version: "2"
run:
  build-tags:
    - integ
    - integfuzz
linters:
  default: none
  enable:
    - copyloopvar
    - depguard
    - errcheck
    - gocritic
    - gosec
    - govet
    - ineffassign
    - lll
    - misspell
    - revive
    - staticcheck
    - unconvert
    - unparam
    - unused
  settings:
    depguard:
      rules:
        DenyGogoProtobuf:
          files:
            - $all
          deny:
            - pkg: github.com/gogo/protobuf
              desc: gogo/protobuf is deprecated, use golang/protobuf
        AllGoFiles:
          files:
            - $all
          deny:
            - pkg: golang.org/x/net/http2/h2c
              desc: h2c.NewHandler is unsafe; use wrapper istio.io/istio/pkg/h2c
            - pkg: github.com/golang/protobuf/jsonpb
              desc: don't use the jsonpb package directly; use util/protomarshal instead
            - pkg: google.golang.org/protobuf/encoding/protojson
              desc: don't use the protojson package directly; use util/protomarshal instead
            - pkg: gomodules.xyz/jsonpatch/v3
              desc: don't use v3; v2 is orders of magnitude higher performance
            - pkg: k8s.io/apimachinery/pkg/util/sets
              desc: use istio.io/istio/pkg/util/sets
            - pkg: k8s.io/utils/set
              desc: use istio.io/istio/pkg/util/sets
            - pkg: k8s.io/utils/env
              desc: use istio.io/istio/pkg/env
            - pkg: k8s.io/utils/strings/slices
              desc: use istio.io/istio/pkg/slices
            - pkg: k8s.io/utils/pointer
              desc: use istio.io/istio/pkg/ptr
            - pkg: go.opencensus.io
              desc: do not use OpenCensus; use OpenTelemetry instead
            - pkg: golang.org/x/exp/maps
              desc: do not use golang.org/x/exp/maps; use istio.io/istio/pkg/maps instead
            - pkg: maps
              desc: do not use maps; use istio.io/istio/pkg/maps instead
            - pkg: golang.org/x/exp/slices
              desc: do not use golang.org/x/exp/slices; use istio.io/istio/pkg/slices instead
            - pkg: slices
              desc: do not use slices; use istio.io/istio/pkg/slices instead
            - pkg: gopkg.in/yaml.v2
              desc: do not use gopkg.in/yaml.v2; use sigs.k8s.io/yaml instead
            - pkg: gopkg.in/yaml.v3
              desc: do not use gopkg.in/yaml.v3; use sigs.k8s.io/yaml instead
            - pkg: github.com/ghodss/yaml
              desc: do not use github.com/ghodss/yaml; use sigs.k8s.io/yaml instead
        DenyOpenTelemetry:
          files:
            - $all
            - '!**/pkg/monitoring/**'
            - '!**/pkg/tracing/**'
          deny:
            - pkg: go.opentelemetry.io/otel
              desc: do not use OpenTelemetry directly; use pkg/monitoring
            - pkg: go.opentelemetry.io/otel/metric
              desc: do not use OpenTelemetry directly; use pkg/monitoring
        DenyOperatorAndIstioctl:
          files:
            - '!$test'
            - '!**/operator/**'
            - '!**/istioctl/**'
            - '!**/tools/bug-report/**'
            - '!**/pkg/kube/**'
            - '!**/pkg/url/**'
            - '!**/pkg/test/framework/**'
            - '!**/tests/fuzz/**'
          deny:
            - pkg: istio.io/istio/operator
              desc: operator should not be imported
            - pkg: istio.io/istio/istioctl
              desc: istioctl should not be imported
        DenyProtobufV1:
          files:
            - $all
          deny:
            - pkg: github.com/golang/protobuf/ptypes
              desc: do not use github.com/golang/protobuf/ptypes; use google.golang.org/protobuf/types/known instead
    errcheck:
      check-type-assertions: false
      check-blank: false
    gocritic:
      disable-all: true
      enabled-checks:
        - appendCombine
        - argOrder
        - assignOp
        - badCond
        - boolExprSimplify
        - builtinShadow
        - captLocal
        - caseOrder
        - codegenComment
        - commentedOutCode
        - commentedOutImport
        - defaultCaseOrder
        - deprecatedComment
        - docStub
