golangci-lint scanning in "vendor" folder

[ozkansen]

When I run golangci-lint, it corrects the "vendor" folder. Normally, a local folder for these GO packages shouldn't be touched, right?

[ldez]

Hello,

The folder vendor is excluded by default by the Go tooling we use inside golangci-lint.

Can you provide your project directory tree or a public example?

[ozkansen]

version: "2"

run:
  go: '1.25'
  concurrency: 4
  issues-exit-code: 0
  allow-parallel-runners: true
  build-tags:
    - 'integration'

formatters:
  enable:
    - gci
    - gofmt
    - gofumpt
    - golines

  settings:
    gci:
      sections:
        - standard
        - default
        - prefix(github)
        - prefix(shared)
        - prefix(x)
      no-inline-comments: true
      no-prefix-comments: true
      custom-order: true
      no-lex-order: true
    gofmt:
      simplify: true
      rewrite-rules:
        - pattern: 'interface{}'
          replacement: 'any'
        - pattern: 'a[b:len(a)]'
          replacement: 'a[b:]'
    gofumpt:
      extra-rules: true
    golines:
      max-len: 120
      tab-len: 4
      shorten-comments: true
      reformat-tags: true
      chain-split-dots: true
linters:
  default: none
  enable:
    - errcheck
    - govet
    - ineffassign
    - staticcheck
    - unused
    - whitespace
    - errorlint
    - gocritic
    - gosec
    - testifylint
    - prealloc
    - reassign
    - ireturn
  settings:
    errcheck:
      check-type-assertions: true
      check-blank: true
      disable-default-exclusions: true
    gocritic:
      enable-all: true
    govet:
      enable-all: true
    whitespace:
      multi-if: true
      multi-func: true
    staticcheck:
      checks:
        - all
        - -ST1000
    testifylint:
      enable-all: true
    prealloc:
      simple: true
      range-loops: true
      for-loops: true
    reassign:
      patterns:
        - ".*"
    unused:
      field-writes-are-uses: true
      post-statements-are-reads: true
      exported-fields-are-used: true
      parameters-are-used: true
      local-variables-are-used: true
      generated-is-used: true

run command:

golangci-lint run --config=.golangci.yml --fix ./...

after:

[ldez]

could you provide your go.mod (with your real module name)?

[ozkansen]

The company's project address was registered, so I wrote it as "x." An entry similar to "github.com/ozkansen/project" was written.

[ldez]

I created a script to try to reproduce the behavior:

setup.sh

#!/bin/bash -e

EXAMPLE_DIR='example-vendor'

cd /tmp/
rm -rf "${EXAMPLE_DIR}"
mkdir "${EXAMPLE_DIR}" && cd $_

## Create the module and set up git
git init -q
go mod init 'github.com/example/vendor'

## Create golangci-lint configuration file
cat >> .golangci.yml <<EOF
version: "2"

run:
  allow-parallel-runners: true

formatters:
  enable:
    - gci
    - gofmt
    - gofumpt
    - golines

  settings:
    gci:
      no-inline-comments: true
      no-prefix-comments: true
      custom-order: true
      no-lex-order: true
    gofmt:
      simplify: true
      rewrite-rules:
        - pattern: 'interface{}'
          replacement: 'any'
        - pattern: 'a[b:len(a)]'
          replacement: 'a[b:]'
    gofumpt:
      extra-rules: true
    golines:
      max-len: 120
      tab-len: 4
      shorten-comments: true
      reformat-tags: true
      chain-split-dots: true
linters:
  default: none
  enable:
    - errcheck
    - govet
    - ineffassign
    - staticcheck
    - unused
    - whitespace
    - errorlint
    - gocritic
    - gosec
    - testifylint
    - prealloc
    - reassign
    - ireturn
  settings:
    errcheck:
      check-type-assertions: true
      check-blank: true
    gocritic:
      enable-all: true
    govet:
      enable-all: true
    whitespace:
      multi-if: true
      multi-func: true
    staticcheck:
      checks:
        - all
        - -ST1000
    testifylint:
      enable-all: true
    prealloc:
      simple: true
      range-loops: true
      for-loops: true
    reassign:
      patterns:
        - ".*"
    unused:
      field-writes-are-uses: true
      post-statements-are-reads: true
      exported-fields-are-used: true
      parameters-are-used: true
      local-variables-are-used: true
      generated-is-used: true
EOF

## Create a basic main.
cat >> main.go <<EOF
package main

import (
	"fmt"

	_ "filippo.io/edwards25519"
	_ "github.com/Azure/go-ansiterm"
)

func main() {
	fmt.Println("hello")
}
EOF

## Add dependencies
go get filippo.io/edwards25519@latest
go get github.com/Azure/go-ansiterm@latest
go mod tidy
go mod vendor

## Commit
git add .
git commit -q -m "chore: base"

## Run golangci-lint
golangci-lint run --issues-exit-code=0
golangci-lint run --issues-exit-code=0 --fix

## Show the diff
git diff

## Clean
rm -rf "${EXAMPLE_DIR}"

The output:

$ ./setup.sh
go: creating new go.mod: module github.com/example/vendor
go: added filippo.io/edwards25519 v1.1.0
go: added github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c
0 issues.
0 issues.

As you can see, I don't reproduce the behavior.

The vendor folder is always excluded, not by golangci-lint but by the Go tooling it uses.

Unless you can provide a reproducible example, I think the behavior is not related to golangci-lint (or the Go tooling), but to something wrongly configured inside your environment, your module, etc.

[ozkansen]

You're right, I'll review it again. If I see similar behavior, I'll write back here. Thanks.