chore: update lint/ci setting

.github/dependabot.yml

@@ -0,0 +1,40 @@
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+    schedule:
+      interval: "monthly"
+      time: "08:00"
+      timezone: "Asia/Tokyo"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    open-pull-requests-limit: 10
+    assignees:
+      - "k1LoW"
+      - "pyama86"
+      - "drumato"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+    schedule:
+      interval: "monthly"
+      time: "08:00"
+      timezone: "Asia/Tokyo"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    open-pull-requests-limit: 10
+    assignees:
+      - "k1LoW"
+      - "pyama86"
+      - "drumato"

.github/workflows/benchmark.yml

@@ -11,18 +11,18 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Check out source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version-file: go.mod
 
       - name: Set up deps
         run: make depsdev
 
       - name: Check out source code (main)
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           ref: main
           path: main
@@ -32,7 +32,7 @@ jobs:
         working-directory: main
 
       - name: Run octocov (main)
-        uses: k1LoW/octocov-action@v1
+        uses: k1LoW/octocov-action@73d561f65d59e66899ed5c87e4621a913b5d5c20 # v1.5.0
         with:
           config: .octocov.benchmark.main.yml
         env:
@@ -44,7 +44,7 @@ jobs:
         run: make benchmark
 
       - name: Run octocov
-        uses: k1LoW/octocov-action@v1
+        uses: k1LoW/octocov-action@73d561f65d59e66899ed5c87e4621a913b5d5c20 # v1.5.0
         with:
           config: .octocov.benchmark.yml
         env:

.github/workflows/ci.yml

@@ -12,36 +12,39 @@ jobs:
     runs-on: ubuntu-latest
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
     steps:
       - name: Check out source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up Go
         id: setup-go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version-file: go.mod
 
       - name: Run lint
-        uses: reviewdog/action-golangci-lint@v2
+        uses: reviewdog/action-golangci-lint@f9bba13753278f6a73b27a56a3ffb1bfda90ed71 # v2.8.0
         with:
-          fail_on_error: true
-          go_version: '${{ steps.setup-go.outputs.go-version }}'
-          golangci_lint_flags: --timeout=5m
+          fail_level: warning
+          go_version-file: go.mod
 
       - name: Run gostyle
-        uses: k1LoW/gostyle-action@v1
+        uses: k1LoW/gostyle-action@56cc0ed69a96366aa5be08df58a858e306c1518c # v1.5.0
         with:
           config-file: .gostyle.yml
           fail-on-error: true
 
       - name: Check oldstable
-        uses: k1LoW/oldstable@v1
-          
+        uses: k1LoW/oldstable@28b6b2ef2c743f8dbeecba50626e9313b7fa938f # v2.0.0
+
       - name: Run tests
         run: make ci
 
       - name: Run octocov
-        uses: k1LoW/octocov-action@v1
+        uses: k1LoW/octocov-action@73d561f65d59e66899ed5c87e4621a913b5d5c20 # v1.5.0
         env:
           OCTOCOV_CUSTOM_METRICS_BENCHMARK: custom_metrics_benchmark.json

.github/workflows/tagpr.yml

@@ -11,13 +11,13 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Check out source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version-file: go.mod
 
       - id: run-tagpr
         name: Run tagpr
-        uses: Songmu/tagpr@v1
+        uses: Songmu/tagpr@9c294c8b7b1815a5f3b7c61d6ee6aa50ac25b030 # v1.8.4

