version: "2"

run:

timeout: 5m

modules-download-mode: readonly

linters:

enable:

- govet

- errcheck

- staticcheck

- unused

- ineffassign

- bodyclose

- noctx

- gosec

- prealloc

settings:

govet:

enable:

- shadow

errcheck:

check-type-assertions: false

exclude-functions:

- (io.Closer).Close

- (*os.File).Close

- (net/http.ResponseWriter).Write

- fmt.Fprintf

- fmt.Fprintln

- os.Remove

gosec:

excludes:

- G104 # unhandled errors (too noisy with logger calls)

- G115 # integer overflow — false positives on bounded values and byte casts

- G204 # subprocess with variable — intentional in self-update

- G301 # dir perms 0755 — standard for user dirs

- G302 # file perms 0755 — intentional for executables

- G304 # file inclusion via variable — internal paths only

# G702-G705 (taint analysis) suppressed via inline nolint comments;

# these IDs are only available in newer gosec versions.

exclusions:

rules:

- path: _test\.go

linters:

- errcheck

- gosec

- noctx