Skip to content

Commit 4dbb85a

Browse files
author
Richard Kovacs
committed
Introduce static code analysis
1 parent 7a4b2e5 commit 4dbb85a

File tree

13 files changed

+537
-104
lines changed

13 files changed

+537
-104
lines changed

.github/workflows/build_test_ci.yml

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,16 @@ on:
66
pull_request:
77
branches: [ "main" ]
88

9-
jobs:
9+
permissions:
10+
contents: read
11+
pull-requests: read
12+
actions: read
13+
14+
concurrency:
15+
group: build-test-ci-${{ github.ref }}-1
16+
cancel-in-progress: true
1017

18+
jobs:
1119
go-build-test:
1220
runs-on: ubuntu-latest
1321
steps:
@@ -24,9 +32,46 @@ jobs:
2432
- name: Test
2533
run: make test
2634

35+
go-analyse:
36+
needs: go-build-test
37+
runs-on: ubuntu-latest
38+
steps:
39+
- uses: actions/checkout@v4
40+
41+
- name: Set up Go
42+
uses: actions/setup-go@v5
43+
with:
44+
go-version: 'stable'
45+
46+
- name: Docker cache
47+
uses: ScribeMD/[email protected]
48+
with:
49+
key: docker-${{ runner.os }}-${{ hashFiles('Makefile') }}}
50+
51+
- name: Lint
52+
run: make lint
53+
54+
- name: Gosec
55+
run: make gosec
56+
57+
- uses: nick-fields/retry@v2
58+
with:
59+
timeout_minutes: 5
60+
max_attempts: 3
61+
command: make nilcheck
62+
63+
- name: Vulncheck
64+
run: make vulncheck
65+
2766
docker-build:
2867
runs-on: ubuntu-latest
2968
steps:
3069
- uses: actions/checkout@v4
70+
71+
- name: Cache Docker images.
72+
uses: ScribeMD/[email protected]
73+
with:
74+
key: docker-${{ runner.os }}-${{ hashFiles('Dockerfile') }}
75+
3176
- name: Build the Docker image
3277
run: make docker-build

.github/workflows/codeql.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
pull_request:
7+
# The branches below must be a subset of the branches above
8+
branches: [ "main" ]
9+
10+
permissions:
11+
contents: read
12+
13+
concurrency:
14+
group: codeql-${{ github.ref }}-1
15+
cancel-in-progress: true
16+
17+
jobs:
18+
analyze:
19+
name: Analyze
20+
runs-on: ubuntu-latest
21+
permissions:
22+
actions: read
23+
contents: read
24+
security-events: write
25+
26+
strategy:
27+
fail-fast: false
28+
29+
steps:
30+
- name: Harden Runner
31+
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
32+
with:
33+
disable-sudo: true
34+
egress-policy: block
35+
allowed-endpoints: >
36+
api.github.com:443
37+
github.com:443
38+
proxy.golang.org:443
39+
sum.golang.org:443
40+
objects.githubusercontent.com:443
41+
42+
- name: Checkout repository
43+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
44+
45+
# Initializes the CodeQL tools for scanning.
46+
- name: Initialize CodeQL
47+
uses: github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
48+
with:
49+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
50+
languages: go
51+
# If you wish to specify custom queries, you can do so here or in a config file.
52+
# By default, queries listed here will override any specified in a config file.
53+
# Prefix the list here with "+" to use these queries and those in the config file.
54+
55+
# Details on CodeQL's query packs refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
56+
# queries: security-extended,security-and-quality
57+
58+
- name: Build
59+
run: make build
60+
61+
- name: Perform CodeQL Analysis
62+
uses: github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
63+
with:
64+
category: "/language:go"

