chore: add basic linter rules

.golangci.yaml

@@ -0,0 +1,55 @@
+---
+version: "2"
+run:
+  allow-parallel-runners: true
+linters:
+  enable:
+    - "bidichk"
+    - "bodyclose"
+    - "errcheck"
+    - "errname"
+    - "errorlint"
+    #    - "gocritic"
+    - "goprintffuncname"
+    #    - "gosec"
+    - "govet"
+    - "importas"
+    - "ineffassign"
+    - "makezero"
+    - "prealloc"
+    - "predeclared"
+    - "promlinter"
+    #    - "revive"
+    - "rowserrcheck"
+    - "spancheck"
+    - "staticcheck"
+    - "tagalign"
+    - "testifylint"
+    - "tparallel"
+    - "unconvert"
+    - "usetesting"
+    - "wastedassign"
+    - "whitespace"
+    - "unused"
+  settings:
+    staticcheck:
+      checks:
+        - "all"
+        - "-ST1000" # at least one file in a package should have a package comment
+        - "-ST1003" # poorly chosen identifier
+formatters:
+  enable:
+    - "gci"
+    - "gofmt"
+    - "gofumpt"
+    - "goimports"
+  settings:
+    gci:
+      sections:
+        - "standard"
+        - "default"
+        - "prefix(github.com/authzed)"
+        - "localmodule"
+    goimports:
+      local-prefixes:
+        - "github.com/authzed/spicedb-kubeapi-proxy"

pkg/authz/authz.go

@@ -5,14 +5,14 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/cschleiden/go-workflows/client"
 	"github.com/samber/lo"
 	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/klog/v2"
 
 	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
-	"github.com/cschleiden/go-workflows/client"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apiserver/pkg/endpoints/request"
 
 	"github.com/authzed/spicedb-kubeapi-proxy/pkg/rules"
 )

pkg/authz/check.go

@@ -5,10 +5,10 @@ import (
 	"errors"
 	"fmt"
 
+	"golang.org/x/sync/errgroup"
 	"k8s.io/klog/v2"
 
 	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
-	"golang.org/x/sync/errgroup"
 
 	"github.com/authzed/spicedb-kubeapi-proxy/pkg/rules"
 )

pkg/authz/distributedtx/activity.go

@@ -7,12 +7,13 @@ import (
 	"io"
 	"net/http"
 
-	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/client-go/rest"
 
+	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
+
 	"github.com/authzed/spicedb-kubeapi-proxy/pkg/failpoints"
 )
 
@@ -111,7 +112,8 @@ func (h *ActivityHandler) WriteToKube(ctx context.Context, req *KubeReqInput) (*
 	resp := KubeResp{}
 	body, err := res.Raw()
 	var nonKerr error
-	if kerr, ok := err.(*k8serrors.StatusError); ok {
+	kerr := &k8serrors.StatusError{}
+	if errors.As(err, &kerr) {
 		resp.Err = *kerr
 		resp.StatusCode = int(kerr.Status().Code)
 	} else {

pkg/authz/distributedtx/activity_test.go

@@ -59,7 +59,7 @@ func TestWriteToKube(t *testing.T) {
 	})
 
 	require.NoError(t, err)
-	require.Equal(t, `{"hi":"bye"}`, string(resp.Body))
+	require.JSONEq(t, `{"hi":"bye"}`, string(resp.Body))
 	require.Equal(t, http.StatusCreated, resp.StatusCode)
 }
 

pkg/authz/distributedtx/client.go

@@ -4,14 +4,15 @@ import (
 	"context"
 	"log/slog"
 
-	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
 	"github.com/cschleiden/go-workflows/backend"
 	"github.com/cschleiden/go-workflows/backend/monoprocess"
 	"github.com/cschleiden/go-workflows/backend/sqlite"
 	"github.com/cschleiden/go-workflows/client"
 	"github.com/cschleiden/go-workflows/worker"
 	"k8s.io/client-go/rest"
 	"k8s.io/klog/v2"
+
+	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
 )
 
 func SetupWithMemoryBackend(ctx context.Context, permissionClient v1.PermissionsServiceClient, kubeClient rest.Interface) (*client.Client, *Worker, error) {

pkg/authz/distributedtx/log.go

@@ -2,8 +2,9 @@ package distributedtx
 
 import (
 	"context"
-	"k8s.io/klog/v2"
 	"log/slog"
+
+	"k8s.io/klog/v2"
 )
 
 type klogToSlogAdapter struct {

pkg/authz/distributedtx/workflow.go

@@ -5,21 +5,20 @@ import (
 	"net/http"
 	"time"
 
-	"k8s.io/klog/v2"
-
+	"github.com/cespare/xxhash/v2"
+	"github.com/cschleiden/go-workflows/workflow"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/apiserver/pkg/endpoints/request"
+	"k8s.io/klog/v2"
 
