ai-gateway/.golangci.yml at main · ferro-labs/ai-gateway · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
version: "2"

run:
  timeout: 5m

linters:
  enable:
    - bodyclose
    - copyloopvar
    - depguard
    - dupl
    - errcheck
    - errorlint
    - goconst
    - gocritic
    - gocyclo
    - gosec
    - govet
    - ineffassign
    - misspell
    - nolintlint
    - prealloc
    - revive
    - spancheck
    - staticcheck
    - unconvert
    - unparam
    - unused
    - noctx
    - maintidx

  settings:
    depguard:
      rules:
        # All logging goes through pkg/logger so output stays uniform and
        # structured. pkg/logger itself is the one place allowed to wrap slog.
        no-direct-logging:
          files:
            - "!**/pkg/logger/**"
          deny:
            - pkg: log/slog
              desc: use github.com/ferro-labs/ai-gateway/pkg/logger instead of importing log/slog directly
            - pkg: github.com/ferro-labs/ai-gateway/internal/logging
              desc: internal/logging was removed; use github.com/ferro-labs/ai-gateway/pkg/logger
        # gopkg.in/yaml.v3 is unmaintained upstream. go.yaml.in/yaml/v3 is the
        # YAML org's maintained fork and a drop-in (same package name, same API).
        # It remains in the module graph indirectly via test dependencies; this
        # rule only stops it being imported directly again.
        no-archived-yaml:
          deny:
            - pkg: gopkg.in/yaml.v3
              desc: gopkg.in/yaml.v3 is unmaintained; use go.yaml.in/yaml/v3
    gocyclo:
      min-complexity: 30
    dupl:
      threshold: 150
    nolintlint:
      require-explanation: true
      require-specific: true
      allow-unused: false

  exclusions:
    paths:
      - web
    rules:
      # dupl on tests is noise — table fixtures and mock setups legitimately
      # repeat structure across cases. Enforce it on production code only.
      - path: _test\.go
        linters:
          - dupl
      # unparam on tests is noise: mock methods satisfy production interfaces
      # (so a mandatory error return may always be nil), and helper return
      # values exist for symmetry. Enforce it on production code only.
      - path: _test\.go
        linters:
          - unparam
      # otelSpan.StartChild and otelProvider.StartAttemptSpan are span
      # factories: each returns the span (wrapped in otelSpan) for the caller
      # to end via End, per the observability.Span contract. spancheck cannot
      # follow the span through the wrapper, so it wrongly reports a leak on
      # the child and attempt spans here. Scoped to those two span variables,
      # so an unrelated leak in this file is still reported.
      - path: internal/otel/provider\.go
        linters:
          - spancheck
        text: "(child|attempt).End"
      # Test fixtures legitimately repeat literals (tool names, IDs, JSON
      # fragments); enforce the constant rule on production code only.
      - path: _test\.go
        linters:
          - goconst
      # Tests compare error values by identity on purpose; the wrapped-error
      # checks apply to production code only.
      - path: _test\.go
        linters:
          - errorlint
      # staticcheck's SA5011 does not reliably recognize a preceding
      # t.Fatal/t.Fatalf-guarded nil check as terminating the branch in some
      # table-driven/multi-guard test shapes, and flags the subsequent access
      # as a possible nil dereference. Scoped to SA5011 only (via text) so
      # other staticcheck findings in tests still apply.
      - path: _test\.go
        linters:
          - staticcheck
        text: "SA5011"
      # RouteStream's remaining complexity (after extracting the MCP-loop-
      # equivalent safe blocks — see resolveStreamOrError and
      # runBeforePluginsStream) is the streamwrap.MeterMeta closure setup
      # (CompletionFn/ErrorFn/SpanFinisher), which captures and mutates pctx
      # (nil-out + sync.Once-guarded release) across three closures.
      # Extracting it further means passing pctx as **plugin.Context or
      # restructuring the release semantics — both add real risk of a
      # double-release or nil-deref in the hottest streaming path. See
      # gateway_stream.go's test coverage (RunAfterReceivesStreamResponse,
      # RunOnErrorReceivesStreamError, AfterPluginRejectRunsOnError,
      # Close_DuringInFlightRouteStreamDoesNotPanic) for what protects this
      # behavior today.
      - path: gateway_stream\.go
        linters:
          - maintidx
        text: "RouteStream"