| 1 | version: "2" |
| 2 | |
| 3 | linters: |
| 4 | enable: |
| 5 | - copyloopvar |
| 6 | - errcheck |
| 7 | - errorlint |
| 8 | - govet |
| 9 | - ineffassign |
| 10 | - intrange |
| 11 | - modernize |
| 12 | - staticcheck |
| 13 | - unused |
| 14 | - usestdlibvars |
| 15 | settings: |
| 16 | modernize: |
| 17 | # omitempty -> omitzero changes which fields are written for nested |
| 18 | # structs. That is a wire-format change to session files and the |
| 19 | # extension protocol, not a refactor, so it lands on its own. |
| 20 | disable: |
| 21 | - omitzero |
| 22 | # Go 1.26 makes these suggestions available, but adopting them would |
| 23 | # rewrite unrelated production and test code across the repository. |
| 24 | # Keep the security-only module upgrade focused and revisit these in |
| 25 | # a dedicated modernization change. |
| 26 | - newexpr |
| 27 | - stditerators |
| 28 | errcheck: |
| 29 | check-type-assertions: false |
| 30 | exclude-functions: |
| 31 | - (*os.File).Close |
| 32 | - (io.Closer).Close |
| 33 | - (*net/http.Response).Body.Close |
| 34 | - golang.org/x/term.Restore |
| 35 | # Win32: CloseHandle in a defer mirrors the Close exclusions above, and |
| 36 | # LazyProc.Call always returns a non-nil errno — the caller reads r1. |
| 37 | - golang.org/x/sys/windows.CloseHandle |
| 38 | - (*syscall.LazyProc).Call |
| 39 | - (*golang.org/x/sys/windows.LazyProc).Call |
| 40 | staticcheck: |
| 41 | checks: |
| 42 | - all |
| 43 | - -ST1005 # error strings ending with punctuation — too strict for initial adoption |
| 44 | - -ST1018 # Unicode format characters — intentional in TUI code |
| 45 | - -QF1001 # De Morgan's law — readability preference |
| 46 | exclusions: |
| 47 | generated: lax |
| 48 | presets: |
| 49 | - comments |
| 50 | - common-false-positives |
| 51 | - legacy |
| 52 | - std-error-handling |
| 53 | rules: |
| 54 | # Setup/teardown in tests routinely ignores cleanup errors. |
| 55 | - path: _test\.go |
| 56 | linters: |
| 57 | - errcheck |
| 58 | # The pinned golangci-lint binary's staticcheck reports SA5011 false |
| 59 | # positives on `if x == nil { t.Fatal(...) }`-guarded derefs in tests (it |
| 60 | # doesn't treat t.Fatal as terminating); the same code is clean under a |
| 61 | # locally-built golangci-lint. Scope the suppression to tests so SA5011 |
| 62 | # still guards production code. |
| 63 | - path: _test\.go |
| 64 | linters: |
| 65 | - staticcheck |
| 66 | text: SA5011 |
| 67 | # SA4023 is trivially true on GOOS=windows: dialAgent's Windows stub |
| 68 | # (agent_windows.go) always returns a non-nil error until named-pipe |
| 69 | # transport lands. Suppress only this call site; the comparison stays |
| 70 | # meaningful on Unix where dialAgent can succeed. |
| 71 | - path: internal/remote/auth\.go |
| 72 | linters: |
| 73 | - staticcheck |
| 74 | text: SA4023 |
| 75 | |
| 76 | issues: |
| 77 | max-issues-per-linter: 0 |
| 78 | max-same-issues: 0 |
| 79 |