v0.8.0

What's Changed

• corpus: adopt packer — open 305, all of it config handling by @dakimura in #332
• config: version: 2 is an integer without quotes, and guff read packer's file as v1 by @dakimura in #334
• staticcheck: S1002 renders the operand's source, not the string <expr> by @dakimura in #335
• staticcheck: S1020's nested form reports on the inner if, and stops at an else by @dakimura in #336
• staticcheck: SA4006's loop guard only counts reads the back edge can reach by @dakimura in #337
• staticcheck: SA4006 never fired inside a method — packer closes, corpus reaches 51 by @dakimura in #338
• types: dereferencing a type parameter walks its type set, not its underlying type by @dakimura in #339
• staticcheck: S1035 matches the callee, not the selector's name by @dakimura in #340
• ssa: range over a pointer to a named array panicked — minio adopted, corpus reaches 52 by @dakimura in #341
• corpus: adopt hydra — clean, and a negative-only checks selector selects nothing by @dakimura in #342
• compat: (related information) was discarded from every set-diff, in every tier by @dakimura in #343
• lint: a typecheck error must silence nolintlint too — woodpecker adopted, corpus reaches 54 by @dakimura in #344
• corpus: exclude lnd — both tools refuse its config, for the same reason by @dakimura in #345
• corpus: adopt go-elasticsearch — 92 vs 92, and the check that it is not measuring nothing by @dakimura in #346
• corpus: adopt ingress-nginx — one package makes ./... unmeasurable, so scope to the other 94 by @dakimura in #347
• gocritic: regexpSimplify merges only plain characters — ingress-nginx 4 open to 2 by @dakimura in #348
• revive: var-declaration gates on the declared type too — ingress-nginx 2 open to 1 by @dakimura in #349
• gocritic: commentedOutCode's block fallback has no permitted-statement filter — ingress-nginx closed, corpus reaches 56 by @dakimura in #350
• corpus: adopt lazygit — a hardcoded //go:fix inline table that depends on the x/exp version by @dakimura in #351
• govet/inline: read the vendored declaration instead of trusting the x/exp table — lazygit closed, corpus reaches 57 by @dakimura in #352
• corpus: adopt argo-workflows — ./... is unmeasurable, but only two trees are tainted by @dakimura in #353
• corpus: adopt podman — a nolintlint symptom whose cause is an unparam miss by @dakimura in #354
• unparam: call sites inside a package var initialiser were never counted — podman closed, corpus reaches 59 by @dakimura in #355
• corpus: adopt cometbft — one gocritic false positive and one false negative by @dakimura in #356
• gocritic: dupBranchBody ignored go/defer arguments, ifElseChain marked chains visited too early — cometbft closed, corpus reaches 60 by @dakimura in #357
• gofumpt: a second v0.10.0 rule was newer than the pinned version — gatekeeper adopted clean, corpus reaches 61 by @dakimura in #358
• corpus: tempo does not finish — one dependency, not size, and it is guff's defect by @dakimura in #359
• corpus: adopt cluster-api — three gocritic causes behind four findings by @dakimura in #360
• gocritic: dupOption ignored named func types, offBy1 lacked its slice rules, badCond skipped side-effect-free — cluster-api closed, corpus reaches 62 by @dakimura in #361
• corpus: adopt go-ethereum — govet tests reads non-test files, and the x/exp hole comes due by @dakimura in #362
• govet: tests asks the package whether it is a test, and one analyzer has two report positions by @dakimura in #363
• corpus: adopt dagger — upstream's whole report is 6 typecheck issues, guff's is 203 findings by @dakimura in #364
• gosec: match the receiver, not the callee's package — seven call lists, close grafana, corpus reaches 63 by @dakimura in #366
• corpus: adopt pyroscope — five causes, one of which is upstream flipping a coin by @dakimura in #367
• close pyroscope: two different generics escape hatches, _ directories, unquoted values, and slicing an array — corpus reaches 64 by @dakimura in #368
• guff-types: cover every arm of typeparams::Free, not just the six ifaceassert reaches by @dakimura in #369
