Versions updates

.github/workflows/validate.yaml → .github/workflows/checks.yaml

@@ -1,14 +1,14 @@
-name: Validation
+name: Code Checks
 
-on: [push, pull_request]
+on: [push]
 
 defaults:
   run:
     shell: bash
 
 jobs:
-  basic:
-    name: generate and vet
+  makechecks:
+    name: Make Checks
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -17,16 +17,39 @@ jobs:
         with:
           go-version-file: './go.mod'
 
+      - uses: actions/setup-python@v5
+        with:
+          python-version: 3.x
+
+      - run: pip install yamllint==1.33.0
+
       - run: |
-          make generate
           make manifests
-          go mod tidy
+          make generate
           make fmt
           make vet
+          yamllint .
           git diff --exit-code
 
-  unit-tests:
-    name: Unit Tests
+  # A separate job so that it can annotate the code
+  golangci:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: './go.mod'
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v5
+        with:
+          version: v1.58
+          # Automatically uses ./.golangci.yml for configuration
+
+  tests:
+    name: Tests
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -38,15 +61,10 @@ jobs:
       - run: |
           make test
 
-          # Fix things up for the coverage report
-          head -1 cover.out > nucleus_cover.out
-          grep 'governance-policy-nucleus' cover.out >> nucleus_cover.out
-          sudo rm -rf .go
-
       - name: Update coverage report
         uses: ncruces/go-coverage-report@v0
         with:
-          coverage-file: nucleus_cover.out
+          coverage-file: cover.out
           output-dir: ${{ github.ref_name }}
           report: true
           chart: false

.gitignore

@@ -15,5 +15,8 @@ bin/
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
 
+# Output of gosec tool
+gosec.json
+
 # Dependency directories (remove the comment below to include it)
 # vendor/

.golangci.yaml

@@ -1,30 +1,14 @@
+# Reference: https://github.com/golangci/golangci-lint/blob/master/.golangci.reference.yml
 run:
   # timeout for analysis, e.g. 30s, 5m, default is 1m
   deadline: 20m
   timeout: 20m
 
-  # which dirs to skip: they won't be analyzed;
-  # can use regexp here: generated.*, regexp is applied on full path;
-  # default value is empty list, but next dirs are always skipped independently
-  # from this option's value:
-  #   	vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
-  skip-dirs:
-    - genfiles$
-    - vendor$
-    - vbh$
-
-  # which files to skip: they will be analyzed, but issues from them
-  # won't be reported. Default value is empty list, but there is
-  # no need to include all autogenerated files, we confidently recognize
-  # autogenerated files. If it's not please let us know.
-  skip-files:
-    - ".*\\.pb\\.go"
-    - ".*\\.gen\\.go"
-
 linters:
   enable-all: true
   disable:
     - bodyclose
+    - copyloopvar # prefer old style for now, more reliable across various scanners
     - cyclop
     - deadcode #deprecated
     - depguard
@@ -40,13 +24,14 @@ linters:
     - goconst
     - gocyclo
     - godot
-    - goerr113
+    - err113
     - golint # replaced by revive
     - gomnd
     - gomoddirectives
     - gosec
     - ifshort
     - interfacer
+    - intrange # prefer old style
     - ireturn # New linter to consider
     - maligned
     - maintidx # New linter to consider
@@ -122,69 +107,26 @@ linters-settings:
   gocritic:
     enabled-checks:
       - appendCombine
-      - argOrder
-      - assignOp
-      - badCond
       - boolExprSimplify
       - builtinShadow
-      - captLocal
-      - caseOrder
-      - codegenComment
       - commentedOutCode
       - commentedOutImport
-      - defaultCaseOrder
-      - deprecatedComment
       - docStub
-      - dupArg
-      - dupBranchBody
-      - dupCase
-      - dupSubExpr
-      - elseif
       - emptyFallthrough
       - equalFold
-      - flagDeref
-      - flagName
       - hexLiteral
       - indexAlloc
       - initClause
       - methodExprCall
       - nilValReturn
       - octalLiteral
-      - offBy1
       - rangeExprCopy
-      - regexpMust
-      - sloppyLen
       - stringXbytes
-      - switchTrue
       - typeAssertChain
-      - typeSwitchVar
       - typeUnparen
-      - underef
-      - unlambda
       - unnecessaryBlock
-      - unslice
-      - valSwap
       - weakCond
 
