgo/.golangci.yml at main · SkinnyPeteTheGiraffe/gographgo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
version: "2"

linters:
  # Start from a clean slate — explicitly opt in to what we want.
  default: none
  enable:
    # Correctness
    - errcheck       # unchecked errors
    - govet          # go vet checks (shadow, printf, composites, etc.)
    - staticcheck    # SA* / S* / ST* checks (go static analysis suite)
    - ineffassign    # assignments whose result is never used
    - unused         # exported identifiers that are never referenced

    # Style / maintainability
    - misspell       # common spelling mistakes in comments and strings
    - godot          # comments should end with a period
    - revive         # drop-in replacement for golint with more rules
    - gocritic       # opinionated but useful style checks

    # Safety
    - gosec          # security-sensitive patterns (G1xx–G7xx)
    - noctx          # HTTP requests without context.Context
    - bodyclose      # HTTP response bodies not closed

    # Complexity / hygiene
    - cyclop         # cyclomatic complexity
    - gocognit       # cognitive complexity
    - dupl           # near-duplicate code blocks
    - goconst        # repeated string literals that should be constants

  settings:
    errcheck:
      # Ignore errors returned by fmt.Print* — common in examples and tests.
      exclude-functions:
        - fmt.Print
        - fmt.Println
        - fmt.Printf
        - fmt.Fprint
        - fmt.Fprintln
        - fmt.Fprintf

    govet:
      enable-all: true
      disable:
        - shadow       # too noisy; err shadowing is idiomatic in Go

    staticcheck:
      checks:
        - "all"
        - "-ST1000"    # package comments — we follow Go stdlib style, not godoc strict
        - "-ST1020"    # exported functions need comments — too noisy during early dev

    revive:
      rules:
        - name: exported
          disabled: true # same as ST1020 — relax during early development
        - name: var-naming
          arguments: [["ID", "URL", "HTTP", "API", "SQL", "JSON", "RPC", "IO"]]
        - name: unused-parameter
          disabled: false
        - name: unreachable-code
          disabled: false
        - name: early-return
          disabled: false

    gocritic:
      enabled-tags:
        - diagnostic
        - style
        - performance
      disabled-checks:
        - hugeParam     # we rely on value semantics for state structs intentionally
        - rangeValCopy  # same reason

    cyclop:
      max-complexity: 15  # default 10 is tight for graph traversal logic

    gocognit:
      min-complexity: 20  # default 30; tighter for new code

    dupl:
      threshold: 120  # lines of code before flagging duplication

    goconst:
      min-len: 3
      min-occurrences: 4  # only flag strings repeated 4+ times

    godot:
      scope: declarations  # only check exported declaration comments
      period: true

    gosec:
      excludes:
        - G115   # integer overflow — too noisy for normal Go math
        - G304   # file path from variable — intentional in checkpoint backends

    misspell:
      locale: US

  exclusions:
    # Test files get a relaxed set — error checks, magic numbers, etc.
    rules:
      - path: "_test\\.go$"
        linters:
          - errcheck
          - goconst
          - gosec
          - dupl
          - gocognit
          - cyclop

      # Example files are for illustration — allow fmt.Print* and loose style.
      - path: "^examples/"
        linters:
          - errcheck
          - gocritic
          - revive

      # Internal packages are not part of the public API contract.
      - path: "^internal/"
        linters:
          - godot

      # Exclude well-known false-positive patterns.
      # G103/G104: use of unsafe and unhandled errors in defer — common in stdlib usage.
      - path: ".*\\.go$"
        text: "G103:"
      - path: ".*\\.go$"
        text: "Error return value of `.*\\.Close` is not checked"
      - path: ".*\\.go$"
        text: "Error return value of `.*\\.Flush` is not checked"

formatters:
  enable:
    - gofmt          # formatting (belt-and-suspenders alongside the fmt job)
    - goimports      # import grouping and formatting

  settings:
    goimports:
      local-prefixes:
        - github.com/SkinnyPeteTheGiraffe/gographgo

issues:
  # Don't limit the number of issues reported.
  max-issues-per-linter: 0
  max-same-issues: 0

run:
  timeout: 5m
  tests: true
  modules-download-mode: readonly