astonish/.golangci.yml at main · NelTdS/astonish · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
# golangci-lint configuration v2
# Focus on bugs and real issues, not style preferences
version: "2"

run:
  timeout: 5m

linters:
  # Disable default linters and enable only what we want
  default: none
  enable:
    # Bug finders - these catch real issues
    - govet         # Go vet - catches serious issues
    - ineffassign   # Detects unused variable assignments
    - unused        # Finds unused code

    # Staticcheck for real bugs (not style)
    - staticcheck

    # Security scanner
    - gosec

  exclusions:
    paths:
      - web/node_modules

  settings:
    # Disable unreachable code check in govet (often false positives in complex flows)
    govet:
      disable:
        - unreachable

    staticcheck:
      checks:
        - "all"
        # Disable style rules (ST*)
        - "-ST*"
        # Disable code simplification suggestions (S*)
        - "-S*"
        # Disable quickfix suggestions (QF*)
        - "-QF*"
        # Disable empty branch warnings (intentional in some cases)
        - "-SA9003"
        # Disable deprecation warnings (will fix gradually)
        - "-SA1019"

    gosec:
      excludes:
        # Struct fields named "APIKey", "Password", etc. are expected in config types
        - G101  # Hardcoded credentials (false positives on constants/env var maps)
        - G104  # Errors unhandled — most are best-effort Close/Remove calls; real cases fixed manually
        - G117  # Exported field matches secret pattern (unavoidable in config structs)
        # Cookie Secure/HttpOnly/SameSite — false positives when Secure is set via helper
        # (isSecureRequest) and on test request cookies that are not Set-Cookie responses.
        # G124 exists in gosec bundled with golangci-lint >= 2.12; keep CI version in sync
        # (.github/workflows/lint.yml) or config verify will reject this ID on older releases.
        - G124
        # File permissions: 0644/0755 are standard for non-secret config and cache files
        - G301  # Directory permissions > 0750
        - G302  # File permissions > 0600
        - G306  # WriteFile permissions > 0600
        # Safe to use math/rand for jitter/humanization (not cryptographic)
        - G404  # Weak random number generator
        # Variable URLs are expected in an HTTP client/proxy codebase
        - G107  # HTTP request with variable URL
        # Integer conversions are verified safe in context (e.g. uint32>>9 to uint8)
        - G115  # Integer overflow conversion
        # Log injection and SSRF taint analysis produce too many false positives
        - G704  # SSRF via taint analysis
        - G706  # Log injection via taint analysis
        # Path traversal taint analysis flags safe internal paths
        - G703  # Path traversal via taint analysis
        # XSS taint analysis — output is to terminal, not browsers
        - G705  # XSS via taint analysis
        # Subprocess launched with variable — inherent to an agent framework
        - G204  # Subprocess launched with variable
        # File inclusion via variable — config/demo files are loaded by path
        - G304  # Potential file inclusion via variable
        # Command injection — inherent to an agent that runs user-specified commands/editors
        - G702  # Command injection via taint analysis
        # Context.Background in goroutines — intentional for fire-and-forget background work
        # (reindex, long-lived watchers, session loops) that must outlive request scope
        - G118  # Goroutine uses context.Background/TODO