-      # Unused
-      # - yodaStyleExpr
-      # - appendAssign
-      # - commentFormatting
-      # - emptyStringTest
-      # - exitAfterDefer
-      # - ifElseChain
-      # - hugeParam
-      # - importShadow
-      # - nestingReduce
-      # - paramTypeCombine
-      # - ptrToRefParam
-      # - rangeValCopy
-      # - singleCaseSwitch
-      # - sloppyReassign
-      # - unlabelStmt
-      # - unnamedResult
-      # - wrapperFunc
-
 issues:
   # List of regexps of issue texts to exclude, empty list by default.
   # But independently from this option we use default exclude patterns,
@@ -223,6 +165,10 @@ issues:
     - linters:
         - lll
       source: \/\/ ?https?:\/\/
+    # Don't enforce whitespace rules on test files
+    - path: _test\.go$
+      linters:
+        - wsl
 
   # Independently from option `exclude` we use default exclude patterns,
   # it can be disabled by this option. To list all

Makefile

@@ -6,8 +6,10 @@ $(LOCAL_BIN):
 	mkdir -p $(LOCAL_BIN)
 
 # Keep an existing GOPATH, make a private one if it is undefined
-GOPATH_DEFAULT := $(ROOTDIR)/.go
-export GOPATH ?= $(GOPATH_DEFAULT)
+export GOPATH ?= $(shell go env GOPATH)
+ifeq ($(GOPATH),)
+	GOPATH := $(ROOTDIR)/.go
+endif
 GOBIN_DEFAULT := $(GOPATH)/bin
 export GOBIN ?= $(GOBIN_DEFAULT)
 
@@ -24,29 +26,51 @@ SHELL = /usr/bin/env bash -o pipefail
 # Note: this replaces `go-get-tool`.
 go-install = @set -e ; mkdir -p $(LOCAL_BIN) ; GOBIN=$(LOCAL_BIN) go install $(1)
 
-# Define local utilities near the top so they work correctly as targets
+# Define local utilities before other targets so they work correctly
 # Note: this pattern of variables, paths, and target names allows users to
 #  override the version used, and helps Make by not using PHONY targets.
+# To 'refresh' versions, remove the local bin directory.
 
+CONTROLLER_GEN_VERSION ?= v0.15.0 # https://github.com/kubernetes-sigs/controller-tools/releases/latest
 CONTROLLER_GEN ?= $(LOCAL_BIN)/controller-gen
 $(CONTROLLER_GEN): $(LOCAL_BIN)
-	$(call go-install,sigs.k8s.io/controller-tools/cmd/[email protected])
-
-ENVTEST ?= $(LOCAL_BIN)/setup-envtest
-$(ENVTEST): $(LOCAL_BIN)
-	$(call go-install,sigs.k8s.io/controller-runtime/tools/setup-envtest@latest)
+	$(call go-install,sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_GEN_VERSION))
 
+KUSTOMIZE_VERSION ?= v5.4.1 # https://github.com/kubernetes-sigs/kustomize/releases/latest
 KUSTOMIZE ?= $(LOCAL_BIN)/kustomize
 $(KUSTOMIZE): $(LOCAL_BIN)
-	$(call go-install,sigs.k8s.io/kustomize/kustomize/[email protected])
+	$(call go-install,sigs.k8s.io/kustomize/kustomize/v5@$(KUSTOMIZE_VERSION))
+
+GOFUMPT_VERSION ?= v0.6.0 # https://github.com/mvdan/gofumpt/releases/latest
+GOFUMPT ?= $(LOCAL_BIN)/gofumpt
+$(GOFUMPT): $(LOCAL_BIN)
+	$(call go-install,mvdan.cc/gofumpt@$(GOFUMPT_VERSION))
+
+GCI_VERSION ?= v0.13.4 # https://github.com/daixiang0/gci/releases/latest
+GCI ?= $(LOCAL_BIN)/gci
+$(GCI): $(LOCAL_BIN)
+	$(call go-install,github.com/daixiang0/gci@$(GCI_VERSION))
 