• corpus: adopt opentofu — unused's "implements an interface" edge is wrong in both directions, and a method named init is used by @dakimura in #370
• close opentofu: unused's implements is not types.Implements, and SA4004 only looked at a function's top level — corpus reaches 65 by @dakimura in #371
• corpus: exclude milvus — cgo wants milvus's own C++ core, and what survives is another race by @dakimura in #372
• corpus: adopt victoriametrics — //line positions belong to the .go file, unsafe.Sizeof's exemption never matched, and #371 left a false positive by @dakimura in #373
• close victoriametrics: SA4006 was reading an assignment out of a block the IR had already deleted — corpus reaches 66 by @dakimura in #374
• adopt cosmos-sdk: the go/build header scan spun forever on a backquoted import path — tempo's exclusion was this, corpus reaches 67 by @dakimura in #375
• close tempo: struct tags were never unquoted, T[A](x) went silently invalid, and go/ssa packs the variadic tail — corpus reaches 68 by @dakimura in #376
• seed: a spurious dependency cycle — the ring is four edges long and two of them are test edges by @dakimura in #377
• corpus: exclude kubevirt — ./... never starts, and 39 of the 105 paths it does lint will not build here by @dakimura in #378
• adopt photoprism: two C libraries to make it measurable at all, then four unrelated defects — corpus reaches 69 by @dakimura in #379
• corpus: adopt cortex — clean on the first measurement, corpus reaches 70 by @dakimura in #380
• adopt loki: issues.fix: true rewrites the checkout, and three staticcheck defects behind it — corpus holds at 70 by @dakimura in #381
• close loki: stop, measured — the inline call form's diagnostic depends on running the inliner by @dakimura in #382
• corpus: let the queue skip an open target whose remaining gap is a scoped-out feature by @dakimura in #383
• adopt avalanchego: tagalign's strict aligns by key, and SA1026 must not judge a type-parameter map key — corpus holds at 70 by @dakimura in #384
• unused: field-writes-are-uses and post-statements-are-reads — avalanchego closes, corpus reaches 71 by @dakimura in #385
• adopt vitess: five defects, all of them the wrong context — closure, package, enclosing function — corpus reaches 72 by @dakimura in #386
• adopt beats: a left-associative chain is as deep as it is long — 24,711 terms overflowed the checker's stack by @dakimura in #387
• close beats (1): a cgo package's test variant was handed the production file list, so its in-package tests were never read by @dakimura in #388
• close beats (2): new(expr) gives a constant its default type, and upstream decides that in package scope by @dakimura in #389
• close beats (3): io/ioutil's six wrappers are the one class the inline pass can answer without an inliner by @dakimura in #390
• close beats (4): structtag rendered the tag with Rust's {:?}, and read it by dropping backslashes by @dakimura in #391
• close beats (5): ST1016 reports at the method that sorts first by Id, not the one written first by @dakimura in #392
• close beats (6): reflecttypefor — NoEffects walks the tree, *new(T) is pure, and any is an alias by @dakimura in #393
• close beats (7): code.CallName is typeutil.FuncName, and both S1038 and SA1006 were reading it as package path plus name by @dakimura in #394
• close beats (8): wastedassign never looked at a single method, and loosening it surfaced a false positive that was already there by @dakimura in #395
• close beats (9): G202 had no identifier branch, and the last G115 row turns out to be an upstream message cache by @dakimura in #396
• close beats (10): porting G305 closed three nolintlint rows as well as its own two by @dakimura in #397
• close beats (11): minmax has a second arm — the user-defined min/max declaration itself by @dakimura in #398
• close beats (12): waitgroupgo's "or end with wg.Done()", and a fix-tier green that was only a stale baseline by @dakimura in #399
• close beats (13): three small modernize rules, all the same family — a predicate that matched by name and a rendering that could fail by @dakimura in #400
