Add golangci-lint and yamllint (#365)

* Add Makefile and yamllint config

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

* Add golangci-lint config

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

* Add golangci-lint config

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

* add linters to pre-submit

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

* add issue link to todos

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

* Fix whitespace issue

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

.github/workflows/codeql-analysis.yml

@@ -13,12 +13,12 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ main, '*' ]
+    branches: [main, "*"]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ main ]
+    branches: [main]
   schedule:
-    - cron: '30 0 * * 2'
+    - cron: "30 0 * * 2"
 
 permissions: read-all
 
@@ -34,38 +34,38 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'go' ]
+        language: ["go"]
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
         # Learn more about CodeQL language support at https://git.io/codeql-language-support
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.1.2
+      - name: Checkout repository
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.1.2
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32
+      # Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
 
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
 
-    #- run: |
-    #   make bootstrap
-    #   make release
+      # - run: |
+      #     make bootstrap
+      #     make release
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32

.github/workflows/pre-submit.cli.yml

@@ -1,12 +1,12 @@
 name: Pre submits cli
-on: 
+on:
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
   workflow_dispatch:
   # Used in combination with schedule.cli.yml
   # to avoid duplicating the test code.
   schedule:
-    - cron: '25 6 * * 5'
+    - cron: "25 6 * * 5"
 
 permissions: read-all
 
@@ -20,7 +20,7 @@ jobs:
       - name: setup-go
         uses: actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f # tag=v3.3.1
         with:
-          go-version: '1.18'
+          go-version: "1.18"
 
       - name: Save event name
         env:

.github/workflows/pre-submit.lint.yml

@@ -7,6 +7,45 @@ permissions:
   contents: read
 
 jobs:
+  golangci-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
+      - uses: actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f # tag=v3.3.1
+        with:
+          go-version: "1.18"
+      - env:
+          GOLANGCI_LINT_VERSION: "1.46.2"
+          GOLANGCI_LINT_CHECKSUM: "242cd4f2d6ac0556e315192e8555784d13da5d1874e51304711570769c4f2b9b"
+        run: |
+          set -euo pipefail
+
+          #Install golangci-lint
+          curl -sSLo golangci-lint.tar.gz "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64.tar.gz"
+          echo "golangci-lint checksum is $(sha256sum golangci-lint.tar.gz | awk '{ print $1 }')"
+          echo "expected checksum is $GOLANGCI_LINT_CHECKSUM"
+          echo "$GOLANGCI_LINT_CHECKSUM golangci-lint.tar.gz" | sha256sum --strict --check --status || exit -2
+          tar xf golangci-lint.tar.gz
+          mv golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64/golangci-lint /usr/local/bin
+
+          # Run golangci-lint
+          make golangci-lint
+
+  yamllint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
+      - env:
+          YAMLLINT_VERSION: "1.26.3"
+        run: |
+          set -euo pipefail
+
+          # Install yamllint
+          pip install "yamllint==${YAMLLINT_VERSION}"
+
+          # Run yamllint
+          make yamllint
+
   eslint:
     runs-on: ubuntu-latest
     steps:
@@ -14,5 +53,4 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 16
-      - working-directory: actions/installer
-        run: make lint
+      - run: make eslint

.github/workflows/release.yml

@@ -1,6 +1,6 @@
 name: Verifier releaser
 
-on: 
+on:
   # For manual tests.
   workflow_dispatch:
   push:
@@ -8,7 +8,7 @@ on:
       - "*" # triggers only if push new tag version, like `0.8.4`.
   # Run daily as a dry-run/test.
   schedule:
-    - cron: '0 1 * * *'
+    - cron: "0 1 * * *"
 
 permissions: read-all
 

.github/workflows/scorecards.yml

@@ -3,9 +3,9 @@ on:
   # Only the default branch is supported.
   branch_protection_rule:
   schedule:
-    - cron: '25 6 * * 5'
+    - cron: "25 6 * * 5"
   push:
-    branches: [ "main" ]
+    branches: ["main"]
 
 # Declare default permissions as read only.
 permissions: read-all
@@ -22,7 +22,7 @@ jobs:
       # Needs for private repositories.
       contents: read
       actions: read
-    
+
     steps:
       - name: "Checkout code"
         uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.1.2
@@ -41,8 +41,8 @@ jobs:
           # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
 
           # Publish the results for public repositories to enable scorecard badges. For more details, see
-          # https://github.com/ossf/scorecard-action#publishing-results. 
-          # For private repositories, `publish_results` will automatically be set to `false`, regardless 
+          # https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories, `publish_results` will automatically be set to `false`, regardless
           # of the value entered here.
           publish_results: true
 
@@ -54,7 +54,7 @@ jobs:
           name: SARIF file
           path: results.sarif
           retention-days: 5
-      
+
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
         uses: github/codeql-action/upload-sarif@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32

