githedgehog · Frostman · Jul 14, 2025
@@ -89,10 +89,10 @@ jobs:
           just --timestamp _lint
 
       - name: More Go lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v8
         with:
           # keep in sync with hack/tools.just
-          version: v1.64.8
+          version: v2.2.2
 
       - name: Run tests
         run: |

@@ -1,47 +1,38 @@
+version: "2"
 run:
   timeout: 10m
   allow-parallel-runners: true
   build-tags:
     - containers_image_openpgp
     - containers_image_storage_stub
-
 linters:
-  disable-all: true
-  # Look at this for details: https://golangci-lint.run/usage/linters/
+  default: none
   enable:
-    # enabled by default
-    - typecheck
-    - errcheck
-    - gosimple
-    - govet
-    - ineffassign
-    - staticcheck
-    - unused
-    # disabled by default
     - asasalint
     - asciicheck
     - bidichk
     - bodyclose
     - containedctx
     - contextcheck
+    - copyloopvar
     - depguard
     - dogsled
     - durationcheck
+    - err113
+    - errcheck
     - errchkjson
     - errname
     - errorlint
     - exhaustive
-    - copyloopvar
     - ginkgolinter
     - gocheckcompilerdirectives
     - goconst
     - gocritic
-    - err113
-    - gofmt
-    - goimports
     - goprintffuncname
     - gosec
+    - govet
     - importas
+    - ineffassign
     - loggercheck
     - makezero
     - misspell
@@ -53,97 +44,138 @@ linters:
     - noctx
     - nolintlint
     - nonamedreturns
+    - nosprintfhostport
     - prealloc
     - predeclared
     - promlinter
     - reassign
     - revive
-    - stylecheck
-    # - tagliatelle
+    - staticcheck
     - unconvert
     - unparam
+    - unused
     - usestdlibvars
     - usetesting
     - whitespace
     - wrapcheck
-
-linters-settings:
-  exhaustive:
-    check:
-      - switch
-      - map
-  govet:
-    enable-all: true
-    disable:
-      - fieldalignment
-      - shadow
-  importas:
-    no-unaliased: true
-    alias:
-      - pkg: k8s.io/apimachinery/pkg/types
-        alias: ktypes
-      - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
-        alias: kmetav1
-      - pkg: k8s.io/apimachinery/pkg/api/errors
-        alias: kapierrors
-      - pkg: k8s.io/apimachinery/pkg/util/errors
-        alias: kerrors
-      - pkg: k8s.io/apimachinery/pkg/api/meta
-        alias: kmeta
-      - pkg: sigs.k8s.io/controller-runtime/pkg/log
-        alias: kctrllog
-      - pkg: sigs.k8s.io/yaml
-        alias: kyaml
-      - pkg: sigs.k8s.io/controller-runtime
-        alias: kctrl
-      - pkg: sigs.k8s.io/controller-runtime/pkg/client
-        alias: kclient
-  depguard:
-    rules:
-      main:
-        deny:
-          # - pkg: "github.com/pkg/errors$"
-          #   desc: use stdlib errors package
-          - pkg: "golang.org/x/exp/maps$"
-            desc: use stdlib maps or samber/lo package
-          - pkg: "golang.org/x/exp/slices$"
-            desc: use stdlib slices or samber/lo package
-          - pkg: "golang.org/x/exp/slog$"
-            desc: use stdlib slog package
-          - pkg: "k8s.io/utils/strings/slices$"
-            desc: use stdlib slices or samber/lo package
-          - pkg: gopkg.in/yaml
-            desc: use sigs.k8s.io/yaml
-  reassign:
-    patterns:
-      - ".*"
-  revive:
-    # By default, revive will enable only the linting rules that are named in the configuration file.
-    # So, it's needed to explicitly enable all required rules here.
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            # - pkg: "github.com/pkg/errors$"
+            #   desc: use stdlib errors package
+            - pkg: golang.org/x/exp/maps$
+              desc: use stdlib maps or samber/lo package
+            - pkg: golang.org/x/exp/slices$
+              desc: use stdlib slices or samber/lo package
+            - pkg: golang.org/x/exp/slog$
+              desc: use stdlib slog package
+            - pkg: k8s.io/utils/strings/slices$
+              desc: use stdlib slices or samber/lo package
+            - pkg: gopkg.in/yaml
+              desc: use sigs.k8s.io/yaml
+    embeddedstructfieldcheck:
+      # Checks that sync.Mutex and sync.RWMutex are not used as embedded fields.
+      forbid-mutex: true
+    exhaustive:
+      check:
+        - switch
+        - map
+    ginkgolinter:
+      forbid-focus-container: true
+      forbid-spec-pollution: true
+    govet:
+      enable-all: true
+      disable:
+        - fieldalignment
+        - shadow # TODO consider restricting shadowing in future
+    importas:
+      no-unaliased: true
+      alias:
+        - pkg: k8s.io/apimachinery/pkg/types
+          alias: ktypes
+        - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
+          alias: kmetav1
+        - pkg: k8s.io/apimachinery/pkg/api/errors
+          alias: kapierrors
+        - pkg: k8s.io/apimachinery/pkg/util/errors
+          alias: kerrors
+        - pkg: k8s.io/apimachinery/pkg/api/meta
+          alias: kmeta
+        - pkg: sigs.k8s.io/controller-runtime/pkg/log
+          alias: kctrllog
+        - pkg: sigs.k8s.io/yaml
+          alias: kyaml
+        - pkg: sigs.k8s.io/controller-runtime
+          alias: kctrl
+        - pkg: sigs.k8s.io/controller-runtime/pkg/client
+          alias: kclient
+    nolintlint:
+      allow-unused: false
+    reassign:
+      patterns:
+        - .*
+    revive:
+      rules:
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: dot-imports
+          arguments:
+            - allowedPackages:
+                - github.com/onsi/ginkgo/v2
+                - github.com/onsi/gomega
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: if-return
+        - name: import-shadowing
+        - name: increment-decrement
+        - name: var-naming
+        - name: var-declaration
+        - name: package-comments
+          disabled: true
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+        - name: empty-block
+        - name: superfluous-else
+        - name: unused-parameter
+        - name: unreachable-code
+        - name: redefines-builtin-id
+        - name: bool-literal-in-expr
+        - name: constant-logical-expr
+  exclusions:
+    generated: strict
+    paths:
+      - ^vendor/
+      - zz_generated.*\.go$
+      - .*conversion.*\.go$
     rules:
-      # The following rules are recommended https://github.com/mgechev/revive#recommended-configuration
-      - name: blank-imports
-      - name: context-as-argument
-      - name: context-keys-type
-      - name: dot-imports
-      - name: error-return
-      - name: error-strings
-      - name: error-naming
-      - name: if-return
-      - name: increment-decrement
-      - name: var-naming
-      - name: var-declaration
-      - name: range
-      - name: receiver-naming
-      - name: time-naming
-      - name: unexported-return
-      - name: indent-error-flow
-      - name: errorf
-      - name: superfluous-else
-      - name: unreachable-code
-      - name: redefines-builtin-id
-      #
-      # Rules in addition to the recommended configuration above.
-      #
-      - name: bool-literal-in-expr
-      - name: constant-logical-expr
+      - linters:
+          - errcheck
+        text: Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*print(f|ln)?|os\.(Un)?Setenv). is not checked
+      - linters:
+          - gosec
+        text: "G304: Potential file inclusion via variable"
+      - path: (.+)\.go$
+        text: Subprocess launch(ed with variable|ing should be audited)
+      - linters:
+          - staticcheck
+        text: "QF1001:"
+formatters:
+  enable:
+    - gofmt
+    - gofumpt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - ^vendor/
+      - third_party$
+      - builtin$
+      - examples$
@@ -564,7 +564,7 @@ type Agent struct {
 
