.golangci.yml

issues:
  exclude-dirs:
    - (^|/)node_modules/
    - ^api/gen/
    - ^docs/
    - ^gen/
    - ^rfd/
    - ^web/
  exclude-dirs-use-default: false
  exclude-rules:
    - linters:
        - gosimple
      text: 'S1002: should omit comparison to bool constant'
    - linters:
        - revive
      text: 'exported: exported const'
    # TODO(hugoShaka): Remove once https://github.com/dominikh/go-tools/issues/1294 is fixed
    - linters:
        - unused
      path: 'integrations/operator/controllers/resources/(.+)_controller_test\.go'
    # TODO(codingllama): Remove once we move to grpc.NewClient.
    - linters: [staticcheck]
      text: 'grpc.Dial is deprecated'
    - linters: [staticcheck]
      text: 'grpc.DialContext is deprecated'
    # Deprecated gRPC dial options. Related to grpc.NewClient.
    - path: (client/client.go|client/proxy/client_test.go) # api/
      linters: [staticcheck]
      # grpc.FailOnNonTempDialError
      # grpc.WithReturnConnectionError
      text: 'this DialOption is not supported by NewClient'
    - path: lib/kube/grpc/grpc_test.go
      linters: [staticcheck]
      text: 'grpc.WithBlock is deprecated'
    - path: lib/observability/tracing/client.go
      linters: [staticcheck]
      text: 'grpc.WithBlock is deprecated'
    - path: integrations/lib/config.go
      linters: [staticcheck]
      text: 'grpc.WithReturnConnectionError is deprecated'
    - path: lib/service/service_test.go
      linters: [staticcheck]
      # grpc.WithReturnConnectionError
      # grpc.FailOnNonTempDialError
      text: 'this DialOption is not supported by NewClient'
    - path: integration/client_test.go
      linters: [staticcheck]
      text: 'grpc.WithReturnConnectionError is deprecated'
    - path: integration/integration_test.go
      linters: [staticcheck]
      text: 'grpc.WithBlock is deprecated'
    - path: lib/multiplexer/multiplexer_test.go
      linters: [staticcheck]
      text: 'grpc.WithBlock is deprecated'
    - path: provider/provider.go # integrations/terraform
      linters: [staticcheck]
      text: 'grpc.WithReturnConnectionError is deprecated'
    - linters: [govet]
      path-except: ^e/
      text: 'non-constant format string in call to github.com/gravitational/trace.'
  exclude-use-default: true
  max-same-issues: 0
  max-issues-per-linter: 0

linters:
  disable-all: true
  enable:
    - bodyclose
    - depguard
    - errorlint
    - gci
    - goimports
    - gosimple
    - govet
    - ineffassign
    - misspell
    - nolintlint
    - revive
    - sloglint
    - staticcheck
    - testifylint
    - unconvert
    - unused
    - forbidigo

