chore: migrate to golangci-lint v2 (#533)

Author: knqyf263

.github/workflows/go.yml

@@ -15,9 +15,9 @@ jobs:
           go-version-file: go.mod
 
       - name: Lint
-        uses: golangci/golangci-lint-action@v6.2.0
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
-          version: v1.63
+          version: v2.1.6
           args: --verbose
 
       - name: Test

.golangci.yaml

@@ -0,0 +1,212 @@
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
+linters:
+  settings:
+    depguard:
+      rules:
+        main:
+          list-mode: lax
+          deny:
+            # Cannot use gomodguard, which examines go.mod, as "golang.org/x/exp/slices" is not a module and doesn't appear in go.mod.
+            - pkg: "golang.org/x/exp/slices"
+              desc: "Use 'slices' instead"
+            - pkg: "golang.org/x/exp/maps"
+              desc: "Use 'maps' or 'github.com/samber/lo' instead"
+    dupl:
+      threshold: 100
+    errcheck:
+      check-type-assertions: true
+      check-blank: true
+    goconst:
+      min-len: 3
+      min-occurrences: 3
+    gocritic:
+      disabled-checks:
+        - appendAssign
+        - commentedOutCode
+        - hugeParam
+        - importShadow # FIXME
+        - indexAlloc
+        - rangeValCopy
+        - regexpSimplify
+        - sloppyReassign
+        - unnamedResult
+        - whyNoLint
+      enabled-tags:
+        - diagnostic
+        - style
+        - performance
+        - experimental
+        - opinionated
+    gocyclo:
+      min-complexity: 20
+    gomodguard:
+      blocked:
+        modules:
+          - github.com/hashicorp/go-version:
+              recommendations:
+                - github.com/aquasecurity/go-version
+              reason: "`aquasecurity/go-version` is designed for our use-cases"
+          - github.com/Masterminds/semver:
+              recommendations:
+                - github.com/aquasecurity/go-version
+              reason: "`aquasecurity/go-version` is designed for our use-cases"
+    gosec:
+      excludes:
+        - G101
+        - G114
+        - G115
+        - G204
+        - G304
+        - G402
+    govet:
+      disable:
+        - shadow
+    misspell:
+      locale: US
+      ignore-rules:
+        - behaviour
+        - licence
+        - optimise
+        - simmilar
+    perfsprint:
+      # Optimizes even if it requires an int or uint type cast.
+      int-conversion: true
+      # Optimizes into `err.Error()` even if it is only equivalent for non-nil errors.
+      err-error: true
+      # Optimizes `fmt.Errorf`.
+      errorf: true
+      # Optimizes `fmt.Sprintf` with only one argument.
+      sprintf1: false
+      # Optimizes into strings concatenation.
+      strconcat: false
+    revive:
+      max-open-files: 2048
+      # https://github.com/mgechev/revive/blob/HEAD/RULES_DESCRIPTIONS.md
+      rules:
+        - name: bool-literal-in-expr
+        - name: context-as-argument
+          arguments:
+            - allowTypesBefore: "*testing.T"
+        - name: duplicated-imports
+        - name: early-return
+          arguments:
+            - preserve-scope
+        - name: if-return
+        - name: increment-decrement
+        - name: indent-error-flow
+          arguments:
+            - preserve-scope
+        - name: range
+        - name: range-val-address
+        - name: superfluous-else
+          arguments:
+            - preserve-scope
+        - name: time-equal
+        - name: unnecessary-stmt
+        - name: unused-parameter
+        - name: use-any
+
+    staticcheck:
+      checks:
+        - all
+        - -QF1008 # Omit embedded fields from selector expression
+        - -S1007  # Simplify regular expression by using raw string literal
+        - -S1011  # Use a single append to concatenate two slices
+        - -S1023  # Omit redundant control flow
+        - -SA1019 # Using a deprecated function, variable, constant or field
+        - -SA1024 # A string cutset contains duplicate characters
+        - -SA4004 # The loop exits unconditionally after one iteration
+        - -SA4023 # Impossible comparison of interface value with untyped nil
+        - -SA4032 # Comparing runtime.GOOS or runtime.GOARCH against impossible value
+        - -SA5011 # Possible nil pointer dereference
+        - -ST1003 # Poorly chosen identifier
+        - -ST1012 # Poorly chosen name for error variable
+
+    testifylint:
+      enable-all: true
+
+  default: none
+
+  enable:
+    - bodyclose
+    - depguard
+    - goconst
+    - gocritic
+    - gocyclo
+    - gomodguard
+    - gosec
+    - govet
+    - ineffassign
+    - misspell
+    - perfsprint
+    - revive
+    - staticcheck
+    - testifylint
+    - unconvert
+    - unused
+    - usestdlibvars
+    - usetesting
+
+  exclusions:
+    generated: lax
+    paths:
+      - "pkg/iac/scanners/terraform/parser/funcs" # copies of Terraform functions
+    rules:
+      - path: ".*_test.go$"
+        linters:
+          - goconst
+          - gosec
+          - unused
+      - path: ".*_test.go$"
+        linters:
+          - govet
+        text: "copylocks:"
+      - path: ".*_test.go$"
+        linters:
+          - gocritic
+        text: "commentFormatting:"
+      - path: ".*_test.go$"
+        linters:
+          - gocritic
+        text: "exitAfterDefer:"
+      - path: ".*_test.go$"
+        linters:
+          - gocritic
+        text: "importShadow:"
+      - linters:
+          - goconst
+        text: "string `each` has 3 occurrences, make it a constant"  # FIXME
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    warn-unused: true
+
+run:
+  go: '1.24'
+  timeout: 30m
+
+formatters:
+  enable:
+    - gci
+    - gofmt
+
+  exclusions:
+    generated: lax
+
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(github.com/aquasecurity/)
+        - blank
+        - dot
+    gofmt:
+      simplify: false
+
+version: "2"

