.golangci.yaml

version: "2"

run:
  timeout: 10m
  allow-parallel-runners: true

linters:
  default: none
  enable:
    - asasalint
    - asciicheck
    - bidichk
    - bodyclose
    - canonicalheader
    - contextcheck
    - copyloopvar
    - decorder
    - dupword    
    - errcheck
    - errchkjson
    - errname
    - errorlint
    - fatcontext
    - forbidigo
    - forcetypeassert
    - funcorder
    - gocheckcompilerdirectives
    - goconst
    - gocritic
    - godot
    - goheader
    - goprintffuncname
    - gosec
    - gosmopolitan
    - govet
    - grouper
    - iface
    - importas
    - intrange
    - makezero
    - misspell
    - musttag
    - nakedret
    - nestif
    - nilerr
    - nosprintfhostport
    - prealloc
    - predeclared
    - reassign
    - recvcheck
    - staticcheck
    - tagalign
    - unconvert
    - unparam
    - unused
    - wastedassign
    - whitespace
    - wrapcheck
  disable:
    # depguard has configuration issues in golangci-lint v2 - see https://github.com/golangci/golangci-lint/issues/3906
    - depguard
    # Below linters will be enabled once the issues reported by enabled linters are fixed.
    - dupl
    - cyclop
    - gocyclo
    - gocognit
    - err113
    - revive
    - maintidx
    - mnd
    # Below linters will be enabled when the golangci-lint is upgraded to the version supporting these.
    #- embeddedstructfieldcheck
    #- godoclint
    #- iotamixing
    #- modernize
    
  exclusions:
    # Mode of the generated files analysis.
    #
    # - `strict`: sources are excluded by strictly following the Go generated file convention.
    #    Source files that have lines matching only the following regular expression will be excluded: `^// Code generated .* DO NOT EDIT\.$`
    #    This line must appear before the first non-comment, non-blank text in the file.
    #    https://go.dev/s/generatedcode
    # - `lax`: sources are excluded if they contain lines like `autogenerated file`, `code generated`, `do not edit`, etc.
    # - `disable`: disable the generated files exclusion.
    #
    # Default: strict
    generated: lax
    # Log a warning if an exclusion rule is unused.
    # Default: false
    warn-unused: true
    # Predefined exclusion rules.
    # Default: []
    presets:
      - comments
      - std-error-handling
      - common-false-positives
      - legacy
    # Excluding configuration per-path, per-linter, per-text and per-source.
    rules:
      # Exclude some linters from running on tests files.
      - path: _test\.go
        linters:
          - gocyclo
          - errcheck
          - dupl
          - gosec
          - wrapcheck
          - mnd
          - forcetypeassert
          - goconst
          - gocritic
      # Run some linter only for test files by excluding its issues for everything else.
      - path-except: _test\.go
        linters:
          - forbidigo
      - path: pkg/operators
        linters:
          - all
      # Exclude hack directory from some linters
      - path: hack/
        linters:
          - prealloc
          - recvcheck
      # Exclude operator-sdk annotations from godot
      - text: "^\\+operator-sdk:"
        linters:
          - godot
      - text: "^\\+kubebuilder:"
        linters:
          - godot
      # Exclude false positive hardcoded credential warnings (these are paths, not credentials)
      - path: pkg/controller/deployment/credentials_request.go
        text: "gcpCredentialsDir|cloudCredentialsVolumeName"
        linters:
          - gosec
      - path: pkg/controller/deployment/deployment_overrides.go
        text: "boundSATokenDir"
        linters:
          - gosec
      # Exclude wrapcheck for controller-runtime builder (already configured but adding explicit exclusion)
      - path: pkg/controller/.*_controller.go
        text: "NewControllerManagedBy|Complete"
        linters:
          - wrapcheck
      # Exclude staticcheck rules that are too strict
      - linters:
          - staticcheck
        text: "S1009|SA4006|SA4031"
      # Exclude unparam for functions that may be part of interfaces
      - linters:
          - unparam
        path: pkg/controller/deployment/
  settings:
    wrapcheck:
      # Ignore errors returned from these packages - they are either internal or
      # the error context is already sufficient
      extra-ignore-sigs:
        # Kubernetes client factory functions
        - ".NewForConfig("
        # Kubernetes client methods
        - ".Get("
        - ".Create("
        - ".Update("
        - ".Delete("
        - ".Patch("
        - ".Lister()."
        # Standard library functions
        - "json.Unmarshal"
        - "cache.New"
        - ".Set("
        - ".Start("
      ignore-sig-regexps:
        # Ignore all functions from our own operator package
        - "github\\.com/openshift/cert-manager-operator/.*"
        # Ignore controller-runtime builder functions
        - "sigs\\.k8s\\.io/controller-runtime/pkg/builder\\..*"
      ignore-interface-regexps:
        # Ignore common Kubernetes client interfaces where wrapping adds no value
        - "sigs\\.k8s\\.io/controller-runtime/pkg/client\\..*"
        - "k8s\\.io/client-go/listers/.*"
        - "k8s\\.io/client-go/discovery\\..*"
        - "github\\.com/openshift/client-go/config/listers/.*"
        - "github\\.com/openshift/cert-manager-operator/pkg/operator/listers/.*"
        - "github\\.com/openshift/cert-manager-operator/pkg/operator/clientset/.*"
        - "sigs\\.k8s\\.io/controller-runtime/pkg/manager\\..*"
        - "k8s\\.io/component-base/featuregate\\..*"
      ignore-package-globs:
        # Ignore errors from these packages where context is already clear
        - "encoding/json"
        - "k8s.io/client-go/**"
        - "k8s.io/apiextensions-apiserver/**"
        - "github.com/openshift/client-go/**"
        - "github.com/openshift/cert-manager-operator/**"
        - "sigs.k8s.io/controller-runtime/**"
      report-internal-errors: false
    godot:
      # Comments to be checked: `declarations`, `toplevel`, or `all`.
      scope: declarations
      # List of regexps for excluding particular comment lines from check.
      exclude:
        # Exclude kubebuilder/operator-sdk annotations
        - ".*\\+operator-sdk:"
        - ".*\\+kubebuilder:"
        - ".*\\+k8s:"
        - ".*\\+genclient"
        - ".*\\+optional"
        - ".*\\+required"
        # Exclude comments that are part of type definitions with annotations
        - ".* is the Schema for"
    gosec:
      excludes:
        - G101  # False positives for hardcoded credentials (these are directory/volume paths)
    nestif:
      # Minimal complexity to report - increase to reduce noise
      min-complexity: 9
    gocritic:
      disabled-checks:
        - appendAssign  # Allow append to new variable for clarity
        - singleCaseSwitch  # Allow single-case switches for future extensibility
        - unlambda  # Allow wrapping function calls
        - typeSwitchVar  # Allow type switch without assignment
    staticcheck:
      checks:
        - "all"
        - "-SA4006"  # Disable "value is never used" - often intentional in hooks
        - "-SA4031"  # Disable "nil check is always true/false" - defensive coding
    unparam:
      # Don't check exported functions - they may be part of an interface
      check-exported: false