• close beats (14): newexpr's fact can be built from the dependency's own sources — 42 rows by @dakimura in #401
• close beats (15): a block-comment package doc carries no marker, and the object scan was overwriting the cache that knew better by @dakimura in #402
• SSA: a channel range never declared its := iteration variable — every read of it was a load from nil by @dakimura in #403
• close beats (16): gomodguard's message is Sprintf'd twice, so a %w in the user's reason prints as %!w(MISSING) by @dakimura in #404
• close beats (17): wastedassign never looked inside a func literal — the capture guard collected every use, not the free ones by @dakimura in #405
• close beats (18): a formatter change that only inserts lines is reported above the insertion, not below it by @dakimura in #406
• close beats (19): unused never looked at declarations inside a function — and the type checker never recorded their defs by @dakimura in #407
• close beats (20): a redefinition inside an if arm is an overwrite when every other arm leaves the function by @dakimura in #408
• close beats (21): S1009 folded "is it a constant" and "is it zero" into one answer, and dropped every non-zero bound by @dakimura in #409
• close beats (22): SA9009 never looked at a file with a license header by @dakimura in #410
• close beats (23): port gosec G119 — a redirect policy is decided by its signature alone by @dakimura in #411
• close beats (24): minmax has to check that min still means the builtin where the rewrite lands by @dakimura in #412
• close beats (25): a cgo-generated declaration is not the redundant-type checker's business by @dakimura in #413
• close beats (26): typecheck cannot be turned off, so a //nolint:typecheck is always asked whether it was used by @dakimura in #414
• close beats (27): stringsbuilder skipped every _test.go file by @dakimura in #415
• close beats (28): a body deferred to an io.Closer is closed — but only when it is deferred by @dakimura in #416
• close beats (29): the checks that read a neighbouring statement could not see inside a switch or select case by @dakimura in #417
• close beats (30): two resps under one name are two responses by @dakimura in #418
• close beats (31): gosec G115 names each kind pair after the first conversion it reached by @dakimura in #419
• close beats (32): gosec loses every finding in a cgo file, because it reports the physical file by @dakimura in #420
• close beats (33): fakejson is a copy of encoding/json, dominance rules included; SA9005 did not look through embedding either by @dakimura in #421
• close beats (34): wastedassign's positional fallback counted reads a break or continue jumps over by @dakimura in #422
• close beats (35): modernize stringscut is Index -> Cut in x/tools v0.44; guff had a later version's Split by @dakimura in #423
• close dapr: a goroutine that is not the first capture tells bodyclose nothing by @dakimura in #424
• adopt cilium: 224 of 787 packages cannot be loaded on darwin, so it is adopted and not measured, like tetragon by @dakimura in #425
• adopt k3s: its core 16 packages cannot be loaded on darwin, so it is adopted and not measured by @dakimura in #426
• exclude zitadel: its protobuf and OpenAPI code is generated at build time, so upstream's whole report is one typecheck issue by @dakimura in #427
• adopt nomad: build tags matched to upstream's make check, clean at 0 / 0 by @dakimura in #428
• adopt mimir: ST1016 never reports a generic type by @dakimura in #429
• exclude tidb: golangci-lint itself panics on it, so there is no reference to be compatible with by @dakimura in #430
• exclude opentelemetry-collector-contrib: the root module holds no Go file at all by @dakimura in #431
• adopt trivy: GOEXPERIMENT=jsonv2 was dropped, and ptrToRefParam does not look through aliases by @dakimura in #432
• adopt datadog-agent: upstream's 26 lint build tags, minus the two subtrees that collapse the report by @dakimura in #433
• close datadog-agent (1): S1001 is silent where copy is shadowed by @dakimura in #434