.golangci.yml

Lines changed: 262 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
run:
2+
timeout: 5m
3+
4+
skip-files:
5+
- "zz_generated\\..+\\.go$"
6+
7+
issues-exit-code: 1
8+
9+
output:
10+
# colored-line-number|line-number|json|tab|checkstyle|code-climate, default is "colored-line-number"
11+
format: colored-line-number
12+
13+
linters-settings:
14+
errcheck:
15+
# report about not checking of errors in type assetions: `a := b.(MyStruct)`;
16+
# default is false: such cases aren't reported by default.
17+
check-type-assertions: true
18+
19+
# report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
20+
# default is false: such cases aren't reported by default.
21+
check-blank: true
22+
23+
# [deprecated] comma-separated list of pairs of the form pkg:regex
24+
# the regex is used to ignore names within pkg. (default "fmt:.*").
25+
# see https://github.com/kisielk/errcheck#the-deprecated-method for details
26+
ignore: fmt:.*,io/ioutil:^Read.*
27+
28+
govet:
29+
# report about shadowed variables
30+
check-shadowing: false
31+
32+
golint:
33+
# minimal confidence for issues, default is 0.8
34+
min-confidence: 0.8
35+
36+
gofmt:
37+
# simplify code: gofmt with `-s` option, true by default
38+
simplify: true
39+
40+
goimports:
41+
# put imports beginning with prefix after 3rd-party packages;
42+
# it's a comma-separated list of prefixes
43+
local-prefixes: github.com/crossplane/provider-template
44+
45+
gocyclo:
46+
# minimal code complexity to report, 30 by default (but we recommend 10-20)
47+
min-complexity: 15
48+
49+
cyclop:
50+
max-complexity: 15
51+
52+
maligned:
53+
# print struct with more effective memory layout or not, false by default
54+
suggest-new: true
55+
56+
dupl:
57+
# tokens count to trigger issue, 150 by default
58+
threshold: 100
59+
60+
goconst:
61+
# minimal length of string constant, 3 by default
62+
min-len: 3
63+
# minimal occurrences count to trigger, 3 by default
64+
min-occurrences: 5
65+
66+
lll:
67+
# tab width in spaces. Default to 1.
68+
tab-width: 1
69+
70+
unused:
71+
# treat code as a program (not a library) and report unused exported identifiers; default is false.
72+
# XXX: if you enable this setting, unused will report a lot of false-positives in text editors:
73+
# if it's called for subdir of a project it can't find funcs usages. All text editor integrations
74+
# with golangci-lint call it on a directory with the changed file.
75+
check-exported: false
76+
77+
unparam:
78+
# Inspect exported functions, default is false. Set to true if no external program/library imports your code.
79+
# XXX: if you enable this setting, unparam will report a lot of false-positives in text editors:
80+
# if it's called for subdir of a project it can't find external interfaces. All text editor integrations
81+
# with golangci-lint call it on a directory with the changed file.
82+
check-exported: false
83+
84+
prealloc:
85+
# XXX: we don't recommend using this linter before doing performance profiling.
86+
# For most programs usage of prealloc will be a premature optimization.
87+
88+
# Report preallocation suggestions only on simple loops that have no returns/breaks/continues/gotos in them.
89+
# True by default.
90+
simple: true
91+
range-loops: true # Report preallocation suggestions on range loops, true by default
92+
for-loops: false # Report preallocation suggestions on for loops, false by default
93+
94+
gocritic:
95+
# Enable multiple checks by tags, run `GL_DEBUG=gocritic golangci-lint` run to see all tags and checks.
96+
# Empty list by default. See https://github.com/go-critic/go-critic#usage -> section "Tags".
97+
enabled-tags:
98+
- diagnostic
99+
- experimental
100+
- opinionated
101+
- performance
102+
- style
103+
104+
# disabled-checks:
105+
# - unnamedResult
106+
# - hugeParam
107+
108+
settings: # settings passed to gocritic
109+
captLocal: # must be valid enabled check name
110+
paramsOnly: true
111+
rangeValCopy:
