[teamai] Push 87 resource(s) from XingfenD

2026-09-10 16:10:45 +08:00
parent 425c9c078a
commit 65c04def51
1314 changed files with 211681 additions and 0 deletions
@@ -0,0 +1,151 @@
+version: "2"
+run:
+  concurrency: 4
+  # Timeout for analysis
+  timeout: 5m
+  # Include test files
+  tests: true
+
+issues:
+  max-issues-per-linter: 0  # 0 = unlimited (we want ALL issues)
+  max-same-issues: 50
+
+linters:
+  enable:
+    # correctness
+    - govet            # built-in checker: copylocks, printf formats, struct tags, unreachable code
+    - staticcheck      # extensive static analysis: deprecated APIs, common mistakes, simplifications
+    - unused           # unused variables, functions, types
+    - errcheck         # unchecked error returns and type assertions
+    - errorlint        # correct use of errors.Is/As and %w wrapping (Go 1.13+)
+    - nilerr           # returning nil error when err is non-nil
+    - forcetypeassert  # type assertions without comma-ok check
+    - copyloopvar      # loop variable copy issues (Go 1.22+)
+    - durationcheck    # detect time.Duration * time.Duration bugs
+    - reassign         # package-level variable reassignment
+    # style
+    - gocritic         # opinionated style: unnecessary conversions, range copies, redundant code
+    - revive           # naming conventions, exported types, stuttered package names
+    - wsl_v5           # whitespace and blank line rules for readability
+    - whitespace       # trailing whitespace, unnecessary blank lines
+    - godot            # exported-symbol comments must end with a period
+    - misspell         # common English misspellings in identifiers and comments
+    - dupword          # duplicate words in comments and strings (the the, is is)
+    - predeclared      # shadowing Go built-ins (len, cap, error)
+    - errname          # error type/var naming conventions (ErrFoo, FooError)
+    - asciicheck       # non-ASCII identifiers (prevents homoglyph/trojan source attacks)
+    # complexity
+    - gocyclo          # cyclomatic complexity threshold
+    - nestif           # deeply nested if/else chains
+    - funlen           # function length limits (lines and statements)
+    - dupl             # code duplication detection
+    # performance
+    - perfsprint       # faster alternatives to fmt.Sprintf
+    - unconvert        # unnecessary type conversions
+    - ineffassign      # assignments to variables never read
+    - goconst          # repeated literals that should be constants
+    # security & resources
+    - gosec            # security scanner: SQL injection, hardcoded credentials, weak crypto, path traversal
+    - bidichk          # dangerous bidirectional Unicode sequences (trojan source CVE-2021-42574)
+    - bodyclose        # unclosed HTTP response bodies (connection leaks)
+    - noctx            # HTTP requests missing context.Context
+    - containedctx     # context.Context stored in struct fields instead of passed as parameter
+    - fatcontext       # context.WithValue/WithCancel in loops (unbounded context chain, memory leak)
+    - sqlclosecheck    # unclosed sql.Rows and sql.Stmt
+    - rowserrcheck     # unchecked sql.Rows.Err() after iteration
+    # logging
+    - sloglint         # consistent log/slog code style
+    - loggercheck      # key-value pair validation for structured loggers (zap, slog, logr)
+    # testing
+    - testifylint      # testify best practices
+    - thelper          # test helpers missing t.Helper()
+    - usetesting       # use t.Setenv/t.TempDir instead of os equivalents in tests
+    - paralleltest     # tests and subtests missing t.Parallel()
+    # modernization & meta
+    - modernize        # old patterns replaceable with newer Go features
+    - exptostd         # replace golang.org/x/exp/ functions with stdlib equivalents
+    - intrange         # range over integer instead of C-style loop (Go 1.22+)
+    - usestdlibvars    # use stdlib constants instead of hardcoded values
+    - exhaustive       # switch statements not covering all enum values
+    - nolintlint       # enforces proper //nolint directive usage
+
+  disable:
+    - lll              # line length — handled by gofmt/gofumpt
+    - prealloc         # high false-positive rate; enable only after performance profiling
+    - wrapcheck        # forces wrapping all external errors — too noisy as a default
+    - err113           # forces package-level sentinel errors — too opinionated, breaks common patterns
+    - mnd              # magic number detector — extremely noisy, flags obvious constants like HTTP 200
+    - iface            # interface pollution detector — too opinionated, not mature enough
+    - nakedret         # naked returns — overlaps with funlen (short functions make naked returns fine)
+    - noinlineerr      # bans `if err := ...; err != nil {}` — this is idiomatic Go
+    - gocognit         # cognitive complexity — redundant with gocyclo + nestif
+    - cyclop           # cyclomatic complexity — redundant with gocyclo
+    - depguard         # import allow/deny lists — requires per-project configuration
+    - goheader         # file header enforcement — project-specific policy
+    - importas         # import alias enforcement — requires per-project configuration
+    - funcorder        # function ordering — too opinionated for a default
+    - godoclint        # godoc validation — overlaps with godot and revive
+    - varnamelen       # variable name length — too opinionated, Go favors short names
+    - exhaustruct      # all struct fields must be set — extremely noisy, breaks zero-value idiom
+    - gochecknoglobals # no global variables — too strict, many valid uses
+    - gochecknoinits   # no init() functions — too strict, many valid uses
+    - unparam          # unused function parameters — medium false-positive rate with interfaces
+    - makezero         # flags make([]T, n) — noisy, often wrong about intent
+    - testpackage      # forces _test package — valid but too opinionated as a default
+    - embeddedstructfieldcheck # embedded type placement — minor style, not worth enforcing
+    - iotamixing       # iota in mixed const blocks — very rare issue
+    - unqueryvet       # SELECT * detection — too niche for a default config
+    - recvcheck        # receiver type consistency — overlaps with gocritic
+    - mirror           # bytes/strings mirror patterns — very few real hits
+    - protogetter      # proto field access via getters — only for protobuf users
+    - spancheck        # OpenTelemetry span checks — only for OTel users
+    - zerologlint      # zerolog usage — only for zerolog users
+
+  exclusions:
+    paths:
+      - vendor$
+      - third_party$
+      - testutils$
+      - examples$
+
+  settings:
+    dupl:
+      threshold: 100  # lower => stricter (tokens)
+    errcheck:
+      check-type-assertions: true
+    funlen:
+      lines: 120
+      statements: 80
+    goconst:
+      min-len: 3
+      min-occurrences: 4
+    gocyclo:
+      min-complexity: 13 # strict; lower => stricter
+    nolintlint:
+      require-explanation: true
+      require-specific: true
+    wsl_v5:
+      allow-first-in-block: true
+      allow-whole-block: false
+      branch-max-lines: 2
+
+formatters:
+  # formatters are opt-in: only those listed here run. Others are left commented
+  # with the reason they stay off (a `disable` block is not valid here and makes
+  # `golangci-lint config verify` fail).
+  enable:
+    - gofumpt    # superset of gofmt: applies gofmt's rules first, then its own
+    - goimports  # import management: adds imports that --fix introduces, drops unused ones
+    # - gofmt    # redundant: gofumpt already applies gofmt's rules
+    # - gci      # import grouping/ordering — gofumpt already handles standard grouping
+    # - golines  # line wrapping — too opinionated, can break readability
+    # - swaggo   # swaggo comment formatting — only for swaggo users
+  settings:
+    gofumpt:
+      extra-rules: true
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$