version: "2"
linters:
  default: none
  enable:
    - bodyclose
    - dupword
    - durationcheck
    - errcheck
    - forbidigo
    - gocritic
    - gosec
    - govet
    - ineffassign
    - mirror
    - misspell
    - nilerr
    - nilnil
    - predeclared
    - revive
    - sqlclosecheck
    - staticcheck
    - unused
    - wastedassign
  settings:
    errcheck:
      check-type-assertions: false
    gocritic:
      disabled-checks:
        - commentFormatting
        - captLocal
        - deprecatedComment
    gosec:
      includes:
        - G101
        - G103
        - G104
        - G106
        - G108
        - G109
        - G110
        - G111
        - G201
        - G202
        - G203
        - G301
        - G302
        - G303
        - G304
        - G305
        - G306
        - G307
        - G403
        - G502
        - G503
        - G504
        - G601
        - G602
    govet:
      enable:
        - nilness
      disable:
        # The inline analyzer flags x/exp/maps Clone/Clear with //go:fix inline
        # directives but cannot perform the rewrite due to generic type
        # parameter inference limitations in the Go inliner.
        - inline
      enable-all: false
    revive:
      rules:
        - name: exported
          arguments:
            - checkPrivateReceivers
            - sayRepetitiveInsteadOfStutters
          severity: warning
          disabled: false
  exclusions:
    generated: lax
    presets:
      - comments
      - common-false-positives
      - legacy
      - std-error-handling
    rules:
      - linters:
          - forbidigo
        path: management/cmd/root\.go
      - linters:
          - forbidigo
        path: signal/cmd/root\.go
      - linters:
          - unused
        path: sharedsock/filter\.go
      - linters:
          - unused
        path: client/firewall/iptables/rule\.go
      - linters:
          - gosec
          - mirror
        path: test\.go
      - linters:
          - nilnil
        path: mock\.go
      - linters:
          - staticcheck
        text: grpc.DialContext is deprecated
      - linters:
          - staticcheck
        text: grpc.WithBlock is deprecated
      - linters:
          - staticcheck
        text: "QF1001"
      - linters:
          - staticcheck
        text: "QF1008"
      - linters:
          - staticcheck
        text: "QF1012"
      # client/ui/main.go uses //go:embed all:frontend/dist; the
      # directory is populated by `pnpm build` in the release pipeline
      # and missing at lint time, so the embed parses to "no matching
      # files found" — surfaced by golangci-lint's typecheck pre-pass.
      # Suppress just that one diagnostic; the rest of the package
      # (services/, tray.go, grpc.go, ...) still gets linted normally.
      - linters:
          - typecheck
        path: client/ui/main\.go
        text: "pattern all:frontend/dist"
    paths:
      - third_party$
      - builtin$
      - examples$
issues:
  max-same-issues: 5
formatters:
  exclusions:
    generated: lax
    paths:
      - third_party$
      - builtin$
      - examples$