 const KindAgent = "Agent"
 
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // AgentList contains a list of Agent
 type AgentList struct {

@@ -65,7 +65,7 @@ type Catalog struct {
 	Status CatalogStatus `json:"status,omitempty"`
 }
 
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // CatalogList contains a list of Catalog
 type CatalogList struct {

@@ -113,7 +113,7 @@ type DHCPSubnet struct {
 	Status DHCPSubnetStatus `json:"status,omitempty"`
 }
 
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // DHCPSubnetList contains a list of DHCPSubnet
 type DHCPSubnetList struct {

@@ -66,7 +66,7 @@ type External struct {
 	Status ExternalStatus `json:"status,omitempty"`
 }
 
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // ExternalList contains a list of External
 type ExternalList struct {

@@ -82,7 +82,7 @@ type ExternalAttachment struct {
 	Status ExternalAttachmentStatus `json:"status,omitempty"`
 }
 
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // ExternalAttachmentList contains a list of ExternalAttachment
 type ExternalAttachmentList struct {

@@ -96,7 +96,7 @@ type ExternalPeering struct {
 
 const KindExternalPeering = "ExternalPeering"
 
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // ExternalPeeringList contains a list of ExternalPeering
 type ExternalPeeringList struct {
@@ -157,15 +157,18 @@ func (peering *ExternalPeering) Validate(ctx context.Context, kube kclient.Reade
 		if permit.Prefix == "" {
 			return nil, errors.Errorf("external.prefixes.prefix is required")
 		}
-		/*if permit.Ge > permit.Le {
-			return nil, errors.Errorf("external.prefixes.ge must be <= external.prefixes.le")
-		}
-		if permit.Ge > 32 {
-			return nil, errors.Errorf("external.prefixes.ge must be <= 32")
-		}
-		if permit.Le > 32 {
-			return nil, errors.Errorf("external.prefixes.le must be <= 32")
-		}*/
+
+		/*
+			if permit.Ge > permit.Le {
+				return nil, errors.Errorf("external.prefixes.ge must be <= external.prefixes.le")
+			}
+			if permit.Ge > 32 {
+				return nil, errors.Errorf("external.prefixes.ge must be <= 32")
+			}
+			if permit.Le > 32 {
+				return nil, errors.Errorf("external.prefixes.le must be <= 32")
+			}
+		*/
 
 		// TODO add more validation for prefix/ge/le
 	}

@@ -33,8 +33,8 @@ import (
 
 // IPv4NamespaceSpec defines the desired state of IPv4Namespace
 type IPv4NamespaceSpec struct {
-	//+kubebuilder:validation:MinItems=1
-	//+kubebuilder:validation:MaxItems=20
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=20
 	// Subnets is the list of subnets to allocate VPC subnets from, couldn't overlap between each other and with Fabric reserved subnets
 	Subnets []string `json:"subnets,omitempty"`
 }
@@ -61,7 +61,7 @@ type IPv4Namespace struct {
 
 const KindIPv4Namespace = "IPv4Namespace"
 
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // IPv4NamespaceList contains a list of IPv4Namespace
 type IPv4NamespaceList struct {

@@ -195,7 +195,7 @@ type VPC struct {
 
 const KindVPC = "VPC"
 
-//+kubebuilder:object:root=true
+// +kubebuilder:object:root=true
 
 // VPCList contains a list of VPC
 type VPCList struct {