From dee3a151e9346198f4ff8a617b9e029aa737875c Mon Sep 17 00:00:00 2001 From: Kostiantyn <32730812+kkovaletp@users.noreply.github.com> Date: Tue, 1 Oct 2024 15:50:44 +0300 Subject: [PATCH] Update GitHub workflows with various improvements (#1028) Updated DB images in tests to align with the PROD setup Try to upload coverage only if tests were executed (passed or failed) - not skipped or canceled Added ESLint execution after UI tests with results exported to artifact Shifted scheduled run time from 00 minutes according to GitHub recommendations, as the 00 minutes of each hour is the busiest time Dynamically extract a list of langs from the repo to use them for CodeQL analysis instead of hardcoded ones Updated versions of several outdated actions Added the Autobuild step before CodeQL analysis for GO Added the Anchore dependency scan job, reporting to the Security tab. I can add steps to manage PR comments with the results, but I need a token to be provided by @viktorstrate Added the Hadolint Dockerfile scan job, reporting to the Security tab. I can add steps to manage PR comments with the results, but I need a token to be provided by @viktorstrate Implemented weekly rebuild of images for the latest commit in the master branch and the latest released tag. It will recreate images with the recent base image and 3rd-party dependencies even if there were no new pushes for a long time Added the Dockle container analysis job to be run on master and tag and validate just pushed images, reporting to the Security tab Added golangci-lint config to the /api folder, as a starting point and for local usage Added 2 weekly jobs for Dependabot: -- Maintain dependencies for GitHub Actions -- Maintain dependencies for Dockerfile --------- Co-authored-by: Konstantin Koval --- .dockleignore | 5 + .github/dependabot.yml | 15 + .github/workflows/build.yml | 110 ++++++- .github/workflows/codeql-analysis.yml | 165 ++++++++-- .github/workflows/dependencies.yml | 2 +- .github/workflows/tests.yml | 32 +- .hadolint.yaml | 4 + api/.golangci.yml | 420 ++++++++++++++++++++++++++ 8 files changed, 723 insertions(+), 30 deletions(-) create mode 100644 .dockleignore create mode 100644 .github/dependabot.yml create mode 100644 .hadolint.yaml create mode 100644 api/.golangci.yml diff --git a/.dockleignore b/.dockleignore new file mode 100644 index 00000000..1993d8b1 --- /dev/null +++ b/.dockleignore @@ -0,0 +1,5 @@ +# Allow the `latest` tag +DKL-DI-0006 + +# Don't care about signatures +CIS-DI-0005 diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..06b48a2a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,15 @@ +version: 2 +updates: + # Maintain dependencies for GitHub Actions + - package-ecosystem: "github-actions" + directory: "/.github/workflows" + schedule: + interval: "weekly" + + # Maintain dependencies for Dockerfile + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "weekly" + ignore: + - dependency-name: "node" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 67416039..03c4acb9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,12 +1,15 @@ name: Docker builds on: + pull_request: + branches: [master] push: branches: [master] tags: - v* - pull_request: - branches: [master] + schedule: + # At 01:18 every Thursday. Details in https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule + - cron: '18 1 * * 4' env: IS_PUSHING_IMAGES: ${{ github.event_name != 'pull_request' && github.repository == 'photoview/photoview' }} @@ -16,14 +19,62 @@ env: PLATFORMS: linux/amd64,linux/arm64,linux/arm/v7 jobs: - build: - name: Build Docker Image + prepare: + name: Prepare the Matrix runs-on: ubuntu-latest - steps: - name: Checkout uses: actions/checkout@v4 + - name: Prepare the Matrix + id: prepare_matrix + shell: bash + run: | + case ${{ github.event_name }} in + pull_request) + echo 