 	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
-	"github.com/cespare/xxhash/v2"
-	"github.com/cschleiden/go-workflows/workflow"
-	k8serrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/util/json"
-	"k8s.io/apimachinery/pkg/util/wait"
 )
 
 const (

pkg/authz/distributedtx/workflow_test.go

@@ -7,9 +7,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/authzed/spicedb-kubeapi-proxy/pkg/spicedb"
-
-	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
 	"github.com/cschleiden/go-workflows/client"
 	"github.com/cschleiden/go-workflows/workflow"
 	"github.com/google/uuid"
@@ -20,6 +17,10 @@ import (
 	"k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/client-go/rest/fake"
+
+	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
+
+	"github.com/authzed/spicedb-kubeapi-proxy/pkg/spicedb"
 )
 
 func TestWorkflow(t *testing.T) {
@@ -34,7 +35,7 @@ func TestWorkflow(t *testing.T) {
 			srv, err := spicedb.NewServer(ctx, "")
 			require.NoError(t, err)
 			go func() {
-				require.NoError(t, srv.Run(ctx))
+				require.NoError(t, srv.Run(ctx)) // nolint:testifylint
 			}()
 
 			dialCtx, err := srv.GRPCDialContext(ctx)
@@ -93,7 +94,7 @@ func TestWorkflow(t *testing.T) {
 			require.NoError(t, err)
 			require.NotNil(t, resp)
 			require.Empty(t, resp.Err, "workflow returned error: %s", resp.Err)
-			require.Equal(t, `{"hi":"myfriend"}`, string(resp.Body))
+			require.JSONEq(t, `{"hi":"myfriend"}`, string(resp.Body))
 			require.Equal(t, http.StatusCreated, resp.StatusCode)
 			require.Equal(t, runtime.ContentTypeJSON, resp.ContentType)
 
@@ -117,5 +118,4 @@ func TestWorkflow(t *testing.T) {
 			require.Equal(t, v1.CheckPermissionResponse_PERMISSIONSHIP_HAS_PERMISSION, cpr.Permissionship)
 		})
 	}
-
 }

pkg/authz/filter.go

@@ -7,10 +7,10 @@ import (
 	"io"
 	"slices"
 
+	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/klog/v2"
 
 	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
-	"k8s.io/apimachinery/pkg/types"
 
 	"github.com/authzed/spicedb-kubeapi-proxy/pkg/config/proxyrule"
 	"github.com/authzed/spicedb-kubeapi-proxy/pkg/rules"

pkg/authz/postfilter.go

@@ -5,10 +5,11 @@ import (
 	"encoding/json"
 	"fmt"
 
-	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/klog/v2"
 
+	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
+
 	"github.com/authzed/spicedb-kubeapi-proxy/pkg/rules"
 )
 
@@ -61,7 +62,7 @@ func filterItemsWithBulkPermissions(ctx context.Context, items []interface{}, fi
 
 	// Build bulk permission check requests
 	var bulkItems []*v1.CheckBulkPermissionsRequestItem
-	var itemToRequestMap = make(map[int][]int) // maps item index to request indices
+	itemToRequestMap := make(map[int][]int) // maps item index to request indices
 
 	for itemIndex, item := range items {
 		itemMap, ok := item.(map[string]interface{})

pkg/authz/postfilter_test.go

@@ -5,12 +5,13 @@ import (
 	"encoding/json"
 	"testing"
 
-	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 	"k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/apiserver/pkg/endpoints/request"
 
+	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
+
 	"github.com/authzed/spicedb-kubeapi-proxy/pkg/config/proxyrule"
 	"github.com/authzed/spicedb-kubeapi-proxy/pkg/rules"
 )
@@ -33,7 +34,7 @@ func (m *mockPermissionsClient) CheckPermission(ctx context.Context, req *v1.Che
 }
 
 func (m *mockPermissionsClient) CheckBulkPermissions(ctx context.Context, req *v1.CheckBulkPermissionsRequest, opts ...grpc.CallOption) (*v1.CheckBulkPermissionsResponse, error) {
-	var pairs []*v1.CheckBulkPermissionsPair
+	pairs := make([]*v1.CheckBulkPermissionsPair, 0, len(req.Items))
 
 	for _, item := range req.Items {
 		// Create a key from the request item to match against responses
@@ -318,7 +319,7 @@ func TestFilterItemsWithBulkPermissions(t *testing.T) {
 	// Test with empty items
 	emptyItems, err := filterItemsWithBulkPermissions(context.Background(), []interface{}{}, []*rules.RunnableRule{filteredRules}, input, mockClient)
 	require.NoError(t, err)
-	require.Len(t, emptyItems, 0)
+	require.Empty(t, emptyItems)
 }
 
 func TestShouldRunPostFilters(t *testing.T) {