version: "2"

linters:
  default: none
  enable:
    - errcheck
    - govet
    - staticcheck
    - unused
    - ineffassign
    - gosec
    - bodyclose
    - noctx
  settings:
    errcheck:
      # Best-effort cleanup and response writes. A failure here has no useful
      # handler; the caller already logs or returns the main error.
      exclude-functions:
        - (io.Closer).Close
        - (*os.File).Close
        - (*database/sql.Rows).Close
        - (*database/sql.Tx).Rollback
        - os.Remove
        - os.RemoveAll
        - (net/http.ResponseWriter).Write
        - (*encoding/json.Encoder).Encode
        - io.Copy
        - io.WriteString
        - fmt.Fprintf
    gosec:
      excludes:
        - G104 # errcheck covers unchecked errors
        - G124 # cookies set HttpOnly and SameSite; Secure would break plain-HTTP self-hosting
        - G203 # the only template.HTML is rendered template output, not user input
        - G204 # running yt-dlp, ffmpeg and ffprobe with request args is the core of this program
        - G301 # library and temp directories are meant to be world-readable
        - G304 # paths come from LibraryService.resolveItemDir, which rejects escapes
        - G702 # taint analysis: same as G204
        - G703 # taint analysis: same as G304
        - G706 # log injection: log lines are for the operator
        - G710 # localReferer keeps only a local path, see its test
  exclusions:
    rules:
      - path: _test\.go
        linters: [gosec, errcheck, noctx, bodyclose]
      # The repository layer is deliberately context-free: SQLite is local and
      # every query is short. noctx still guards the outbound HTTP calls.
      - path: internal/(repository|database)/
        linters: [noctx]
      # These error strings are the flash message shown to the user, so they are
      # written as sentences on purpose.
      - path: internal/handler/settings\.go
        text: "ST1005"

formatters:
  enable:
    - gofumpt
  settings:
    gofumpt:
      module-path: vidarchive
      extra:
        group-params: true