Merge branch 'google:master' into dependecy_graph_snapshots

.codecov.yml

@@ -3,3 +3,5 @@ ignore:
   - "github/github-accessors.go"
   # ignore experimental scrape package
   - "scrape"
+  # ignore tools
+  - "tools"

.github/dependabot.yml

@@ -9,7 +9,7 @@ updates:
   schedule:
     interval: weekly
 - package-ecosystem: gomod
-  directory: update-urls
+  directory: tools
   schedule:
     interval: weekly
 - package-ecosystem: github-actions

.github/workflows/linter.yml

@@ -3,31 +3,17 @@ name: linter
 
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   lint:
-    strategy:
-      matrix:
-        go-version: [1.x]
-        platform: [ubuntu-latest]
-
-        # golangci-lint will only process a single module, so we need to call it
-        # separately for each module in the repo.  We dont lint example/newreposecretwithlibsodium
-        # since that needs libsodium to run.
-        working-directory:
-          - ""
-          # - example  # Fails with "no go files to analyze"
-          - scrape
-          - update-urls
-    runs-on: ${{ matrix.platform }}
-
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-
-    - name: golangci-lint ${{ matrix.working-directory }}
-      uses: golangci/golangci-lint-action@v3
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
       with:
-        version: latest
-        working-directory: ${{ matrix.working-directory}}
-        args: --verbose
+        go-version: 1.x
+        cache-dependency-path: "**/go.sum"
+    - run: script/lint.sh
+      env:
+        CHECK_GITHUB_OPENAPI: 1
+        GITHUB_TOKEN: ${{ github.token }}

.github/workflows/tests.yml

@@ -19,9 +19,12 @@ permissions:
 
 jobs:
   test:
+    defaults:
+      run:
+        shell: bash
     strategy:
       matrix:
-        go-version: [1.x, 1.20.x]
+        go-version: [1.x, 1.21.x]
         platform: [ubuntu-latest]
         include:
           # include windows, but only with the latest Go version, since there
@@ -36,50 +39,38 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-    - uses: actions/setup-go@v4
+    - uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.go-version }}
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
-    # Get values for cache paths to be used in later steps 
+    # Get values for cache paths to be used in later steps
     - id: cache-paths
       run: |
         echo "go-cache=$(go env GOCACHE)" >> $GITHUB_OUTPUT
         echo "go-mod-cache=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
-      shell: bash
 
     - name: Cache go modules
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           ${{ steps.cache-paths.outputs.go-cache }}
           ${{ steps.cache-paths.outputs.go-mod-cache }}
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: ${{ runner.os }}-go-
 
-    - name: Ensure go generate produces a zero diff
-      shell: bash
-      run: go generate -x ./... && git diff --exit-code; code=$?; git checkout -- .; (exit $code)
-
     - name: Run go test
-      run: go test -v -race -coverprofile coverage.txt -covermode atomic ./...
+      run: |
+        if [ -n "${{ matrix.update-coverage }}" ]; then
+          script/test.sh -race -covermode atomic -coverprofile coverage.txt ./...
+          exit
+        fi
+        script/test.sh -race -covermode atomic ./...
 
     - name: Ensure integration tests build
       # don't actually run tests since they hit live GitHub API
       run: go test -v -tags=integration -run=^$ ./test/integration
 
-    - name: Run scrape tests
-      run: |
-        cd scrape
-        go test ./...
-
     - name: Upload coverage to Codecov
       if: ${{ matrix.update-coverage }}
-      uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d #v3.1.4
-
-    - name: Ensure go generate produces a zero diff for update-urls
-      shell: bash
-      run: cd update-urls && go generate -x ./... && git diff --exit-code; code=$?; git checkout -- .; (exit $code)
-
-    - name: Run go test for update-urls
-      run: cd update-urls && go test -v -race ./...
+      uses: codecov/codecov-action@84508663e988701840491b86de86b666e8a86bed #v4.3.0

.gitignore

@@ -1,6 +1,9 @@
 *.sh
+!/script/*.sh
 *.test
+.*.local
 coverage.out
+/bin
 # intellij files
 .idea/
 vendor/

.golangci.yml

@@ -1,34 +1,53 @@
+run:
+  build-tags:
+    - integration
+  timeout: 10m
 linters:
-  # TODO: fix errors so that all of the linters below pass.
-  # The linters that are commented out, as well as those explicitly disabled,
-  # are currently failing.  We should fix those failures or define exclusion
-  # rules, and then enable those linters.
   enable:
     - dogsled
     - dupl
     - gofmt
     - goimports
-  # - gosec
+    - gosec
     - misspell
     - nakedret
     - stylecheck
-  # - unconvert
-  # - unparam
+    - unconvert
+    - unparam
     - whitespace
-  disable:
-    - errcheck
-    - gosimple
-    - staticcheck
-    - ineffassign
-    - unused
+linters-settings:
+  gosec:
+    excludes:
+      # duplicates errcheck
+      - G104
+      # performance issue: see https://github.com/golangci/golangci-lint/issues/4039
+      # and https://github.com/securego/gosec/issues/1007
+      - G602
 issues:
-  exclude:
-    - composites
+  exclude-use-default: false
   exclude-rules:
-  - linters:
-    - dogsled
-    text:  "declaration has 3 blank identifiers"
-    path: _test\.go
-  - linters:
-    - dupl
-    path: _test\.go
+    - linters:
+        - dupl
+        - unparam
+        - gosec
+        - dogsled
+      path: _test\.go
+
+    # We need to pass nil Context in order to test DoBare erroring on nil ctx.
+    - linters: [ staticcheck ]
+      text: 'SA1012: do not pass a nil Context'
+      path: _test\.go
+
+    # We need to use sha1 for validating signatures
+    - linters: [ gosec ]
+      text: 'G505: Blocklisted import crypto/sha1: weak cryptographic primitive'
+
+    # This is adapted from golangci-lint's default exclusions. It disables linting for error checks on
+    # os.RemoveAll and any function ending in "Close".
+    - linters: [ errcheck ]
+      text: Error return value of .(.*Close|os\.Remove(All)?). is not checked
+
+    # We don't care about file inclusion via variable in examples or internal tools.
+    - linters: [ gosec ]
+      text: 'G304: Potential file inclusion via variable'
+      path: '^(example|tools)\/'

AUTHORS

@@ -303,6 +303,7 @@ Matt Gaunt <[email protected]>
 Matt Landis <[email protected]>
 Matt Moore <[email protected]>
 Matt Simons <[email protected]>
+Matthew Reidy <[email protected]>
 Maxime Bury <[email protected]>
 Michael Meng <[email protected]>
 Michael Spiegel <[email protected]>
@@ -484,4 +485,4 @@ Zach Latta <[email protected]>
 zhouhaibing089 <[email protected]>
 六开箱 <[email protected]>
 缘生 <[email protected]>
-蒋航 <[email protected]>
+蒋航 <[email protected]>