Use official golangci action together with CodeQL

.github/mergify.yml

@@ -36,18 +36,17 @@ pull_request_rules:
               ref: "{{ head }}"
             - workflow: test.yml
               ref: "{{ head }}"
-  
+
   - name: Comment when size/xl label is added
     conditions:
       - label=size/xl
-
     actions:
       comment:
         message: |
           > [!WARNING]
           > #### This PR exceeds the recommended limit of 1,000 lines.
           >
-          > Large PRs are difficult to review and may be rejected due to their size.  
+          > Large PRs are difficult to review and may be rejected due to their size.
           >
-          > Please verify that this PR does not address multiple issues.  
-          > Consider refactoring it into smaller, more focused PRs to facilitate a smoother review process.
+          > Please verify that this PR does not address multiple issues.
+          > Consider refactoring it into smaller, more focused PRs to facilitate a smoother review process.

.github/workflows/codeql.yml

@@ -2,13 +2,14 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ "main" ]
+    branches: ["main"]
+    types: [opened, labeled, unlabeled, synchronize]
   schedule:
     # runs on 19:17 every Tuesday
-    - cron: '27 19 * * 2'
+    - cron: "27 19 * * 2"
 
 jobs:
   analyze:
@@ -23,44 +24,103 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'go', 'javascript-typescript' ]
+        language: ["go", "javascript-typescript"]
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
 
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
+          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # queries: security-extended,security-and-quality
 
+      # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
 
-    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
 
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
 
-    #   If the Autobuild fails above, remove it and uncomment the following three lines.
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+      # - run: |
+      #     echo "Run, Build Application using script"
+      #     ./location_of_script_within_repo/buildscript.sh
 
-    # - run: |
-    #     echo "Run, Build Application using script"
-    #     ./location_of_script_within_repo/buildscript.sh
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{matrix.language}}"
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:${{matrix.language}}"
+  lint-golangci:
+    name: "Lint (golangci)"
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    permissions:
+      # Required: allow read access to the content for analysis.
+      contents: read
+      # allow read access to pull request. Use with `only-new-issues` option.
+      pull-requests: read
+      # allow write access to checks to allow the action to annotate code in the PR.
+      checks: write
+      # allow write access to security events to allow the action to upload SARIF files.
+      security-events: write
+    steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        id: golangci
+        with:
+          version: v1.64
+          only-new-issues: true # Shows only issues introduced in the PR
+          # Not all line numbers in diff may match the linter's line outputs
+          # See: https://github.com/golangci/golangci-lint/issues/4376#issuecomment-1938874827
+          # Always exit 0 so we upload the sarif file to CodeQL
+          args: >
+            --out-format sarif:golangci-lint.sarif
+            --issues-exit-code=0
+
+      - name: Upload filtered SARIF results
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: golangci-lint.sarif
+
+  pr-semver-labels:
+    name: PR Semver Labels
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: mheap/github-action-required-labels@v5
+        with:
+          mode: exactly
+          count: 1
+          labels: |
+            major
+            minor
+            patch
+            no-release
+          add_comment: true
+          message: |
+            > [!WARNING]
+            > This PR is blocked from merging because a required semver label is missing.
+            > ```
+            > {{ provided }}
+            > ```
+            > You'll need to add one before this PR can be merged.
 
   pr-size-labeler:
     name: PR Size Labeler
@@ -76,23 +136,23 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
-      
+
       - name: PR Size Labeler
         uses: codelytv/pr-size-labeler@v1.10.2
         with:
-          xs_label: 'size/xs'
-          xs_max_size: '10'
-          s_label: 'size/s'
-          s_max_size: '100'
-          m_label: 'size/m'
-          m_max_size: '500'
-          l_label: 'size/l'
-          l_max_size: '1000'
-          xl_label: 'size/xl'
-          fail_if_xl: 'false'
+          xs_label: "size/xs"
+          xs_max_size: "10"
+          s_label: "size/s"
+          s_max_size: "100"
+          m_label: "size/m"
+          m_max_size: "500"
+          l_label: "size/l"
+          l_max_size: "1000"
+          xl_label: "size/xl"
+          fail_if_xl: "false"
           files_to_ignore: >
             package-lock.json
             yarn.lock
             go.sum
-          ignore_line_deletions: 'false'
-          ignore_file_deletions: 'false'
+          ignore_line_deletions: "false"
+          ignore_file_deletions: "false"

.github/workflows/test.yml

@@ -488,33 +488,6 @@ jobs:
               ]
             }
 
-  lint-golangci:
-    name: "[lint] golangci"
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Lint with golangci-lint
-        uses: reviewdog/action-golangci-lint@v2
-        id: golangci
-        with:
-          reviewdog_version: latest
-          filter_mode: "diff_context"
-          reporter: github-check
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-        continue-on-error: true
-
-      - name: Fail if Lint Errors Exist
-        if: steps.golangci.outcome == 'failure'
-        run: |
-          gh issue edit ${{ github.event.pull_request.number }} --add-label "lint-failures"
-          exit 1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   release:
     needs: [test, lint, mock, k3s, localstack, docker, validate]
     if: github.event_name == 'push'

.golangci.yml

@@ -180,14 +180,20 @@ severity:
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
+  exclude-dirs:
+    - experiments/.*
   exclude-rules:
     - path: _test\.go$ # Ignore test files for specific linters
       linters:
+        - err113
+        - errcheck
         - funlen
-        - revive
         - gci
-        - errcheck
+        - gosec
+        - revive
 
 output:
+  sort-results: true
   formats:
     - format: colored-line-number
+      path: stderr

Makefile

@@ -24,7 +24,7 @@ version: version-default
 # The following will lint only files in git. `golangci-lint run --new-from-rev=HEAD` should do it,
 # but it's still including files not in git.
 lint: get
-	git ls-files '*.go' | xargs -n1 dirname | sort -u | xargs golangci-lint run
+	golangci-lint run --new-from-rev=origin/main
 
 build-linux: GOOS=linux
 build-linux: build-default

internal/exec/terraform_utils.go

@@ -87,7 +87,7 @@ func generateBackendConfig(atmosConfig *schema.AtmosConfiguration, info *schema.
 				return err
 			}
 
-			err = u.WriteToFileAsJSON(backendFileName, componentBackendConfig, 0o644)
+			err = u.WriteToFileAsJSON(backendFileName, componentBackendConfig, 0o600)
 			if err != nil {
 				return err
 			}
@@ -106,7 +106,7 @@ func generateProviderOverrides(atmosConfig *schema.AtmosConfiguration, info *sch
 
 		if !info.DryRun {
 			providerOverrides := generateComponentProviderOverrides(info.ComponentProvidersSection)
-			err := u.WriteToFileAsJSON(providerOverrideFileName, providerOverrides, 0o644)
+			err := u.WriteToFileAsJSON(providerOverrideFileName, providerOverrides, 0o600)
 			return err
 		}
 	}
@@ -154,7 +154,7 @@ func isWorkspacesEnabled(atmosConfig *schema.AtmosConfiguration, info *schema.Co
 	if info.ComponentBackendType == "http" {
 		// If workspaces are explicitly enabled for HTTP backend, log a warning.
 		if atmosConfig.Components.Terraform.WorkspacesEnabled != nil && *atmosConfig.Components.Terraform.WorkspacesEnabled {
-			l.Warn("ignoring the enabled setting for workspaces since HTTP backend doesn't support workspaces",
+			l.Warn("ignoring unsupported workspaces `enabled` setting for HTTP backend type.",
 				"backend", "http",
 				"component", info.Component)
 		}