        - dupArg
        - dupBranchBody
        - dupCase
        - dupSubExpr
        - elseif
        - emptyFallthrough
        - equalFold
        - flagDeref
        - flagName
        - hexLiteral
        - indexAlloc
        - initClause
        - methodExprCall
        - nilValReturn
        - octalLiteral
        - offBy1
        - rangeExprCopy
        - regexpMust
        - sloppyLen
        - stringXbytes
        - switchTrue
        - typeAssertChain
        - typeSwitchVar
        - typeUnparen
        - underef
        - unlambda
        - unnecessaryBlock
        - unslice
        - valSwap
        - weakCond
    gosec:
      includes:
        - G401
        - G402
        - G404
    govet:
      disable:
        - shadow
    lll:
      line-length: 160
      tab-width: 1
    misspell:
      locale: US
      ignore-rules:
        - cancelled
    revive:
      confidence: 0
      severity: warning
      rules:
        - name: blank-imports
        - name: context-keys-type
        - name: time-naming
        - name: var-declaration
        - name: unexported-return
        - name: errorf
        - name: context-as-argument
        - name: dot-imports
        - name: error-return
        - name: error-strings
        - name: error-naming
        - name: increment-decrement
        - name: var-naming
        - name: package-comments
        - name: range
        - name: receiver-naming
        - name: indent-error-flow
        - name: superfluous-else
        - name: modifies-parameter
        - name: unreachable-code
        - name: struct-tag
        - name: constant-logical-expr
        - name: bool-literal-in-expr
        - name: redefines-builtin-id
        - name: imports-blocklist
        - name: range-val-in-closure
        - name: range-val-address
        - name: waitgroup-by-value
        - name: atomic
        - name: call-to-gc
        - name: duplicated-imports
        - name: string-of-int
        - name: defer
          arguments:
            - - call-chain
        - name: unconditional-recursion
        - name: identical-branches
    unparam:
      check-exported: false
  exclusions:
    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:
      - linters:
          - errcheck
          - maligned
        path: _test\.go$|tests/|samples/
      - path: _test\.go$
        text: 'dot-imports: should not use dot imports'
      - linters:
          - staticcheck
        text: 'SA1019: package github.com/golang/protobuf/jsonpb'
      - linters:
          - staticcheck
        text: 'SA1019: "github.com/golang/protobuf/jsonpb"'
      - linters:
          - staticcheck
        text: 'SA1019: grpc.Dial is deprecated: use NewClient instead'
      - linters:
          - staticcheck
        text: 'SA1019: grpc.DialContext is deprecated: use NewClient instead'
      - linters:
          - staticcheck
        text: 'SA1019: grpc.WithBlock is deprecated'
      - linters:
          - staticcheck
        text: 'SA1019: grpc.FailOnNonTempDialError'
      - linters:
          - staticcheck
        text: 'SA1019: grpc.WithReturnConnectionError'
      - path: (.+)\.go$
        text: composite literal uses unkeyed fields
      # TODO: remove following rule in the future
      - linters:
          - staticcheck
        text: 'QF'
      - linters:
          - staticcheck
        text: 'ST1005'
      - linters:
          - staticcheck
        text: 'S1007'
      # TODO: remove once we have updated package names
      - linters:
          - revive
        text: "var-naming: avoid meaningless package names"
    paths:
      - third_party$
      - builtin$
      - examples$
      - vendor$
      - third_party$
      - builtin$
      - examples$
issues:
  max-issues-per-linter: 0
  max-same-issues: 0
formatters:
  enable:
    - gci
    - gofumpt
    - goimports
  settings:
    gci:
      sections:
        - standard
        - default
        - prefix(istio.io/)
    goimports:
      local-prefixes:
        - istio.io/
  exclusions:
    generated: lax
    paths:
      - third_party$
      - builtin$
      - examples$
      - vendor$
      - third_party$
      - builtin$
      - examples$