'tags=[{"tag": "", "ref": "${{ github.ref }}"}]' >> $GITHUB_OUTPUT + ;; + push) + echo 'tags=[{"tag": "${{ github.ref_name }}", "ref": "${{ github.ref }}"}]' >> $GITHUB_OUTPUT + ;; + schedule) + git fetch --all + TAG=$(git describe --tags --abbrev=0 || exit 0) + if [ -z "$TAG" ]; then + echo 'tags=[{"tag": "${{ github.ref_name }}", "ref": "${{ github.ref }}"}]' >> $GITHUB_OUTPUT + else + echo 'tags=[{"tag": "${{ github.ref_name }}", "ref": "${{ github.ref }}"}, {"tag": "$TAG", "ref": "$(git show-ref --tags -d | grep "/$TAG$" | cut -d ' ' -f 2)"}]' >> $GITHUB_OUTPUT + fi + ;; + *) + echo "Run for '${{ github.event_name }}' is not expected" + echo 'tags=[{"tag": "${{ github.ref_name }}", "ref": "${{ github.ref }}"}]' >> $GITHUB_OUTPUT + ;; + esac + + outputs: + tags: ${{ steps.prepare_matrix.outputs.tags }} + + build: + name: Build Docker Image + runs-on: ubuntu-latest + needs: prepare + strategy: + fail-fast: false + matrix: + tags: ${{ fromJson(needs.prepare.outputs.tags) }} + steps: + - name: Delete huge unnecessary tools folder + run: rm -rf /opt/hostedtoolcache + + - name: Checkout ${{ matrix.tags.ref }} + uses: actions/checkout@v4 + with: + ref: ${{ matrix.tags.ref }} + + - name: Fetch branches + run: git fetch --all + - name: Set up QEMU uses: docker/setup-qemu-action@v3 with: @@ -60,16 +111,59 @@ jobs: uses: docker/build-push-action@v6 with: context: . + sbom: true + provenance: mode=max platforms: ${{ env.PLATFORMS }} pull: true push: ${{ env.IS_PUSHING_IMAGES }} tags: ${{ steps.docker_meta.outputs.tags }} labels: ${{ steps.docker_meta.outputs.labels }} + annotations: ${{ steps.docker_meta.outputs.annotations }} cache-from: type=gha cache-to: type=gha,mode=max - sbom: true - provenance: mode=max - annotations: ${{ steps.docker_meta.outputs.annotations }} build-args: | VERSION=${{ github.ref_name }} COMMIT_SHA=${{ github.sha }} + + dockle: + name: Dockle Container Analysis + runs-on: ubuntu-latest + needs: + - prepare + - build + strategy: + fail-fast: false + matrix: + tags: ${{ fromJson(needs.prepare.outputs.tags) }} + if: ${{ github.event_name != 'pull_request' && github.repository == 'photoview/photoview' }} + steps: + # Makes sure your .dockleignore file is available to the next step + - name: Checkout ${{ matrix.tags.ref }} + uses: actions/checkout@v4 + with: + ref: ${{ matrix.tags.ref }} + + - name: Docker Login + uses: docker/login-action@v3 + with: + username: ${{ env.DOCKER_USERNAME }} + password: ${{ env.DOCKER_PASSWORD }} + + - name: Run Dockle for '${{ env.DOCKER_IMAGE }}:${{ matrix.tags.tag }}' + id: dockle + if: ${{ matrix.tags.tag != '' }} + continue-on-error: true + uses: erzz/dockle-action@v1 + with: + image: '${{ env.DOCKER_IMAGE }}:${{ matrix.tags.tag }}' + report-name: dockle-results-${{ matrix.tags.tag }} + report-format: sarif + failure-threshold: fatal + exit-code: 1 + timeout: 5m + + - name: Upload SARIF file + if: ${{ steps.dockle.conclusion == 'success' }} + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: dockle-results-${{ matrix.tags.tag }}.sarif diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 71404491..a7a20aa0 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -7,34 +7,163 @@ on: # The branches below must be a subset of the branches above branches: [master] schedule: - - cron: '0 1 * * 4' + # At 01:37 every Thursday. Details in https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule + - cron: '37 1 * * 4' jobs: - analyze: - name: Analyze - if: github.repository == 'photoview/photoview' - runs-on: ubuntu-20.04 - - # strategy: - # fail-fast: false - # matrix: - # Override automatic language detection by changing the below list - # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python'] - # language: ['go', 'javascript'] - # Learn more... - # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection + create-matrix: + runs-on: ubuntu-latest + steps: + - name: Get languages from repo + id: set-matrix + uses: advanced-security/set-codeql-language-matrix@v1 + with: + access-token: ${{ github.token }} + endpoint: ${{ github.event.repository.languages_url }} + outputs: + matrix: ${{ steps.set-matrix.outputs.languages }} + code-ql: + name: CodeQL + needs: create-matrix + if: ${{ needs.create-matrix.outputs.matrix != '[]' && github.repository == 'photoview/photoview' }} + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + language: ${{ fromJSON(needs.create-matrix.outputs.matrix) }} steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v1 + uses: github/codeql-action/init@v3 with: - languages: go, javascript + languages: ${{ matrix.language }} # Run further tests queries: security-extended, security-and-quality + debug: true + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + with: + working-directory: ${{ ( matrix.language == 'go' && './api' ) || ( matrix.language == 'javascript' && './ui' ) || '.' }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{ matrix.language }}" + + anchore: + name: Anchore scan code dependencies + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Generate report + id: scan + uses: anchore/scan-action@v4 + continue-on-error: true + with: + path: "." + fail-build: false + add-cpes-if-none: true + + - name: Upload report + uses: github/codeql-action/upload-sarif@v3 + if: ${{ steps.scan.conclusion == 'success' }} + with: + sarif_file: ${{ steps.scan.outputs.sarif }} + + - name: Scan PR source code + id: scan-fixed + uses: anchore/scan-action@v4 + if: always() && github.event_name == 'pull_request' + continue-on-error: true + with: + path: "." + fail-build: false + add-cpes-if-none: true + output-format: json + severity-cutoff: high + only-fixed: true + + - name: Prepare JSON + if: ${{ steps.scan-fixed.conclusion == 'success' && github.event_name == 'pull_request' }} + run: | + jq '{ + "|": .matches | map({ + "language": .artifact.language, + "id": .vulnerability.id, + "severity": .vulnerability.severity, + "name": .artifact.name, + "version": .artifact.version, + "fix-versions": .vulnerability.fix.versions[0], + "path": .artifact.locations[0].path, + "description": .vulnerability.description + }) + }' ${{ steps.scan-fixed.outputs.json }} > vulns.json + cat vulns.json | jq + + - name: Anchore vulns artifact + id: anchore-artifact + uses: actions/upload-artifact@v4 + with: + name: Anchore-vulns-report + path: ./vulns.json + if-no-files-found: warn + compression-level: 9 + overwrite: true + + hadolint: + name: Hadolint Dockerfile + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Lint Dockerfile + id: lint + uses: hadolint/hadolint-action@v3.1.0 + continue-on-error: true + with: + dockerfile: Dockerfile + config: ${{ github.workspace }}/.hadolint.yaml + output-file: hadolint.txt + format: tty + failure-threshold: error + + - name: Output results + if: ${{ steps.lint.conclusion == 'success' }} + run: | + cat ./hadolint.txt || echo ${HADOLINT_RESULTS} + + - name: Hadolint artifact + id: hadolint-artifact + uses: actions/upload-artifact@v4 + with: + name: hadolint-report + path: ./hadolint.txt + if-no-files-found: warn + compression-level: 9 + overwrite: true + + - name: Lint Dockerfile (sarif) + uses: hadolint/hadolint-action@v3.1.0 + id: lint-report + continue-on-error: true + with: + dockerfile: Dockerfile + config: ${{ github.workspace }}/.hadolint.yaml + output-file: hadolint.sarif + format: sarif + failure-threshold: ignore + + - name: Upload report + uses: github/codeql-action/upload-sarif@v3 + if: ${{ steps.lint-report.conclusion == 'success' }} + with: + sarif_file: hadolint.sarif diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml index 9710c061..fe71114d 100644 --- a/.github/workflows/dependencies.yml +++ b/.github/workflows/dependencies.yml @@ -61,9 +61,9 @@ jobs: push: ${{ env.IS_PUSHING_IMAGES }} tags: ${{ steps.docker_meta.outputs.tags }} labels: ${{ steps.docker_meta.outputs.labels }} + annotations: ${{ steps.docker_meta.outputs.annotations }} cache-from: ${{ ( env.IS_CACHING == 'true' && 'type=gha' ) || '' }} cache-to: ${{ ( env.IS_CACHING == 'true' && 'type=gha,mode=max' ) || '' }} no-cache: ${{ env.IS_CACHING != 'true' }} sbom: true provenance: mode=max - annotations: ${{ steps.docker_meta.outputs.annotations }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index ecf110e9..bc669bd5 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -17,14 +17,15 @@ jobs: services: mariadb: - image: mariadb:10.5 + image: mariadb:lts env: MYSQL_DATABASE: photoview_test MYSQL_USER: photoview MYSQL_PASSWORD: photosecret MYSQL_RANDOM_ROOT_PASSWORD: yes + # https://github.com/MariaDB/mariadb-docker/issues/497 options: >- - --health-cmd="mysqladmin ping" + --health-cmd="mariadb-admin ping" --health-interval=10s --health-timeout=5s --health-retries=5 @@ -32,7 +33,7 @@ jobs: - 3306:3306 postgres: - image: postgres:13.2 + image: postgres:16-alpine env: POSTGRES_USER: photoview POSTGRES_PASSWORD: photosecret @@ -64,6 +65,8 @@ jobs: cache-to: type=gha,mode=max - name: Test + id: test + continue-on-error: true run: | docker run --name test --network host \ -e PHOTOVIEW_DATABASE_DRIVER=${{ matrix.database }} \ @@ -76,6 +79,7 @@ jobs: - name: Upload coverage uses: codecov/codecov-action@v4 + if: ${{ steps.test.conclusion == 'success' }} with: flags: api-${{ matrix.database }} @@ -102,11 +106,33 @@ jobs: cache-to: type=gha,mode=max - name: Test + id: test + continue-on-error: true run: | docker run --name test photoview/ui npm run test:ci docker cp test:/app/ui/coverage ./ui/ - name: Upload coverage uses: codecov/codecov-action@v4 + if: ${{ steps.test.conclusion == 'success' }} with: flags: ui + + - name: Run ESLint + working-directory: ui + run: | + npm run lint:ci || true + echo "--------------------------" + echo "ESLint execution results :" + echo "--------------------------" + cat ./eslint-report.txt || echo "ESLint report file not found." + + - name: ESLint artifact + id: eslint-artifact + uses: actions/upload-artifact@v4 + with: + name: ESLint-report + path: ./ui/eslint-report.txt + if-no-files-found: warn + compression-level: 9 + overwrite: true diff --git a/.hadolint.yaml b/.hadolint.yaml new file mode 100644 index 00000000..40d10241 --- /dev/null +++ b/.hadolint.yaml @@ -0,0 +1,4 @@ +ignored: + - DL3008 # Pin versions in apt get install. Instead of `apt-get install ` use `apt-get install =` + - DL3015 # Avoid additional packages by specifying `--no-install-recommends`. + - SC1091 # Not following: File not included in mock. diff --git a/api/.golangci.yml b/api/.golangci.yml new file mode 100644 index 00000000..89bf8b5e --- /dev/null +++ b/api/.golangci.yml @@ -0,0 +1,420 @@ +# Options for analysis running. +run: + # Number of operating system threads (`GOMAXPROCS`) that can execute golangci-lint simultaneously. + # If it is explicitly set to 0 (i.e. not the default) then golangci-lint will automatically set the value to match Linux container CPU quota. + # Default: the number of logical CPUs in the machine + #concurrency: 4 + # Timeout for analysis, e.g. 30s, 5m. + # Default: 1m + #timeout: 5m + # Exit code when at least one issue was found. + # Default: 1 + #issues-exit-code: 2 + # Include test files or not. + # Default: true + tests: false + # List of build tags, all linters use it. + # Default: [] + #build-tags: + # - mytag + # If set, we pass it to "go list -mod={option}". From "go help modules": + # If invoked with -mod=readonly, the go command is disallowed from the implicit + # automatic updating of go.mod described above. Instead, it fails when any changes + # to go.mod are