formatters:
  settings:
    gci:
      # Section configuration to compare against.
      # Section names are case-insensitive and may contain parameters in ().
      # The default order of sections is `standard > default > custom > blank > dot > alias > localmodule`.
      # If `custom-order` is `true`, it follows the order of `sections` option.
      # Default: ["standard", "default"]
      sections:
        - standard # Standard section: captures all standard packages.
        - default # Default section: contains all imports that could not be matched to another section type.
        - prefix(github.com/openshift/cert-manager-operator) # Custom section: groups all imports with the specified Prefix.
        - blank # Blank section: contains all blank imports. This section is not present unless explicitly enabled.
        - dot # Dot section: contains all dot imports. This section is not present unless explicitly enabled.
        - alias # Alias section: contains all alias imports. This section is not present unless explicitly enabled.
        - localmodule # Local module section: contains all local packages. This section is not present unless explicitly enabled.
      # Checks that no inline comments are present.
      # Default: false
      no-inline-comments: true
      # Checks that no prefix comments (comment lines above an import) are present.
      # Default: false
      no-prefix-comments: true
      # Enable custom order of sections.
      # If `true`, make the section order the same as the order of `sections`.
      # Default: false
      custom-order: true
      # Drops lexical ordering for custom sections.
      # Default: false
      no-lex-order: true
    gofmt:
      # Simplify code: gofmt with `-s` option.
      # Default: true
      simplify: false
      # Apply the rewrite rules to the source before reformatting.
      # https://pkg.go.dev/cmd/gofmt
      # Default: []
      rewrite-rules:
        - pattern: 'interface{}'
          replacement: 'any'
        - pattern: 'a[b:len(a)]'
          replacement: 'a[b:]'
    gofumpt:
      # Module path which contains the source code being formatted.
      # Default: ""
      module-path: github.com/openshift/cert-manager-operator
      # Choose whether to use the extra rules.
      # Default: false
      extra-rules: true
    goimports:
      # A list of prefixes, which, if set, checks import paths
      # with the given prefixes are grouped after 3rd-party packages.
      # Default: []
      local-prefixes:
        - github.com/openshift/cert-manager-operator
    golines:
      # Target maximum line length.
      # Default: 100
      max-len: 200
      # Length of a tabulation.
      # Default: 4
      tab-len: 8
      # Shorten single-line comments.
      # Default: false
      shorten-comments: true
      # Default: true
      reformat-tags: false
      # Split chained methods on the dots as opposed to the arguments.
      # Default: true
      chain-split-dots: false