+GOSEC_VERSION ?= v2.19.0 # https://github.com/securego/gosec/releases/latest
+GOSEC ?= $(LOCAL_BIN)/gosec
+$(GOSEC): $(LOCAL_BIN)
+	$(call go-install,github.com/securego/gosec/v2/cmd/gosec@$(GOSEC_VERSION))
+
+GOLANGCI_VERSION ?= v1.58.0 # https://github.com/golangci/golangci-lint/releases/latest
 GOLANGCI ?= $(LOCAL_BIN)/golangci-lint
 $(GOLANGCI): $(LOCAL_BIN)
-	$(call go-install,github.com/golangci/golangci-lint/cmd/golangci-lint@v1.55.2)
+	$(call go-install,github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCI_VERSION))
 
+# To change this version, adjust it in the go.mod file
+# https://github.com/onsi/ginkgo/releases/latest
+GINKGO_VERSION := $(shell awk '/github.com\/onsi\/ginkgo\/v2/ {print $$2}' go.mod)
 GINKGO ?= $(LOCAL_BIN)/ginkgo
 $(GINKGO): $(LOCAL_BIN)
-	$(call go-install,github.com/onsi/ginkgo/v2/ginkgo@$(shell awk '/github.com\/onsi\/ginkgo\/v2/ {print $$2}' go.mod))
+	$(call go-install,github.com/onsi/ginkgo/v2/ginkgo@$(GINKGO_VERSION))
+
+ENVTEST ?= $(LOCAL_BIN)/setup-envtest
+$(ENVTEST): $(LOCAL_BIN)
+	$(call go-install,sigs.k8s.io/controller-runtime/tools/setup-envtest@latest)
 
 .PHONY: manifests
 manifests: $(CONTROLLER_GEN) $(KUSTOMIZE) ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
@@ -62,12 +86,15 @@ generate: $(CONTROLLER_GEN) ## Generate code containing DeepCopy, DeepCopyInto,
 	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
 
 .PHONY: fmt
-fmt: ## Run go fmt against code.
-	go fmt ./...
+fmt: $(GOFUMPT) $(GCI)
+	go mod tidy
+	find . -not \( -path "./.go" -prune \) -name "*.go" | xargs $(GOFUMPT) -l -w
+	find . -not \( -path "./.go" -prune \) -name "*.go" | xargs $(GCI) write --skip-generated -s standard -s default -s localmodule
 
 .PHONY: vet
-vet: ## Run go vet against code.
+vet: $(GOSEC)
 	go vet ./...
+	$(GOSEC) -fmt sonarqube -out gosec.json -stdout -exclude-dir=.go -exclude-dir=test -exclude-generated ./...
 
 # Note: this target is not used by Github Actions. Instead, each linter is run 
 # separately to automatically decorate the code with the linting errors.
@@ -77,7 +104,7 @@ lint: $(GOLANGCI)
 	$(GOLANGCI) run
 	yamllint -c $(ROOTDIR)/.yamllint.yaml .
 
-ENVTEST_K8S_VERSION ?= 1.26
+ENVTEST_K8S_VERSION ?= 1.29
 .PHONY: test
 test: manifests generate $(GINKGO) $(ENVTEST) ## Run tests.
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" $(GINKGO) \

api/v1alpha1/reflectiveResourceList.go

@@ -4,8 +4,9 @@ import (
 	"fmt"
 	"reflect"
 
-	"open-cluster-management.io/governance-policy-nucleus/api/v1beta1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"open-cluster-management.io/governance-policy-nucleus/api/v1beta1"
 )
 
 //+kubebuilder:object:generate=false