.golangci.yml

@@ -1,8 +1,41 @@
+version: "2"
 run:
-  go: 1.21
-  modules-download-mode: mod
+  timeout: 2m
 linters:
-  fast: false
-issues:
-  exclude:
-    - SA3000
+  enable:
+    - errorlint
+    - godot
+    - gosec
+    - misspell
+    - revive
+    - funcorder
+  settings:
+    errcheck:
+      check-type-assertions: true
+    misspell:
+      locale: US
+    revive:
+      rules:
+        - name: unexported-return
+          disabled: true
+        - name: exported
+          disabled: false
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - tmpmod
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

benchmark_test.go

@@ -39,7 +39,7 @@ func BenchmarkNGINXCache1MBBody(b *testing.B) {
 	b.ResetTimer()
 	b.RunParallel(func(pb *testing.PB) {
 		for pb.Next() {
-			i := rand.Intn(cacherange)
+			i := rand.Intn(cacherange) //nolint:gosec // Weak random number is acceptable for benchmark test
 			req, err := http.NewRequest("GET", fmt.Sprintf("%s/cache/%d", proxy, i), nil)
 			if err != nil {
 				b.Error(err)
@@ -88,7 +88,7 @@ func BenchmarkDiscCache1MBBody(b *testing.B) {
 	b.ResetTimer()
 	b.RunParallel(func(pb *testing.PB) {
 		for pb.Next() {
-			i := rand.Intn(cacherange)
+			i := rand.Intn(cacherange) //nolint:gosec // Weak random number is acceptable for benchmark test
 			req, err := http.NewRequest("GET", fmt.Sprintf("%s/cache/%d", proxy.URL, i), nil)
 			if err != nil {
 				b.Error(err)

diskcache.go

@@ -66,7 +66,11 @@ func (d *deque) back() string {
 	if d.lru.Len() == 0 {
 		return ""
 	}
-	return d.lru.Back().Value.(string)
+	v, ok := d.lru.Back().Value.(string)
+	if !ok {
+		return ""
+	}
+	return v
 }
 
 func (d *deque) remove(key string) {
@@ -251,7 +255,7 @@ func (c *DiskCache) StopAll() {
 	c.StopAdjust()
 }
 
-// StartAutoCleanup starts the goroutine of automatic cache cleanup
+// StartAutoCleanup starts the goroutine of automatic cache cleanup.
 func (c *DiskCache) StartAutoCleanup() {
 	go c.m.Start()
 }
@@ -261,7 +265,7 @@ func (c *DiskCache) StopAutoCleanup() {
 	c.m.Stop()
 }
 
-// StopAdjust
+// StopAdjust stops the auto adjust cache.
 func (c *DiskCache) StopAdjust() {
 	c.adjustStopCancelFunc()
 }
@@ -451,7 +455,7 @@ func (c *DiskCache) Metrics() Metrics {
 	}
 }
 
-// warmUpCaches warm up the cache
+// warmUpCaches warm up the cache.
 func (c *DiskCache) warmUpCaches() error {
 	return filepath.WalkDir(c.cacheRoot, func(path string, info fs.DirEntry, err error) error {
 		if err != nil {
@@ -481,7 +485,11 @@ func (c *DiskCache) warmUpCaches() error {
 		if err != nil {
 			return err
 		}
-		size := uint64(reqi.Size() + resi.Size())
+		totalSize := reqi.Size() + resi.Size()
+		if totalSize < 0 {
+			totalSize = 0
+		}
+		size := uint64(totalSize) //nolint:gosec // File sizes are guaranteed to be non-negative in practice
 		c.mu.Lock()
 		defer c.mu.Unlock()
 		c.totalBytes += size

error.go

@@ -2,5 +2,5 @@ package rcutil
 
 import "errors"
 
-// ErrCacheFull is returned if the cache is full
+// ErrCacheFull is returned if the cache is full.
 var ErrCacheFull error = errors.New("cache full")

rcutil.go

@@ -55,12 +55,12 @@ func EncodeRes(res *http.Response, w io.Writer) error {
 	return res.Write(w)
 }
 
-// DecodeReq decodes to http.Request
+// DecodeReq decodes to http.Request.
 func DecodeReq(r io.Reader) (*http.Request, error) {
 	return http.ReadRequest(bufio.NewReader(r))
 }
 
