fix another 39 errors by upgrading golangci-lint

Signed-off-by: Leslie Qi Wang <qiwa@pensando.io>

Author: leslie-qiwa

.golangci.yml

@@ -4,7 +4,8 @@ run:
 
 linters-settings:
   govet:
-    check-shadowing: true
+    enable:
+      - shadow
   revive:
     min-confidence: 0.8
   gocyclo:
@@ -41,14 +42,14 @@ linters:
     - dogsled
     - dupl
     - errcheck
-    - exportloopref
+    - copyloopvar  # replaces exportloopref for Go 1.22+
     - exhaustive
     - goconst
     - gocritic
     - gofmt
     - goimports
     - revive # replaces golint
-    - gomnd
+    - mnd    # replaces gomnd
     - goprintffuncname
     - gosec
     - gosimple
@@ -72,12 +73,12 @@ issues:
   exclude-rules:
     - path: _test\.go
       linters:
-        - gomnd
+        - mnd
         - gocritic
         - gosec
     - path: main\.go
       linters:
-        - gomnd
+        - mnd
     - path: protocol/
       linters:
         - revive # Protocol has many generated-like structs

actionsdotnetactcompat/act_worker.go

@@ -163,7 +163,7 @@ func (f *ghaFormatter) Format(entry *logrus.Entry) ([]byte, error) {
 	}
 	if f.rqt.Variables != nil {
 		for _, v := range f.rqt.Variables {
-			if v.IsSecret && len(v.Value) > 0 && !strings.EqualFold(v.Value, "true") &&
+			if v.IsSecret && v.Value != "" && !strings.EqualFold(v.Value, "true") &&
 				!strings.EqualFold(v.Value, "false") && !strings.EqualFold(v.Value, "0") && !strings.EqualFold(v.Value, "1") {
 				entry.Message = strings.ReplaceAll(entry.Message, v.Value, "***")
 			}
@@ -260,17 +260,17 @@ func ExecWorker(rqt *protocol.AgentJobRequestMessage, wc actionsrunner.WorkerCon
 	env["ACTIONS_RUNTIME_URL"] = vssConnection.TenantURL
 	env["ACTIONS_RUNTIME_TOKEN"] = vssConnection.Token
 
-	if cacheURL, cacheOk := vssConnectionData["CacheServerUrl"]; cacheOk && len(cacheURL) > 0 {
+	if cacheURL, cacheOk := vssConnectionData["CacheServerUrl"]; cacheOk && cacheURL != "" {
 		env["ACTIONS_CACHE_URL"] = cacheURL
 	}
-	if idTokenURL, idTokenOk := vssConnectionData["GenerateIdTokenUrl"]; idTokenOk && len(idTokenURL) > 0 {
+	if idTokenURL, idTokenOk := vssConnectionData["GenerateIdTokenUrl"]; idTokenOk && idTokenURL != "" {
 		env["ACTIONS_ID_TOKEN_REQUEST_URL"] = idTokenURL
 		env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] = vssConnection.Token
 	}
-	if resultsServiceURL, resultsOk := vssConnectionData["ResultsServiceUrl"]; resultsOk && len(resultsServiceURL) > 0 {
+	if resultsServiceURL, resultsOk := vssConnectionData["ResultsServiceUrl"]; resultsOk && resultsServiceURL != "" {
 		env["ACTIONS_RESULTS_URL"] = resultsServiceURL
 	}
-	if pipelinesServiceURL, pipelinesOk := vssConnectionData["PipelinesServiceUrl"]; pipelinesOk && len(pipelinesServiceURL) > 0 {
+	if pipelinesServiceURL, pipelinesOk := vssConnectionData["PipelinesServiceUrl"]; pipelinesOk && pipelinesServiceURL != "" {
 		env["ACTIONS_RUNTIME_URL"] = pipelinesServiceURL
 	}
 	if usesCacheServiceV2, cacheV2Ok := rqt.Variables["actions_uses_cache_service_v2"]; cacheV2Ok &&
@@ -542,7 +542,12 @@ func ExecWorker(rqt *protocol.AgentJobRequestMessage, wc actionsrunner.WorkerCon
 		if canEvaluateNow {
 			rec.Name = eval.Interpolate(jobExecCtx, rec.Name)
 		}
-		jlogger.Append(&rec).Order = int32(i + len(steps) + 1)
+		// Check for integer overflow before conversion
+		order := i + len(steps) + 1
+		if order > protocol.MaxInt32 { // int32 max value
+			order = protocol.MaxInt32
+		}
+		jlogger.Append(&rec).Order = int32(order) //nolint:gosec // bounds checked above
 	}
 