needed. This setting is most useful to check that go.mod does + # not need updates, such as in a continuous integration and testing system. + # If invoked with -mod=vendor, the go command assumes that the vendor + # directory holds the correct copies of dependencies and ignores + # the dependency descriptions in go.mod. + # + # Allowed values: readonly|vendor|mod + # Default: "" + #modules-download-mode: readonly + # Allow multiple parallel golangci-lint instances running. + # If false, golangci-lint acquires file lock on start. + # Default: false + allow-parallel-runners: true + # Allow multiple golangci-lint instances running, but serialize them around a lock. + # If false, golangci-lint exits with an error if it fails to acquire file lock on start. + # Default: false + allow-serial-runners: true + # Define the Go version limit. + # Mainly related to generics support since go1.18. + # Default: use Go version from the go.mod file, fallback on the env var `GOVERSION`, fallback on 1.17 + #go: '1.19' + +# output configuration options +output: + # The formats used to render issues. + # Formats: + # - `colored-line-number` + # - `line-number` + # - `json` + # - `colored-tab` + # - `tab` + # - `html` + # - `checkstyle` + # - `code-climate` + # - `junit-xml` + # - `github-actions` + # - `teamcity` + # - `sarif` + # Output path can be either `stdout`, `stderr` or path to the file to write to. + # + # For the CLI flag (`--out-format`), multiple formats can be specified by separating them by comma. + # The output can be specified for each of them by separating format name and path by colon symbol. + # Example: "--out-format=checkstyle:report.xml,json:stdout,colored-line-number" + # The CLI flag (`--out-format`) override the configuration file. + # + # Default: + # formats: + # - format: colored-line-number + # path: stdout + formats: + - format: junit-xml + path: golang-lint.xml + - format: sarif + path: golang-lint.sarif + - format: github-actions + # Print lines of code with issue. + # Default: true + #print-issued-lines: false + # Print linter name in the end of issue text. + # Default: true + #print-linter-name: false + # Make issues output unique by line. + # Default: true + #uniq-by-line: false + # Add a prefix to the output file references. + # Default: "" + #path-prefix: "" + # Sort results by the order defined in `sort-order`. + # Default: false + sort-results: true + # Order to use when sorting results. + # Require `sort-results` to `true`. + # Possible values: `file`, `linter`, and `severity`. + # + # If the severity values are inside the following list, they are ordered in this order: + # 1. error + # 2. warning + # 3. high + # 4. medium + # 5. low + # Either they are sorted alphabetically. + # + # Default: ["file"] + sort-order: + - linter + - severity + - file # filepath, line, and column. + # Show statistics per linter. + # Default: false + show-stats: true + +linters: + # Disable all linters. + # Default: false + #disable-all: true + # Enable specific linter + # https://golangci-lint.run/usage/linters/#enabled-by-default + enable: + - asasalint + - asciicheck + - bidichk + - bodyclose + - canonicalheader + - containedctx + - contextcheck + - copyloopvar + - cyclop + - decorder + - depguard + - dogsled + - dupl + - dupword + - durationcheck + - err113 + - errcheck + - errchkjson + - errname + - errorlint + - execinquery + - exhaustive + - exhaustruct + - exportloopref + - fatcontext + - forbidigo + - forcetypeassert + - funlen + - gci + - ginkgolinter + - gocheckcompilerdirectives + - gochecknoglobals + - gochecknoinits + - gochecksumtype + - gocognit + - goconst + - gocritic + - gocyclo + - godot + - godox + - gofmt + - gofumpt + - goheader + - goimports + - gomoddirectives + - gomodguard + - goprintffuncname + - gosec + - gosimple + - gosmopolitan + - govet + - grouper + - importas + - inamedparam + - ineffassign + - interfacebloat + - intrange + - ireturn + - lll + - loggercheck + - maintidx + - makezero + - mirror + - misspell + - mnd + - musttag + - nakedret + - nestif + - nilerr + - nilnil + - nlreturn + - noctx + - nolintlint + - nonamedreturns + - nosprintfhostport + - paralleltest + - perfsprint + - prealloc + - predeclared + - promlinter + - protogetter + - reassign + - revive + - rowserrcheck + - sloglint + - spancheck + - sqlclosecheck + - staticcheck + - stylecheck + - tagalign + - tagliatelle + - tenv + - testableexamples + - testifylint + - testpackage + - thelper + - tparallel + - typecheck + - unconvert + - unparam + - unused + - usestdlibvars + - varnamelen + - wastedassign + - whitespace + - wrapcheck + - wsl + - zerologlint + # Enable all available linters. + # Default: false + #enable-all: true + # Disable specific linter + # https://golangci-lint.run/usage/linters/#disabled-by-default + disable: + - deadcode # Deprecated + - exhaustivestruct # Deprecated + - golint # Deprecated + - ifshort # Deprecated + - interfacer # Deprecated + - maligned # Deprecated + - gomnd # Deprecated + - nosnakecase # Deprecated + - scopelint # Deprecated + - structcheck # Deprecated + - varcheck # Deprecated + # Enable presets. + # https://golangci-lint.run/usage/linters + # Default: [] + presets: + - bugs + - comment + - complexity + - error + - format + - import + - metalinter + - module + - performance + - sql + - style + # Enable only fast linters from enabled linters set (first run won't be fast) + # Default: false + fast: true +issues: + # List of regexps of issue texts to exclude. + # + # But independently of this option we use default exclude patterns, + # it can be disabled by `exclude-use-default: false`. + # To list all excluded by default patterns execute `golangci-lint run --help` + # + # Default: https://golangci-lint.run/usage/false-positives/#default-exclusions + #exclude: + #- abcdef + # Excluding configuration per-path, per-linter, per-text and per-source + exclude-rules: + # Exclude some linters from running on tests files. + - path: _test\.go + linters: + - gocyclo + - errcheck + - dupl + - gosec + # Run some linter only for test files by excluding its issues for everything else. + - path-except: _test\.go + linters: + - forbidigo + # Exclude known linters from partially hard-vendored code, + # which is impossible to exclude via `nolint` comments. + # `/` will be replaced by current OS file path separator to properly work on Windows. + #- path: internal/hmac/ + #text: "weak cryptographic primitive" + #linters: + #- gosec + # Exclude some `staticcheck` messages. + #- linters: + # - staticcheck + # text: "SA9003:" + # Exclude `lll` issues for long lines with `go:generate`. + - linters: + - lll + source: "^//go:generate " + # Independently of option `exclude` we use default exclude patterns, + # it can be disabled by this option. + # To list all excluded by default patterns execute `golangci-lint run --help`. + # Default: true + #exclude-use-default: false + # If set to true, `exclude` and `exclude-rules` regular expressions become case-sensitive. + # Default: false + exclude-case-sensitive: false + # Which dirs to exclude: issues from them won't be reported. + # Can use regexp here: `generated.*`, regexp is applied on full path, + # including the path prefix if one is set. + # Default dirs are skipped independently of this option's value (see exclude-dirs-use-default). + # "/" will be replaced by current OS file path separator to properly work on Windows. + # Default: [] + #exclude-dirs: + # - src/external_libs + # - autogenerated_by_my_lib + # Enables exclude of directories: + # - vendor$, third_party$, testdata$, examples$, Godeps$, builtin$ + # Default: true + #exclude-dirs-use-default: false + # Which files to exclude: they will be analyzed, but issues from them won't be reported. + # There is no need to include all autogenerated files, + # we confidently recognize autogenerated files. + # If it's not, please let us know. + # "/" will be replaced by current OS file path separator to properly work on Windows. + # Default: [] + #exclude-files: + # - ".