.golangci.yml

@@ -9,7 +9,7 @@ import (
 	"github.com/aquasecurity/trivy-db/pkg/types"
 )
 
-func (dbc Config) PutAdvisory(tx *bolt.Tx, bktNames []string, key string, advisory interface{}) error {
+func (dbc Config) PutAdvisory(tx *bolt.Tx, bktNames []string, key string, advisory any) error {
 	if err := dbc.put(tx, bktNames, key, advisory); err != nil {
 		return oops.With("key", key).Wrapf(err, "failed to put advisory")
 	}

pkg/db/advisory.go

@@ -11,7 +11,7 @@ const (
 	advisoryDetailBucket = "advisory-detail"
 )
 
-func (dbc Config) PutAdvisoryDetail(tx *bolt.Tx, vulnID, pkgName string, nestedBktNames []string, advisory interface{}) error {
+func (dbc Config) PutAdvisoryDetail(tx *bolt.Tx, vulnID, pkgName string, nestedBktNames []string, advisory any) error {
 	bktNames := append([]string{advisoryDetailBucket, vulnID}, nestedBktNames...)
 	if err := dbc.put(tx, bktNames, pkgName, advisory); err != nil {
 		return oops.With("vuln_id", vulnID).With("package_name", pkgName).Wrapf(err, "failed to put advisory detail")
@@ -53,7 +53,7 @@ func (dbc Config) saveAdvisories(tx *bolt.Tx, bkt *bolt.Bucket, bktNames []strin
 				return eb.Wrapf(err, "unable to save advisories")
 			}
 		} else {
-			detail := map[string]interface{}{}
+			detail := map[string]any{}
 			if err := json.Unmarshal(v, &detail); err != nil {
 				return eb.Wrapf(err, "json unmarshal error")
 			}