112+
sizeThreshold: 32
113+
114+
nolintlint:
115+
require-explanation: true
116+
require-specific: true
117+
118+
linters:
119+
enable:
120+
- asasalint
121+
- asciicheck
122+
- bidichk
123+
- bodyclose
124+
- containedctx
125+
- contextcheck
126+
- cyclop
127+
- decorder
128+
# - depguard
129+
- dogsled
130+
- dupl
131+
- dupword
132+
- durationcheck
133+
- errchkjson
134+
- errname
135+
- errorlint
136+
- errcheck
137+
- exportloopref
138+
- exhaustive
139+
- exportloopref
140+
- forbidigo
141+
- forcetypeassert
142+
# - funlen
143+
# - gci
144+
- gocheckcompilerdirectives
145+
- gocognit
146+
- goconst
147+
- gocritic
148+
# - godot
149+
# - godox
150+
# - goerr113
151+
- gofmt
152+
- goimports
153+
- gomnd
154+
- gocyclo
155+
- goprintffuncname
156+
- gosec
157+
- gosimple
158+
- govet
159+
- ineffassign
160+
- loggercheck
161+
- maintidx
162+
- makezero
163+
- misspell
164+
- nestif
165+
- nilerr
166+
- nilnil
167+
- nlreturn
168+
- noctx
169+
- nolintlint
170+
- paralleltest
171+
- prealloc
172+
- predeclared
173+
- reassign
174+
# - revive
175+
- staticcheck
176+
# - stylecheck
177+
- tenv
178+
- thelper
179+
- typecheck
180+
- unconvert
181+
- unparam
182+
- unused
183+
- usestdlibvars
184+
- varnamelen
185+
- whitespace
186+
# - wrapcheck
187+
188+
presets:
189+
- bugs
190+
- unused
191+
fast: false
192+
193+
194+
issues:
195+
# Excluding configuration per-path and per-linter
196+
exclude-rules:
197+
# Exclude some linters from running on tests files.
198+
- path: _test(ing)?\.go
199+
linters:
200+
- gocyclo
201+
- errcheck
202+
- dupl
203+
- gosec
204+
- exportloopref
205+
- unparam
206+
207+
# Ease some gocritic warnings on test files.
208+
- path: _test\.go
209+
text: "(unnamedResult|exitAfterDefer)"
210+
linters:
211+
- gocritic
212+
213+
# These are performance optimisations rather than style issues per se.
214+
# They warn when function arguments or range values copy a lot of memory
215+
# rather than using a pointer.
216+
- text: "(hugeParam|rangeValCopy):"
217+
linters:
218+
- gocritic
219+
220+
# This "TestMain should call os.Exit to set exit code" warning is not clever
221+
# enough to notice that we call a helper method that calls os.Exit.
222+
- text: "SA3000:"
223+
linters:
224+
- staticcheck
225+
226+
- text: "k8s.io/api/core/v1"
227+
linters:
228+
- goimports
229+
230+
# This is a "potential hardcoded credentials" warning. It's triggered by
231+
# any variable with 'secret' in the same, and thus hits a lot of false
232+
# positives in Kubernetes land where a Secret is an object type.
233+
- text: "G101:"
234+
linters:
235+
- gosec
236+
- gas
237+
238+
# This is an 'errors unhandled' warning that duplicates errcheck.
239+
- text: "G104:"
240+
linters:
241+
- gosec
242+
- gas
243+
244+
# Independently from option `exclude` we use default exclude patterns,
245+
# it can be disabled by this option. To list all
246+
# excluded by default patterns execute `golangci-lint run --help`.
247+
# Default value for this option is true.
248+
exclude-use-default: false
249+
250+
# Show only new issues: if there are unstaged changes or untracked files,
251+
# only those changes are analyzed, else only changes in HEAD~ are analyzed.
252+
# It's a super-useful option for integration of golangci-lint into existing
253+
# large codebase. It's not practical to fix all existing issues at the moment
254+
# of integration: much better don't allow issues in new code.
255+
# Default is false.
256+
new: false
257+
258+
# Maximum issues count per one linter. Set to 0 to disable. Default is 50.
259+
max-per-linter: 0
260+
261+
# Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
262+
max-same-issues: 0

.husky/hooks/pre-push

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,4 @@ fi
1616
make generate manifests
1717
git diff --exit-code --quiet || (git status && exit 1)
1818

19-
make test
19+
make lint gosec nilcheck test

0 commit comments

Comments
 (0)