*\\.my\\.go$" + # - lib/bad.go + # Mode of the generated files analysis. + # + # - `strict`: sources are excluded by following strictly the Go generated file convention. + # Source files that have lines matching only the following regular expression will be excluded: `^// Code generated .* DO NOT EDIT\.$` + # This line must appear before the first non-comment, non-blank text in the file. + # https://go.dev/s/generatedcode + # - `lax`: sources are excluded if they contain lines `autogenerated file`, `code generated`, `do not edit`, etc. + # - `disable`: disable the generated files exclusion. + # + # Default: lax + exclude-generated: strict + # The list of ids of default excludes to include or disable. + # https://golangci-lint.run/usage/false-positives/#default-exclusions + # Default: [] + include: + - EXC0001 + - EXC0002 + - EXC0003 + - EXC0004 + - EXC0005 + - EXC0006 + - EXC0007 + - EXC0008 + - EXC0009 + - EXC0010 + - EXC0011 + - EXC0012 + - EXC0013 + - EXC0014 + - EXC0015 + # Maximum issues count per one linter. + # Set to 0 to disable. + # Default: 50 + max-issues-per-linter: 0 + # Maximum count of issues with the same text. + # Set to 0 to disable. + # Default: 3 + max-same-issues: 0 + # Show only new issues: if there are unstaged changes or untracked files, + # only those changes are analyzed, else only changes in HEAD~ are analyzed. + # It's a super-useful option for integration of golangci-lint into existing large codebase. + # It's not practical to fix all existing issues at the moment of integration: + # much better don't allow issues in new code. + # + # Default: false + #new: true + # Show only new issues created after git revision `REV`. + # Default: "" + #new-from-rev: HEAD + # Show only new issues created in git patch with set file path. + # Default: "" + #new-from-patch: path/to/patch/file + # Show issues in any part of update files (requires new-from-rev or new-from-patch). + # Default: false + #whole-files: true + # Fix found issues (if it's supported by the linter). + # Default: false + #fix: true +severity: + # Set the default severity for issues. + # + # If severity rules are defined and the issues do not match or no severity is provided to the rule + # this will be the default severity applied. + # Severities should match the supported severity names of the selected out format. + # - Code climate: https://docs.codeclimate.com/docs/issues#issue-severity + # - Checkstyle: https://checkstyle.sourceforge.io/property_types.html#SeverityLevel + # - GitHub: https://help.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-error-message + # - TeamCity: https://www.jetbrains.com/help/teamcity/service-messages.html#Inspection+Instance + # + # `@linter` can be used as severity value to keep the severity from linters (e.g. revive, gosec, ...) + # + # Default: "" + #default-severity: error + # If set to true `severity-rules` regular expressions become case-sensitive. + # Default: false + #case-sensitive: true + # When a list of severity rules are provided, severity information will be added to lint issues. + # Severity rules have the same filtering capability as exclude rules + # except you are allowed to specify one matcher per severity rule. + # + # `@linter` can be used as severity value to keep the severity from linters (e.g. revive, gosec, ...) + # + # Only affects out formats that support setting severity information. + # + # Default: [] + rules: + - linters: + - dupl + severity: info