Initial implementation of lint subcommand

[Dentrax]

This PR initially implements brand-new lint subcommand as we discussed: wolfi-dev/os#86

• Implement bare-minimum lint subcommand
• Add 3 rules: no-makefile-entry-for-package, valid-copyright-header and valid-pipeline-fetch-uri (for test purposes)
• Ran gofumpt -w -extra . across project (some intentional changes has made)
• Move some Melange-related funcs to melange.go for code deduplication
• No tests written yet, we thought we can do once we get agreement on the overall architecture
• Bumped the Melange to latest version, so it brings some new dependencies.

Future ideas:

• Create a new /rules folder to separate rules (as godolint did)
• Give ID for each rule? (i.e., WL0001)
• Better output format (table output, nicer log printing)
• Verbose mode to print some additional description and stuff
• Rich options (fail-fast, exclude/include rules by IDs, override exit code by severity, etc.)

Known Bug?:

• We couldn't add strict field checking while unmarshaling given YAML since secfixes didn't introduce in build.Configuration yet on main branch but generally used in the package files.

Example Output:

$ go run . lint os -v
found 198 packages
2022/12/15 12:37:23 Package: wait-for-it: 1 error occurred:
	* [no-makefile-entry-for-package]: package wait-for-it is not exist in the Makefile (ERROR) - (every package should have a corresponding entry in Makefile)

(Exit code is 0, should we return 1? (if severity >= ERROR))

/cc @rawlingsj @developer-guy

Signed-off-by: Furkan furkan.turkal@trendyol.com
Co-authored-by: Batuhanbatuhan.apaydin@trendyol.com

[rawlingsj]

this looks great!

I think we can merge on the agreement of a followup PR to add tests if that's ok with you?

(Exit code is 0, should we return 1? (if severity >= ERROR))

Yeah let's return 1 so that we can easily fail CI?

[rawlingsj]

Or if you prefer to add a test to this PR that's probably better and good practice. To answer the initial question I think this is a great start and we can iterate over time to improve.

[Dentrax]

Makes sense! We will add some test cases in this PR. (+ exit 1)

[rawlingsj]

perfect - one more thing you might want to do is run make docs to generate the CLI docs.

[developer-guy]

We also thought enabling/disabling options for the available linting rules might be a good option, WDYT?

[rawlingsj]

We also thought enabling/disabling options for the available linting rules might be a good option, WDYT?

yeah that sounds good though maybe as a followup PR?

[rawlingsj]

Just waiting on this and we should be good to go #2 (comment)

[Dentrax]

I think we are ready for the review! @rawlingsj

• Add some test cases (last commit)
• Separate digest check logic to new rule: valid-pipeline-fetch-digest
• --list option to list all available rules
• Error out and exit 1 if any failing rule

[rawlingsj]

@Dentrax @developer-guy great work!

[rawlingsj]

I'll look at getting wolfi os using the new linter and see how we go.

[Dentrax]

Thanks for such prompt merge! Looking forward to the new rules! 🚀

[developer-guy]

Most of the development effort belongs to @Dentrax, I just added couple things, so thx @Dentrax 🏅