.golangci.yml

@@ -0,0 +1,173 @@
+---
+run:
+  concurrency: 2
+  deadline: 5m
+issues:
+  include:
+    - EXC0012
+    - EXC0013
+    - EXC0014
+    - EXC0015
+  # Maximum issues count per one linter.
+  # Set to 0 to disable.
+  # Default: 50
+  max-issues-per-linter: 0
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
+  max-same-issues: 0
+  new-from-rev: ""
+linters:
+  disable-all: true
+  enable:
+    - asciicheck
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - deadcode
+    - depguard
+    - dogsled
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - errcheck
+    - errorlint
+    - exhaustive
+    - exportloopref
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - gci
+    - gochecknoinits
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - gocognit
+    - goconst
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - gocritic
+    - gocyclo
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - godot
+    - godox
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - goerr113
+    - gofmt
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - gofumpt
+    - goheader
+    - goimports
+    - gomodguard
+    - goprintffuncname
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - gosec
+    - gosimple
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - govet
+    - ineffassign
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - lll
+    - makezero
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - misspell
+    - nakedret
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - nestif
+    - nolintlint
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - paralleltest
+    - predeclared
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - revive
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - staticcheck
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - stylecheck
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - thelper
+    - typecheck
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - unconvert
+    - unused
+    - varcheck
+    - whitespace
+    # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter
+    # - wrapcheck
+linters-settings:
+  errcheck:
+    check-type-assertions: true
+    check-blank: true
+  govet:
+    enable:
+      - fieldalignment
+  godox:
+    keywords:
+      - BUG
+      - FIXME
+      - HACK
+  gci:
+    sections:
+      - standard
+      - default
+      - prefix(github.com/slsa-framework/slsa-github-generator)
+  gocritic:
+    enabled-checks:
+      # Diagnostic
+      - appendAssign
+      - argOrder
+      - badCond
+      - caseOrder
+      - codegenComment
+      - commentedOutCode
+      - deprecatedComment
+      - dupArg
+      - dupBranchBody
+      - dupCase
+      - dupSubExpr
+      - exitAfterDefer
+      - flagDeref
+      - flagName
+      - nilValReturn
+      - offBy1
+      - sloppyReassign
+      - weakCond
+      - octalLiteral
+
+      # Performance
+      - appendCombine
+      - equalFold
+      - hugeParam
+      - indexAlloc
+      - rangeExprCopy
+      - rangeValCopy
+
+      # Style
+      - assignOp
+      - boolExprSimplify
+      - captLocal
+      - commentFormatting
+      - commentedOutImport
+      - defaultCaseOrder
+      - docStub
+      - elseif
+      - emptyFallthrough
+      - emptyStringTest
+      - hexLiteral
+      - ifElseChain
+      - methodExprCall
+      - regexpMust
+      - singleCaseSwitch
+      - sloppyLen
+      - stringXbytes
+      - switchTrue
+      - typeAssertChain
+      - typeSwitchVar
+      - underef
+      - unlabelStmt
+      - unlambda
+      - unslice
+      - valSwap
+      - wrapperFunc
+      - yodaStyleExpr
+
+      # Opinionated
+      - builtinShadow
+      - importShadow
+      - initClause
+      - nestingReduce
+      - paramTypeCombine
+      - ptrToRefParam
+      - typeUnparen
+      - unnecessaryBlock

.yamllint.yaml

@@ -0,0 +1,17 @@
+---
+extends: default
+
+ignore: |
+  node_modules/
+  vendor/
+
+rules:
+  comments:
+    # prettier formats comments one space from content
+    min-spaces-from-content: 1
+  document-start: disable
+  line-length: disable
+  truthy:
+    allowed-values: ["true", "false"]
+    # Allow Github Actions keys like 'on'
+    check-keys: false

Makefile

@@ -0,0 +1,57 @@
+SHELL := /bin/bash
+OUTPUT_FORMAT = $(shell if [ "${GITHUB_ACTIONS}" == "true" ]; then echo "github"; else echo ""; fi)
+
+.PHONY: help
+help: ## Shows all targets and help from the Makefile (this message).
+	@echo "slsa-github-generator Makefile"
+	@echo "Usage: make [COMMAND]"
+	@echo ""
+	@grep --no-filename -E '^([/a-z.A-Z0-9_%-]+:.*?|)##' $(MAKEFILE_LIST) | \
+		awk 'BEGIN {FS = "(:.*?|)## ?"}; { \
+			if (length($$1) > 0) { \
+				printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2; \
+			} else { \
+				if (length($$2) > 0) { \
+					printf "%s\n", $$2; \
+				} \
+			} \
+		}'
+
+## Testing
+#####################################################################
+
+.PHONY: unit-test
+unit-test: ## Runs all unit tests.
+	# Run unit tests for the detect-workflow action.
+	make -C .github/actions/detect-workflow/ unit-test
+	go mod vendor
+	go test -mod=vendor -v ./...
+
+
+## Linters
+#####################################################################
+
+.PHONY: lint
+lint: golangci-lint eslint yamllint ## Run all linters.
+
+.PHONY: golangci-lint
+golangci-lint: ## Runs the golangci-lint linter.
+	@set -e;\
+		extraargs=""; \
+		if [ "$(OUTPUT_FORMAT)" == "github" ]; then \
+			extraargs="--out-format github-actions"; \
+		fi; \
+		golangci-lint run -c .golangci.yml ./... $$extraargs
+
+.PHONY: eslint
+eslint: ## Runs the eslint linter.
+	make -C actions/installer lint
+
+.PHONY: yamllint
+yamllint: ## Runs the yamllint linter.
+	@set -e;\
+		extraargs=""; \
+		if [ "$(OUTPUT_FORMAT)" == "github" ]; then \
+			extraargs="-f github"; \
+		fi; \
+		yamllint -c .yamllint.yaml . $$extraargs

cli/slsa-verifier/main_test.go

@@ -770,7 +770,6 @@ func Test_runVerifyGHAArtifactImage(t *testing.T) {
 						t.Errorf(fmt.Sprintf("matches failed: %v", err))
 					}
 				}
-
 			}
 		})
 	}