linters-settings:
  depguard:
    rules:
      main:
        deny:
          - pkg: io/ioutil
            desc: 'use "io" or "os" packages instead'
          - pkg: math/rand$
            desc: 'use "math/rand/v2" or "crypto/rand" instead'
          - pkg: github.com/golang/protobuf
            desc: 'use "google.golang.org/protobuf"'
          - pkg: github.com/hashicorp/go-uuid
            desc: 'use "github.com/google/uuid" instead'
          - pkg: github.com/pborman/uuid
            desc: 'use "github.com/google/uuid" instead'
          - pkg: github.com/siddontang/go-log/log
            desc: 'use "github.com/sirupsen/logrus" instead'
          - pkg: github.com/siddontang/go/log
            desc: 'use "github.com/sirupsen/logrus" instead'
          - pkg: github.com/tj/assert
            desc: 'use "github.com/stretchr/testify/assert" instead'
          - pkg: go.uber.org/atomic
            desc: 'use "sync/atomic" instead'
          - pkg: golang.design
            desc: 'experimental project, not to be confused with official Go packages'
          - pkg: golang.org/x/exp/slices
            desc: 'use "slices" instead'
          - pkg: github.com/hashicorp/go-version
            desc: 'use "golang.org/x/mod/semver" or "coreos/go-semver/semver" instead'
          - pkg: github.com/microsoftgraph/msgraph-sdk-go
            desc: 'use "github.com/gravitational/teleport/lib/msgraph" instead'
          - pkg: github.com/cloudflare/cfssl
            desc: 'use "crypto" or "x/crypto" instead'
      # Prevent logrus from being imported by api and e. Once everything in teleport has been converted
      # to use log/slog this should be moved into the main block above.
      logrus:
        files:
          - '**/api/**'
          - '**/e/**'
          - '**/lib/srv/**'
        deny:
          - pkg: github.com/sirupsen/logrus
            desc: 'use "log/slog" instead'
      # Prevent importing internal packages in client tools or packages containing
      # common interfaces consumed by them that are known to bloat binaries or break builds
      # because they only support a single platform.
      client-tools:
        files:
          # Tests can do anything
          - '!$test'
          - '**/tool/tbot/**'
          - '**/lib/tbot/**'
          - '**/tool/tctl/**'
          - '**/tool/tsh/**'
          - '**/lib/client/**'
          - '**/lib/services/**'
          - '**/lib/service/servicecfg/**'
          - '**/lib/reversetunnelclient/**'
          - '**/lib/auth/authclient/**'
          - '**/lib/cloud/imds/**'
        allow:
          - github.com/gravitational/teleport/lib/cloud/imds
        deny:
          - pkg: github.com/gravitational/teleport/lib/auth$
            desc: 'lib/auth should not be imported to prevent increasing binary size, prefer lib/auth/authclient instead'
          - pkg: github.com/gravitational/teleport/lib/cloud
            desc: 'lib/cloud should not be imported to prevent increasing binary size'
          - pkg: github.com/gravitational/teleport/lib/srv$
            desc: 'lib/srv prevents client tools from build on non-linux platforms'
          - pkg: github.com/gravitational/teleport/lib/web$
            desc: 'lib/web should not be imported to prevent increasing binary size'
        list-mode: lax
      # Prevent importing dependencies that require CGO into tools that are
      # meant to be built with CGO_ENABLED=0
      cgo:
        files:
          # Tests can do anything
          - '!$test'
          - '**/tool/tbot/**'
          - '**/lib/client/**'
          - '!**/lib/integrations/**'
          - '**/integrations/**'
        deny:
          - pkg: github.com/gravitational/teleport/lib/bpf
            desc: '"lib/bpf" requires CGO'
          - pkg: github.com/gravitational/teleport/lib/backend/lite
            desc: '"lib/backend/lite" requires CGO'
          - pkg: github.com/gravitational/teleport/lib/cgroup
            desc: '"lib/cgroup" requires CGO'
          - pkg: github.com/gravitational/teleport/lib/config
            desc: '"lib/config" requires CGO via "lib/pam" and "lib/backend/lite"'
          - pkg: github.com/gravitational/teleport/lib/desktop/rdp/rdpclient
            desc: '"lib/desktop/rdp/rdpclient" requires CGO'
          - pkg: github.com/gravitational/teleport/lib/devicetrust/authn$
            desc: '"lib/devicetrust/authn" requires CGO on darwin'
          - pkg: github.com/gravitational/teleport/lib/devicetrust/enroll
            desc: '"lib/devicetrust/enroll" requires CGO on darwin'
          - pkg: github.com/gravitational/teleport/lib/devicetrust/native
            desc: '"lib/devicetrust/native" requires CGO on darwin'
          - pkg: github.com/gravitational/teleport/lib/inventory/metadata
            desc: '"lib/inventory/metadata" requires CGO'
          - pkg: github.com/gravitational/teleport/lib/pam
            desc: '"lib/pam" requires CGO'
          - pkg: github.com/gravitational/teleport/lib/srv/uacc
            desc: '"lib/srv/uacc" requires CGO'
          - pkg: github.com/gravitational/teleport/lib/system/signal
            desc: '"lib/system/signal" requires CGO'
          - pkg: github.com/gravitational/teleport/lib/vnet/daemon
            desc: '"vnet/daemon" requires CGO'
      # Prevent importing go-cmp into production code. From the go-cmp docs:
      # > It is intended to only be used in tests, as performance is not a goal
      # > and it may panic if it cannot compare the values. Its propensity towards
      # > panicking means that its unsuitable for production environments where a
      # > spurious panic may be fatal.
      go-cmp:
        files:
          # Tests can do anything
          - '!$test'
          # Various test helpers defined outside _test.go files are allowed
          - '!**/integration/helpers/**'
          - '!**/integrations/operator/controllers/resources/testlib/**'
          - '!**/lib/auth/test/**'
          - '!**/lib/services/suite/**'
          # Non-compliant legacy code. These should be converted to compare by another mechanism
          # and be removed from this list in the future. Use caution before adding any additional
          # exclusions to this list.
          - '!**/e/lib/accesslist/equal.go'
          - '!**/e/lib/auth/saml.go'
          - '!**lib/services/authority.go'
          - '!**lib/services/compare.go'
          - '!**/lib/services/local/access_list.go'
          - '!**/lib/services/local/users.go'
          - '!**/lib/services/server.go'
          - '!**/lib/services/user.go'
        deny:
          - pkg: github.com/google/go-cmp/cmp
            desc: '"github.com/google/go-cmp/cmp" should only be used in tests'
          - pkg: github.com/google/go-cmp/cmp/cmpopts
            desc: '"github.com/google/go-cmp/cmp/cmpopts" should only be used in tests'
  errorlint:
    comparison: true
    asserts: true
    errorf: true
  gci:
    sections:
      - standard # Standard section: captures all standard packages.
      - default # Default section: contains all imports that could not be matched to another section type.
      - prefix(github.com/gravitational/teleport) # Custom section: groups all imports with the specified Prefix.
      - prefix(github.com/gravitational/teleport/integrations/terraform,github.com/gravitational/teleport/integrations/event-handler)
    skip-generated: true # Skip generated files.
    custom-order: true # Required for "sections" to take effect.
  misspell:
    locale: US
  nolintlint:
    allow-unused: true # Enabled because of conditional builds / build tags.
    require-explanation: true
    require-specific: true
  revive:
    rules:
      - name: unused-parameter
        disabled: true
  sloglint:
    context: all
    key-naming-case: snake
    static-msg: true
    forbidden-keys:
      - level
      - msg
      - source
      - time
  testifylint:
    disable-all: true
    enable:
      - bool-compare
      - compares
      - empty
      - error-is-as
      - error-nil
      - expected-actual
      - float-compare
      - len
      - suite-extra-assert-call
      - suite-thelper
  forbidigo:
    forbid:
      - p: '^rsa\.GenerateKey$'
        msg: 'generating RSA keys is slow, use lib/cryptosuites to generate an appropriate key type'

output:
  uniq-by-line: false

run:
  go: '1.23'
  build-tags: []
  timeout: 15m