-// DecodeRes decodes to http.Response
+// DecodeRes decodes to http.Response.
 func DecodeRes(r io.Reader) (*http.Response, error) {
 	return http.ReadResponse(bufio.NewReader(r), nil)
 }
@@ -142,8 +142,8 @@ func DecodeReqRes(r io.Reader) (*http.Request, *http.Response, error) {
 	return req, res, nil
 }
 
-// KeyToPath converts key to path
-// It is the responsibility of the user to pass path-safe keys
+// KeyToPath converts key to path.
+// It is the responsibility of the user to pass path-safe keys.
 func KeyToPath(key string, n int) string {
 	if n <= 0 {
 		return key
@@ -160,7 +160,7 @@ func KeyToPath(key string, n int) string {
 	return result.String()
 }
 
-// PathToKey converts path to key
+// PathToKey converts path to key.
 func PathToKey(path string) string {
 	return strings.ReplaceAll(path, string(filepath.Separator), "")
 }
@@ -177,7 +177,10 @@ func (wc *WriteCounter) Write(p []byte) (int, error) {
 	if err != nil {
 		return n, err
 	}
-	wc.Bytes += uint64(n)
+	if n < 0 {
+		n = 0
+	}
+	wc.Bytes += uint64(n) //nolint:gosec // Write() return value is guaranteed to be non-negative
 	return n, err
 }
 

testutil/cacher.go

@@ -1,7 +1,7 @@
 package testutil
 
 import (
-	"crypto/sha1"
+	"crypto/sha1" //nolint:gosec // Using SHA1 for cache key generation, not for security
 	"encoding/hex"
 	"io"
 	"net/http"
@@ -68,11 +68,11 @@ func (c *AllCache) Store(req *http.Request, res *http.Response, _ time.Time) err
 
 func (c *AllCache) Hit() int {
 	m := c.dc.Metrics()
-	return int(m.Hits)
+	return int(m.Hits) //nolint:gosec // Converting metrics counter to int for test utility
 }
 
 func seedToKey(seed string) string {
-	sha1 := sha1.New()
+	sha1 := sha1.New() //nolint:gosec // Using SHA1 for cache key generation, not for security
 	_, _ = io.WriteString(sha1, seed) //nostyle:handlerrors
 	return hex.EncodeToString(sha1.Sum(nil))
 }

testutil/container.go

@@ -66,7 +66,7 @@ func NewUpstreamEchoNGINXServer(t testing.TB, hostname string, bodySize int) str
 		t.Fatal(err)
 	}
 	confp := filepath.Join(dir, fmt.Sprintf("%s.nginx_echo.conf", hostname))
-	if err := os.WriteFile(confp, cb, os.ModePerm); err != nil {
+	if err := os.WriteFile(confp, cb, os.ModePerm); err != nil { //nolint:gosec // Test file in temp directory
 		t.Fatal(err)
 	}
 	tb, err := templates.ReadFile("templates/index.html.tmpl")
@@ -114,7 +114,7 @@ func createNGINXServer(t testing.TB, hostname, confp, indexp string) string {
 		t.Fatal(err)
 	}
 	sp := filepath.Join(dir, "sleep.js")
-	if err := os.WriteFile(sp, sb, 0644); err != nil {
+	if err := os.WriteFile(sp, sb, 0644); err != nil { //nolint:gosec // Test file in temp directory
 		t.Fatal(err)
 	}
 	pool, err := dockertest.NewPool("")
@@ -156,7 +156,7 @@ func createNGINXServer(t testing.TB, hostname, confp, indexp string) string {
 	var urlstr string
 	if err := pool.Retry(func() error {
 		urlstr = fmt.Sprintf("http://127.0.0.1:%s", r.GetPort("80/tcp"))
-		if _, err := http.Get(urlstr); err != nil {
+		if _, err := http.Get(urlstr); err != nil { //nolint:gosec // Test server URL from container port
 			time.Sleep(1 * time.Second)
 			return err
 		}