#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

version: "2"
run:
  issues-exit-code: 1
linters:
  enable:
    - asciicheck
    - bodyclose
    - errorlint
    - forbidigo
    - gocritic
    - gosec
    - importas
    - makezero
    - misspell
    - nilnesserr
    - prealloc
    - revive
    - tparallel
    - unconvert
    - unparam
    - usestdlibvars
    - whitespace
  settings:
    forbidigo:
      forbid:
        # Forbid using os.Getenv and os.LookupEnv with COSIGN_ variables in favor of
        # pkg/cosign/env package
        # Reference: https://github.com/sigstore/cosign/issues/2236
        - pattern: os\.Getenv.*
        - pattern: os\.LookupEnv.*
      exclude-godoc-examples: false
    gosec:
      excludes:
        - G115 # integer overflow conversion int64 -> uint64
    govet:
      settings:
        printf:
          funcs:
            - github.com/sigstore/cosign/v3/internal/ui.Infof
            - github.com/sigstore/cosign/v3/internal/ui.Warnf
  exclusions:
    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:
      - linters:
          - errcheck
          # We want to allow using os.Getenv and os.Setenv in tests because it
          # might be easier (and needed in some cases)
          - forbidigo
          - gosec
        path: _test\.go
      - linters:
          - staticcheck
        path: pkg/cosign/tlog.go
        # NewEntry used for Rekor v1, will update to NewTlogEntry for Rekor v2 support
        text: SA1019
      - linters:
          - staticcheck
        path: pkg/cosign/verify.go
        # NewEntry used for Rekor v1, will update to NewTlogEntry for Rekor v2 support
        text: SA1019
      - linters:
          - staticcheck
        path: pkg/cosign/verify_bundle_test.go
        # NewEntry used for Rekor v1, will update to NewTlogEntry for Rekor v2 support
        text: SA1019
      - linters:
          - revive
        path: cmd/cosign/errors/
        # Allow 'errors' package name in cmd/cosign/errors - it doesn't conflict with std lib
        text: "var-naming: avoid package names that conflict with Go standard library package names"
    paths:
      - third_party$
      - builtin$
      - examples$
issues:
  max-issues-per-linter: 0
  max-same-issues: 0
  uniq-by-line: false
formatters:
  enable:
    - gofmt
    - goimports
  exclusions:
    generated: lax
    paths:
      - third_party$
      - builtin$
      - examples$