• close datadog-agent (2): a store to a variable the closure does not own is settled by an invoked capture by @dakimura in #435
• close datadog-agent (3): a directive-only doc is still a doc by @dakimura in #436
• close datadog-agent (4): unexported-return cannot see through an import either by @dakimura in #437
• defer close datadog-agent (5): revive lints the original sources, not the cgo output by @dakimura in #438
• close weaviate (1): explicit-exhaustive-map is not a setting, it is a switch to directives by @dakimura in #439
• close weaviate (2): exhaustive never looks at a literal that does not spell its type by @dakimura in #440
• close weaviate (3): a type that does not write its struct out owns no fields, and upstream never asks by @dakimura in #441
• close weaviate (4): a write is not a use, unless the global was declared in a test file by @dakimura in #442
• close weaviate (5): a constraint written as a bare type is still an interface by @dakimura in #443
• adopt weaviate: 32/32 findings, 0 ill-typed packages, ledger 77/100 by @dakimura in #444
• close teleport (1): analyze-types replaces the text a pattern is matched against, not just the package filter by @dakimura in #445
• close teleport (2): S1005 says nothing about a range over a func by @dakimura in #446
• close teleport (3): a field-stored response is settled by any close in its basic block by @dakimura in #447
• adopt teleport: 16/16 findings, ledger 78/100 by @dakimura in #448
• close opa (1): a generic function with no parameters and no results shared the imported func() signature by @dakimura in #449
• adopt opa: 0/0 findings, 0 ill-typed packages, ledger 79/100 by @dakimura in #450
• corpus: refresh the candidate queue from the reserve list (+48) by @dakimura in #451
• adopt 7 small targets that hunt clean: ledger 86/100 by @dakimura in #452
• close gorm (1): port gosec G601, gated on golangci's run.go — which prefers go.mod's toolchain line by @dakimura in #453
• close glamour (1): SA1019 looks a promoted method up by the type that declares it by @dakimura in #454
• close gosec (1): SA4019 reads build constraints from the preamble only by @dakimura in #455
• close grype (1): revive's ifelse rules walk every container, not just function bodies by @dakimura in #456
• close grype (2): dupl orders a match's occurrences the way upstream does, not by position by @dakimura in #457
• close gosec (2): ginkgolinter's BeNumerically length rule, as upstream computes it by @dakimura in #458
• close nerdctl (1): forbidigo matches pkg: against the resolved path, or "" when there is none by @dakimura in #459
• close kitex (1): staticcheck's generated-code filter, as upstream decides it — on any line, per report site by @dakimura in #460
• close lima (1): SA1029 does not unalias the key type for its empty-struct message by @dakimura in #461
• close lima (2): revive dot-imports honours its allowedPackages argument by @dakimura in #462
• close lima (3): modernize stringscutprefix searches the whole first statement and compares arguments as syntax by @dakimura in #463
• close nerdctl (2): revive var-declaration types a shift by its left operand by @dakimura in #464
• adopt 19 targets: ledger 105/100 — the goal is reached by @dakimura in #466
• close nerdctl (3): gci's no-inline-comments / no-prefix-comments are no-ops upstream by @dakimura in #465
• adopt nerdctl: 0/0 findings, ledger 106/100 by @dakimura in #467
• run.go: an unset value is detected and handed to every linter, as golangci's loader does by @dakimura in #468
• uniq-by-line keeps the first issue in upstream's order: issue-reporter linters before diagnostic ones by @dakimura in #469
• revive option keys ignore case and hyphens, not underscores by @dakimura in #470
• SA1019: protoc-gen-go output may import github.com/golang/protobuf/proto by @dakimura in #471
• seed: the cycle check re-walked the production graph for every test edge by @dakimura in #472
• Re-lock both regress baselines for 0.8.0 by @dakimura in #473
• Release 0.8.0: 140 commits, a corpus at 106 of 100, and grafana re-measured by @dakimura in #474

Full Changelog: v0.7.0...v0.8.0