Add golangci-lint to CI

Signed-off-by: Austin Vazquez <[email protected]>

Author: austinvazquez

.github/workflows/ci.yml

@@ -47,3 +47,38 @@ jobs:
 
     - name: Run tests
       run: make test
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: stable
+
+    - name: golangci-lint (apparmor)
+      id: lint-apparmor
+      uses: golangci/golangci-lint-action@v8
+      with:
+        version: latest
+        working-directory: apparmor
+      continue-on-error: true
+
+    - name: golangci-lint (seccomp)
+      id: lint-seccomp
+      uses: golangci/golangci-lint-action@v8
+      with:
+        version: latest
+        working-directory: seccomp
+      continue-on-error: true
+
+    - name: Check lint results
+      if: steps.lint-apparmor.outcome == 'failure' || steps.lint-seccomp.outcome == 'failure'
+      run: |
+        echo "One or more lint checks failed"
+        exit 1

.golangci.yml

@@ -0,0 +1,74 @@
+version: "2"
+
+run:
+  issues-exit-code: 1
+  tests: true
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+
+linters:
+  enable:
+    - asasalint                 # Detects "[]any" used as argument for variadic "func(...any)".
+    - copyloopvar               # Detects places where loop variables are copied.
+    - depguard
+    - dogsled                   # Detects assignments with too many blank identifiers.
+    - dupword                   # Detects duplicate words.
+    - durationcheck             # Detect cases where two time.Duration values are being multiplied in possibly erroneous ways.
+    - errorlint                 # Detects code that will cause problems with the error wrapping scheme introduced in Go 1.13.
+    - errchkjson                # Detects unsupported types passed to json encoding functions and reports if checks for the returned error can be omitted.
+    - exhaustive                # Detects missing options in enum switch statements.
+    - exptostd                  # Detects functions from golang.org/x/exp/ that can be replaced by std functions.
+    - fatcontext                # Detects nested contexts in loops and function literals.
+    - forbidigo
+    - gocheckcompilerdirectives # Detects invalid go compiler directive comments (//go:).
+    - gocritic                  # Detects for bugs, performance and style issues.
+    - gosec                     # Detects security problems.
+    - govet
+    - iface                     # Detects incorrect use of interfaces. Currently only used for "identical" interfaces in the same package.
+    - importas
+    - ineffassign
+    - makezero                  # Finds slice declarations with non-zero initial length.
+    - mirror                    # Detects wrong mirror patterns of bytes/strings usage.
+    - misspell                  # Detects commonly misspelled English words in comments.
+    - nakedret                  # Detects uses of naked returns.
+    - nilnesserr                # Detects returning nil errors. It combines the features of nilness and nilerr,
+    - nosprintfhostport         # Detects misuse of Sprintf to construct a host with port in a URL.
+    - reassign                  # Detects reassigning a top-level variable in another package.
+    - revive                    # Metalinter; drop-in replacement for golint.
+    - spancheck                 # Detects mistakes with OpenTelemetry/Census spans.
+    - staticcheck
+    - thelper
+    - unconvert                 # Detects unnecessary type conversions.
+    - unused
+    - usestdlibvars             # Detects the possibility to use variables/constants from the Go standard library.
+    - wastedassign              # Detects wasted assignment statements.
+
+  disable:
+    - errcheck
+    - depguard                  # TODO(austinvazquez): Enable this linter after fixing the issues it reports.
+
+  settings:
+    errorlint:
+      # Check whether fmt.Errorf uses the %w verb for formatting errors.
+      errorf: false
+      # See the https://github.com/polyfloyd/go-errorlint for caveats.
+      asserts: false
+
+    gosec:
+      excludes:
+        - G304 # G304: Potential file inclusion via variable.
+        - G306 # G306: Expect WriteFile permissions to be 0600 or less (too restrictive; also flags "0o644" permissions)
+
+    revive:
+      rules:
+        - name: package-comments
+          disabled: true
+
+    staticcheck:
+      checks:
+        - all
+        - -ST1000 # Incorrect or missing package comment; https://staticcheck.dev/docs/checks/#ST1000
+        - -ST1005 # Incorrectly formatted error string; https://staticcheck.dev/docs/checks/#ST1005