align go repository

.github/CONTRIBUTING.md

@@ -7,4 +7,8 @@ Thanks for trying to improve the csi-cloudscale experience.
    Pull Request (to get the correct PR number).
 2. If it's a breaking change or exceeds 100 lines of code then please open an
    issue first and describe the changes you want to make.
-
+3. Before opening a PR, make sure to run:
+   ```
+   make lint-fix
+   make test
+   ```

.github/dependabot.yml

@@ -5,16 +5,20 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - "version-update:semver-patch"
+      day: "monday"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
 
   # Check for Go module updates
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
     allow:
       - dependency-type: "direct"
     groups:
@@ -34,23 +38,32 @@ updates:
     directory: "/charts/csi-cloudscale"
     schedule:
       interval: "weekly"
+      day: "monday"
+    cooldown:
+      default-days: 7
 
   # Check docker base image updates
   - package-ecosystem: "docker"
     directory: "/cmd/cloudscale-csi-plugin"
     schedule:
       interval: "weekly"
+      day: "monday"
     ignore:
       - dependency-name: "*"
         update-types:
           - "version-update:semver-patch"
+    cooldown:
+      default-days: 7
 
   # Check docker side-car containers in helm updates
   - package-ecosystem: "docker"
     directory: "/charts/csi-cloudscale"
     schedule:
       interval: "weekly"
+      day: "monday"
     ignore:
       - dependency-name: "*"
         update-types:
           - "version-update:semver-patch"
+    cooldown:
+      default-days: 7

.github/workflows/govulncheck.yml

@@ -0,0 +1,29 @@
+name: Govulncheck
+
+permissions: {}
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  govulncheck:
+    permissions:
+      contents: read
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run govulncheck
+        run: make govulncheck

.github/workflows/lint.yml

@@ -0,0 +1,29 @@
+name: Lint
+
+permissions: {}
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  lint:
+    permissions:
+      contents: read
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run linter
+        run: make lint

.github/workflows/release-chart.yml

@@ -1,5 +1,7 @@
 name: Release Charts
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -9,19 +11,22 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Configure Git
         run: |
           git config user.name "$GITHUB_ACTOR"
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Install Helm
-        uses: azure/setup-helm@v3.5
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
         with:
           version: v3.9.3
 
@@ -32,7 +37,7 @@ jobs:
           done
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.7.0
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         with:
           config: cr.yaml
         env:

.github/workflows/test.yml

@@ -0,0 +1,31 @@
+name: Tests
+
+permissions: {}
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    permissions:
+      contents: read
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Check Go modules
+        run: go mod tidy -diff
+      - name: Running Tests
+        run: make test TESTARGS='-race'

.github/workflows/zizmor.yml

@@ -0,0 +1,27 @@
+name: Workflow Security Lint
+
+permissions: {}
+
+on:
+  push:
+    branches: [master]
+    paths: ['.github/**']
+  pull_request:
+    paths: ['.github/**']
+
+jobs:
+  zizmor:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    name: zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

.gitignore

@@ -6,3 +6,4 @@ charts/csi-cloudscale/charts
 
 cmd/cloudscale-csi-plugin/cloudscale-csi-plugin
 k8test/
+bin/

.golangci.yml

@@ -0,0 +1,91 @@
+version: "2"
+run:
+  allow-parallel-runners: true
+linters:
+  default: none
+  enable:
+    - asasalint # warns about passing []any to func(...any) without expanding it
+    - asciicheck # non ascii symbols
+    - copyloopvar # copying loop variables
+    - errcheck  # unchecked errors
+    - exhaustive # exhaustiveness of enum switch statements
+    - gocritic # bugs, performance, style
+    - gocyclo # cyclomatic complexity of functions
+    - godoclint # go documentation linting against best practices
+    - gosec # potential security problems
+    - govet # basically 'go vet'
+    - importas # enforces consistent import aliases.
+    - ineffassign # ineffectual assignments
+    - loggercheck # check for even key/value pairs in logger calls
+    - modernize # suggest simplifications to Go code, using modern language and library features
+    - misspell # spelling checks
+    - nakedret  # naked returns (named return parameters and an empty return)
+    # Context cancellation is not safe for state-changing system commands (luksOpen, luksClose, cryptsetup, mkfs, etc.)
+    # because cancellation creates uncertainty about the final system state.
+    # These operations must run to completion or fail definitively.
+    # - noctx  # http requests without context.Context
+    - predeclared # shadowing predeclared identifiers
+    - revive # better version of golint
+    - staticcheck # many static checks
+    - unconvert # unnecessary type conversions
+    - unparam # unused function parameters
+    - unused # unused constants, variables,functions, types
+    - usestdlibvars # using variables/constants from the standard library
+    - usetesting # reports uses of functions with replacement inside the testing package
+    - whitespace # unnecessary newlines
+  settings:
+    loggercheck:
+      kitlog: false
+      slog: false
+      zap: false
+      require-string-key: true
+      no-printf-like: true
+    modernize:
+      disable:
+        - omitzero
+    gocritic:
+      disabled-checks:
+        - ifElseChain # disabled ifElseChain because this is purely stylistic
+    revive:
+      rules:
+        # The following rules are recommended https://github.com/mgechev/revive#recommended-configuration
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: if-return
+        - name: increment-decrement
+        - name: var-naming
+        - name: var-declaration
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+        - name: empty-block
+        - name: superfluous-else
+        - name: unreachable-code
+        - name: redefines-builtin-id
+    staticcheck:
+      dot-import-whitelist:
+        - fmt
+  exclusions:
+    generated: lax
+    warn-unused: true
+formatters:
+  enable:
+    - goimports # ensures imports are organized
+    - gofmt # Check if the code is formatted according to 'gofmt' command.
+  settings:
+    goimports:
+      # A list of prefixes, which, if set, checks import paths
+      # with the given prefixes are grouped after 3rd-party packages.
+      # Default: []
+      local-prefixes:
+        - github.com/cloudscale-ch/csi-cloudscale
+  exclusions:
+    generated: lax
+    warn-unused: true