.golangci.yml

version: "2"

run:
  timeout: 10m
  relative-path-mode: gomod
  tests: true
  build-tags:
    - integration

formatters:
  enable:
    - gofmt
    - gofumpt
    - goimports
    - golines
  settings:
    goimports:
      local-prefixes:
        - github.com/dantte-lp/gobfd
    golines:
      max-len: 120

output:
  formats:
    text:
      print-linter-name: true
      colors: true
  show-stats: true

issues:
  max-issues-per-linter: 0
  max-same-issues: 0

linters:
  default: none
  enable:
    # ── Безопасность / Security ──
    - gosec               # Security problems (audit mode)
    - bidichk             # Dangerous Unicode sequences
    - forcetypeassert     # Forced type assertions → panic on bad input
    - reassign            # Package variable reassignment
    - containedctx        # context.Context stored in structs

    # ── Корректность / Correctness ──
    - govet               # Go vet with extra analyzers
    - staticcheck         # Comprehensive static analysis
    - errcheck            # Unchecked errors
    - bodyclose           # HTTP response body not closed
    - noctx               # HTTP request without context
    - contextcheck        # Non-inherited context usage
    - nilerr              # Returns nil when error is not nil
    - nilnesserr          # Simultaneous nil error + invalid value
    - nilnil              # Simultaneous nil error + nil value
    - durationcheck       # Two durations multiplied together
    - fatcontext          # Nested contexts in loops
    - copyloopvar         # Loop variable copies
    - predeclared         # Shadows predeclared identifiers (true, len, etc.)
    - recvcheck           # Receiver type consistency (pointer vs value)
    - gocheckcompilerdirectives  # Valid //go: directives
    - protogetter         # Enforce proto message getters
    - iface               # Incorrect interface usage patterns
    - asasalint           # Catch []any as any in variadic func(...any)
    - gochecksumtype      # Exhaustive sum type checks
    - gochecknoinits      # No init() — explicit initialization

    # ── Обработка ошибок / Error handling ──
    - errorlint           # Error wrapping style (Go 1.13+)
    - wrapcheck           # External package errors must be wrapped
    - err113              # Error handling expressions
    - errname             # Sentinel errors prefixed with Err
    - errchkjson          # JSON encoding type checks

    # ── Сетевые / Network ──
    - nosprintfhostport   # Misuse of Sprintf for host:port URLs

    # ── Качество кода / Code quality ──
    - gocritic            # Bugs, performance, style diagnostics
    - revive              # Consistency and optimizations
    - cyclop              # Cyclomatic complexity
    - gocognit            # Cognitive complexity
    - funlen              # Long functions
    - nestif              # Deeply nested if statements
    - exhaustive          # Exhaustive enum switch
    - unparam             # Unused function parameters
    - unconvert           # Unnecessary type conversions
    - unused              # Unused code
    - ineffassign         # Ineffective assignments
    - maintidx            # Maintainability index
    - nakedret            # Naked returns
    - nonamedreturns      # Named return parameters
    - goprintffuncname    # Printf-like functions end with 'f'
    - interfacebloat      # Prevent interface pollution
    - inamedparam         # Named interface method parameters
    - decorder            # Consistent declaration ordering

    # ── Производительность / Performance ──
    - prealloc            # Slice pre-allocation
    - perfsprint          # Faster fmt.Sprintf alternatives
    - makezero            # Slice with non-zero length + append
    - mirror              # Wrong bytes/strings mirror patterns
    - wastedassign        # Wasted assignment statements
    - intrange            # Integer range in for loops (Go 1.22+)
    - exptostd            # Replace x/exp with stdlib

    # ── Стиль / Style ──
    - goconst             # Repeated strings → constant
    - dupl                # Code clones
    - misspell            # Misspelled English words
    - sloglint            # Consistent slog usage
    - musttag             # Struct tags in marshaling
    - modernize           # Modern Go patterns
    - asciicheck          # ASCII-only identifiers
    - canonicalheader     # Canonical net/http.Header
    - dupword             # Duplicate words in comments
    - usestdlibvars       # Use stdlib variables/constants
    - loggercheck         # Logger key-value pair validation
    - whitespace          # Unnecessary blank lines
    - godot               # Comments end with period
    - godoclint           # Godoc validation
    - tagalign            # Aligned struct tags
    - importas            # Enforce import aliases consistency

    # ── Зависимости / Dependencies ──
    - depguard            # Forbidden package imports
    - gomoddirectives     # Catch stray replace/retract in go.mod

    # ── Дисциплина / Discipline ──
    - nolintlint          # Nolint directive quality

    # ── Тесты / Testing ──
    - tparallel           # Inappropriate t.Parallel() usage
    - testpackage         # Separate _test package
    - thelper             # Test helpers call t.Helper()
    - testableexamples    # Examples have expected output
    - usetesting          # Testing package replacements
    - testifylint         # Testify best practices

    # ── Наблюдаемость / Observability ──
    - promlinter          # Prometheus metric naming

  settings:
    gosec:
      config:
        global:
          audit: "true"
    govet:
      enable:
        - shadow
        - atomic
        - copylocks
        - loopclosure
        - httpmux
    cyclop:
      max-complexity: 15
      skip-tests: true
    gocognit:
      min-complexity: 15
    funlen:
      lines: 60
      statements: 40
    nestif:
      min-complexity: 4
    maintidx:
      under: 20
    nakedret:
      max-func-lines: 0
    exhaustive:
      default-signifies-exhaustive: true
    interfacebloat:
      max: 10
    importas:
      no-unaliased: false
    depguard:
      rules:
        main:
          deny:
            - pkg: "math/rand$"
              desc: "Use crypto/rand or math/rand/v2"
            - pkg: "^log$"
              desc: "Use log/slog"
            - pkg: "io/ioutil"
              desc: "Deprecated in Go 1.16"
            - pkg: "unsafe"
              desc: "Forbidden — network daemon handles untrusted input"
            - pkg: "os/exec"
              desc: "Shell injection risk — not needed in this project"
    nolintlint:
      require-explanation: true
      require-specific: true
    sloglint:
      attr-only: false
    loggercheck:
      require-string-key: true
      no-printf-like: true
    promlinter:
      strict: true

  exclusions:
    generated: strict
    presets:
      - std-error-handling
      - common-false-positives
    rules:
      - path: _test\.go
        linters:
          - gosec
          - dupl
          - funlen
          - cyclop
          - gocognit
          - nestif
          - err113
          - wrapcheck
          - nonamedreturns
          - maintidx
          - containedctx
          - forcetypeassert
      - path: cmd/
        linters:
          - gochecknoinits  # cobra uses init() for flag registration

severity:
  default: warning
  rules:
    - linters:
        - gosec
        - errcheck
        - bodyclose
        - noctx
        - staticcheck
        - forcetypeassert
        - containedctx
        - nilnil
        - reassign
      severity: error