linters:
  enable:
    - depguard # Checks for dependencies that should not be (re)introduced. See "linter-settings" for further details.
    # - copyloopvar # Checks for loop variable copies in Go 1.22+
    - gofmt
    - goimports
    - gosec
    - ineffassign
    - misspell
    - nolintlint
    - revive
    - staticcheck
    - tenv # Detects using os.Setenv instead of t.Setenv since Go 1.17
    - unconvert
    - unused
    - govet
    - dupword # Checks for duplicate words in the source code
  disable:
    - errcheck

issues:
  include:
    - EXC0002
  max-issues-per-linter: 0
  max-same-issues: 0

  # Only using / doesn't work due to https://github.com/golangci/golangci-lint/issues/1398.
  exclude-rules:
    - path: 'cmd[\\/]containerd[\\/]builtins[\\/]'
      text: "blank-imports:"
    - path: 'contrib[\\/]fuzz[\\/]'
      text: "exported: func name will be used as fuzz.Fuzz"
    - path: 'archive[\\/]tarheader[\\/]'
      # conversion is necessary on Linux, unnecessary on macOS
      text: "unnecessary conversion"
    - path: 'integration[\\/]client'
      text: "dot-imports:"
    - linters:
        - revive
      text: "if-return"
    - linters:
        - revive
      text: "empty-block"
    - linters:
        - revive
      text: "superfluous-else"
    - linters:
        - revive
      text: "unused-parameter"
    - linters:
        - revive
      text: "unreachable-code"
    - linters:
        - revive
      text: "redefines-builtin-id"

linters-settings:
  depguard:
    rules:
      main:
        deny:
          - pkg: github.com/opencontainers/runc
            desc: We don't want to depend on runc (libcontainer), unless there is no other option; see https://github.com/opencontainers/runc/issues/3028.

  gosec:
    # The following issues surfaced when `gosec` linter
    # was enabled. They are temporarily excluded to unblock
    # the existing workflow, but still to be addressed by
    # future works.
    excludes:
      - G204
      - G305
      - G306
      - G402
      - G404
      - G115
  nolintlint:
    allow-unused: true

  exclude-dirs:
    - api
    - cluster
    - docs
    - docs/man
    - releases
    - test # e2e scripts

run:
  timeout: 8m