version: "2"

linters:
  enable:
    - gosec
    - govet
    - errcheck
    - ineffassign
    - staticcheck
    - unused
    - forbidigo
  disable:
    - bodyclose # too many false negatives

  settings:
    gosec:
      excludes:
        - G101
        - G117
        - G306
        - G704
        - G705
    forbidigo:
      forbid:
        - pattern: "http\\.DefaultClient"
          msg: "Use reg.HTTPClient(ctx) or httpx.NewResilientClient() — http.DefaultClient bypasses SSRF protection and retry logic."
        - pattern: "retryablehttp\\.NewClient\\b"
          msg: "Use httpx.NewResilientClient() — retryablehttp.NewClient() bypasses SSRF protection and registry configuration."
  exclusions:
    rules:
      - linters:
          - staticcheck
        text: "SA1019" # we do use deprecated APIs on purpose sometimes
      - linters:
          - forbidigo
        path: "pkg/(httpclient|client-go)/"
      - linters:
          - forbidigo
        path: "_test\\.go$"