pkg/db/advisory_detail.go

@@ -68,7 +68,7 @@ func TestConfig_SaveAdvisoryDetails(t *testing.T) {
 			})
 
 			if tt.wantErr != "" {
-				require.NotNil(t, err)
+				require.Error(t, err)
 				assert.Contains(t, err.Error(), tt.wantErr)
 				return
 			}

pkg/db/advisory_detail_test.go

@@ -88,15 +88,15 @@ func TestConfig_ForEachAdvisory(t *testing.T) {
 			got, err := dbc.ForEachAdvisory([]string{tt.args.source}, tt.args.pkgName)
 
 			if tt.wantErr != "" {
-				require.NotNil(t, err)
+				require.Error(t, err)
 				assert.Contains(t, err.Error(), tt.wantErr)
 				return
 			}
 
-			assert.NoError(t, err)
+			require.NoError(t, err)
 
 			// Compare
-			assert.Equal(t, len(tt.want), len(got))
+			assert.Len(t, got, len(tt.want))
 			for cveID, g := range got {
 				wantAdvisory, ok := tt.want[cveID]
 				if !ok {
@@ -210,10 +210,10 @@ func TestConfig_GetAdvisories(t *testing.T) {
 
 			switch {
 			case tt.wantErr != "":
-				require.NotNil(t, err)
+				require.Error(t, err)
 				assert.Contains(t, err.Error(), tt.wantErr)
 			default:
-				assert.NoError(t, err)
+				require.NoError(t, err)
 			}
 
 			// Compare

pkg/db/advisory_test.go

@@ -15,7 +15,7 @@ import (
 	"github.com/aquasecurity/trivy-db/pkg/types"
 )
 
-type CustomPut func(dbc Operation, tx *bolt.Tx, adv interface{}) error
+type CustomPut func(dbc Operation, tx *bolt.Tx, adv any) error
 
 const SchemaVersion = 2
 
@@ -39,7 +39,7 @@ type Operation interface {
 	GetVulnerability(vulnerabilityID string) (vulnerability types.Vulnerability, err error)
 
 	SaveAdvisoryDetails(tx *bolt.Tx, cveID string) (err error)
-	PutAdvisoryDetail(tx *bolt.Tx, vulnerabilityID, pkgName string, nestedBktNames []string, advisory interface{}) (err error)
+	PutAdvisoryDetail(tx *bolt.Tx, vulnerabilityID, pkgName string, nestedBktNames []string, advisory any) (err error)
 	DeleteAdvisoryDetailBucket() error
 
 	PutDataSource(tx *bolt.Tx, bktName string, source types.DataSource) (err error)
@@ -73,7 +73,7 @@ func Init(dbDir string, opts ...Option) (err error) {
 	}
 
 	eb := oops.With("db_dir", dbDir)
-	if err = os.MkdirAll(dbDir, 0700); err != nil {
+	if err = os.MkdirAll(dbDir, 0o700); err != nil {
 		return eb.Wrapf(err, "failed to mkdir")
 	}
 	dbPath := Path(dbDir)
@@ -92,7 +92,7 @@ func Init(dbDir string, opts ...Option) (err error) {
 		debug.SetPanicOnFault(false)
 	}()
 
-	db, err = bolt.Open(dbPath, 0644, dbOptions.boltOptions)
+	db, err = bolt.Open(dbPath, 0o644, dbOptions.boltOptions)
 	if err != nil {
 		return eb.Wrapf(err, "failed to open db")
 	}
@@ -127,7 +127,7 @@ func (dbc Config) BatchUpdate(fn func(tx *bolt.Tx) error) error {
 	return nil
 }
 
-func (dbc Config) put(tx *bolt.Tx, bktNames []string, key string, value interface{}) error {
+func (dbc Config) put(tx *bolt.Tx, bktNames []string, key string, value any) error {
 	if len(bktNames) == 0 {
 		return oops.Errorf("empty bucket name")
 	}