Mole/.golangci.yml at main · tw93/Mole · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# golangci-lint configuration for Mole
# https://golangci-lint.run/usage/configuration/

version: "2"

run:
  timeout: 5m
  # Only lint Go code in cmd directory
  modules-download-mode: readonly

linters:
  enable:
    # Default linters
    - govet
    - staticcheck
    - errcheck
    - ineffassign
    - unused
    # Additional linters
    - modernize
    - revive
    - unparam
    # Security scanner. mole deletes files and shells out, so gosec is
    # high-value here even with some false positives.
    - gosec

  settings:
    govet:
      enable-all: true
      disable:
        - shadow
        - fieldalignment # struct field alignment optimization is noisy
    errcheck:
      exclude-functions:
        - (io.Closer).Close
        - (*os/exec.Cmd).Run
        - (*os/exec.Cmd).Start
    revive:
      rules:
        - name: use-waitgroup-go
    staticcheck:
      checks: ["all", "-QF1003", "-SA9003"]
    gosec:
      # mole is a system tool: scanning user-supplied paths and shelling out
      # to mdls/du/osascript are core features, not vulnerabilities. We rely
      # on validatePath (covered by FuzzValidatePath) for path safety and
      # on osascript escaping in delete.go for command construction.
      excludes:
        - G104 # already covered by errcheck
        - G115 # integer overflow on stat.{Bavail,Bsize,Dev,Ino} and FileInfo.Size; macOS-safe
        - G204 # subprocess with variable; required for du/mdls/osascript/mdfind
        - G301 # mkdir perms; we use 0o755 intentionally
        - G302 # chmod perms; same
        - G304 # file inclusion via variable; we scan user paths by design
        - G306 # WriteFile perms; we use 0o644 intentionally
        - G702 # command injection taint; mdfind/du take user paths by design
        - G703 # path traversal taint; scanning user paths is mole's purpose

  exclusions:
    rules:
      # Ignore certain patterns in test files
      - path: _test\.go
        linters:
          - errcheck
          - gosec
          - unparam
      # Ignore errors from os.Remove in cleanup code
      - text: "os.Remove"
        linters:
          - errcheck