Option-2 answer to sneak's ruling of 2026-08-19 on
sneak/homoicon#4: migrate to the successor, with
settings. Closes #25.
## The change
`golangci-lint` v2.12.0 deprecated `gomodguard`, and this config sets
`linters.default: all`, so it is enabled everywhere and warns on every run.
- `gomodguard` joins `wsl` in `linters.disable` under a shared "deprecated"
comment. The warning is attached to the old name, so disabling it is what
silences it.
- `gomodguard_v2` is named in `linters.enable`, a no-op under `default: all`
that gives the settings block a visible owner.
- Blocked, each restating a decision already recorded in the Go package
defaults: `rs/zerolog` → `log/slog`; the pre-fork `go-redis/redis` →
`redis/go-redis/v9`; `sergi/go-diff` and `hexops/gotextdiff` → `go-udiff`.
Every entry matches the module path exactly, so the pre-fork go-redis takes
three: `go-redis/redis`, `/v7`, `/v8`. A prefix would also cover
`go-redis/redismock`, the test double for the successor recommended here.
Deliberately absent: recorded rejections that vendoring repos still require
(`mattn/go-sqlite3`, `gorm.io/gorm`, `pmezard/go-difflib`), plus `urfave/cli`
and unversioned `go-chi/chi`. Blocking those would redden repos mid-migration
on their next re-vendor.
## After merge
The file's sha256 moves from
`d10f47ef5e0d8620efd62275b016a7de8fd5abedf333922eec86fe4abc06176e` to
`a79b63a254602a5318db5d0e9a06bc71b84bf0c1d896305229d8bfed1d1b1776`, so every
vendoring repo mismatches. #60 is the
propagation brief; it and the record on
#25 carry this value.
## Disclosures
- Judgement call: `wsl` moved two lines down to share the "deprecated" comment.
No behaviour change, but it widens the diff.
- The `go.mod` survey and the settings-block probe are on
#25.
- Unverified: the linter was not run against each vendoring repo; the per-repo
claim rests on reading their `go.mod` files.
- `make check` exit 0.
Model: opus-5
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #55
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
`depguard` was in the disable list. It is now enabled with one rule,
`test-support`: in files that are neither test files nor inside a package whose
directory name ends in `test`, the imports named under `deny` are refused.
Canonical denies `net/http/httptest`, which serves tests only and is the same
in every repository.
This replaces `internal/testimportgate` in sneak/homoicon, a package whose only
job was to refuse a non-test Go file importing an in-module package whose last
path segment ends in `test`. sneak ruled on
sneak/homoicon#1029 that the rule moves into linter
configuration here.
depguard cannot express that rule generically. Its package lists are prefix
lists -- its own README says so, and I confirmed it: `*test`, `**test` and
`$gomod/**test` each match nothing, while a full import path matches. "In
module" is not generic either, since the module path differs per repository.
And depguard refuses a rule with no allow or deny list, so this file cannot
ship the rule pre-armed and empty for each repository to fill in.
The closest expressible rule is the one here. The file half is generic and
exact; the package half is a deny list each repository extends with its own
test-support packages, by full import path. REPO_POLICIES.md now says that list
is the one part of a vendored copy a repository may add to.
Tested with golangci-lint v2.12.2 on a scratch module: a production file
importing a denied `*test` package fails, and the same import from a `_test.go`
file and from inside the `*test` package passes. `make check` here is green.
Model: opus-5
Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #59
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
Requested by sneak.
Sets the canonical `.golangci.yml` to the org-standard v2-schema config already deployed byte-identical across the org's Go repos (vaultik, sfdupes, attrsum, upaas, simplelog, mfer, secret, rgoue, bsfirehose). sha256: `021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb`.
Why: settings live under `linters.settings`, so the lll/funlen/cyclop/dupl thresholds actually apply under golangci-lint v2. The old canonical file kept them under top-level `linters-settings`, which v2 ignores.
Version note: golangci-lint v2.12.2 tag = commit `c0d3ddc9cf3faa61a4e378e879ece580256d76e5`, recorded for consuming repos. This repo itself has no version pins; the `v2.x.x` / `@sha256:...` strings in `prompts/REPO_POLICIES.md` are intentional placeholders and are unchanged.
Known informational note: this config does not disable the deprecated `gomodguard` linter, so golangci-lint 2.12.x prints a deprecation warning. Harmless, accepted.
Matches dnswatcher PR #96: sneak/dnswatcher#96
Verification: `make check` green (prettier fmt-check on all markdown) after `make fmt`; `.golangci.yml` sha256 verified as `021cc83f...` matching the org-standard file.
Co-authored-by: sneak <sneak@sneak.berlin>
Co-authored-by: clawbot <clawbot@eeqj.de>
Reviewed-on: #24
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
- Add .golangci.yml from upaas as authoritative copy in this repo
- Update REPO_POLICIES.md to reference .golangci.yml by URL
- Add fetch URLs for all template files in both checklists:
.gitignore, .editorconfig, Makefile, .prettierrc, .prettierignore,
REPO_POLICIES.md, .golangci.yml, check.yml