 	logrus.SetLevel(actLogger.GetLevel())

actionsdotnetactcompat/step_converter.go

@@ -121,7 +121,7 @@ func ConvertSteps(jobSteps []protocol.ActionStep) ([]*model.Step, error) {
 				uses = step.Reference.Path
 			} else {
 				uses = step.Reference.Name
-				if len(step.Reference.Path) > 0 {
+				if step.Reference.Path != "" {
 					uses = uses + "/" + step.Reference.Path
 				}
 				uses = uses + "@" + step.Reference.Ref

actionsrunner/runner.go

@@ -605,7 +605,7 @@ func runJob(runnerenv RunnerEnvironment, joblock *sync.Mutex, vssConnection *pro
 
 		logger.Log(logrus.InfoLevel, "Runner Name: "+instance.Agent.Name)
 		logger.Log(logrus.InfoLevel, "Runner OSDescription: github-act-runner "+runtime.GOOS+"/"+runtime.GOARCH)
-		if len(run.Version) > 0 {
+		if run.Version != "" {
 			logger.Log(logrus.InfoLevel, "Runner Version: "+run.Version)
 		}
 

actionsrunner/worker_runner_environment.go

@@ -83,7 +83,11 @@ func (arunner *WorkerRunnerEnvironment) ExecWorker(
 	if err != nil {
 		fmt.Printf("failed to write new job: %s", err)
 	}
-	binary.BigEndian.PutUint32(mid, uint32(len(src)))
+	// Check for integer overflow before conversion
+	if len(src) > protocol.MaxUint32 { // 2^32 - 1
+		return fmt.Errorf("message too large for uint32 conversion: %d bytes", len(src))
+	}
+	binary.BigEndian.PutUint32(mid, uint32(len(src))) //nolint:gosec // bounds checked above
 	_, err = in.Write(mid)
 	if err != nil {
 		fmt.Printf("failed to write new job: %s", err)
@@ -102,7 +106,12 @@ func (arunner *WorkerRunnerEnvironment) ExecWorker(
 			if err != nil {
 				fmt.Printf("failed to write cancel job: %s", err)
 			}
-			binary.BigEndian.PutUint32(mid, uint32(len(src)))
+			// Check for integer overflow before conversion
+			if len(src) > protocol.MaxUint32 { // 2^32 - 1
+				fmt.Printf("cancel message too large for uint32 conversion: %d bytes", len(src))
+				return
+			}
+			binary.BigEndian.PutUint32(mid, uint32(len(src))) //nolint:gosec // bounds checked above
 			_, err = in.Write(mid)
 			if err != nil {
 				fmt.Printf("failed to write cancel job length: %s", err)

main.go

@@ -255,7 +255,7 @@ func main() {
 		Use:   "configure",
 		Short: "Configure your self-hosted runner",
 		Args:  cobra.MaximumNArgs(0),
-		Run: func(cmd *cobra.Command, args []string) {
+		Run: func(_ *cobra.Command, _ []string) {
 			config.ReadFromEnvironment()
 			settings := &runnerconfiguration.RunnerSettings{}
 			if !printJITConfig {
@@ -322,7 +322,7 @@ func main() {
 		Use:   "run",
 		Short: "Run your self-hosted runner",
 		Args:  cobra.MaximumNArgs(0),
-		Run: func(cmd *cobra.Command, args []string) {
+		Run: func(_ *cobra.Command, _ []string) {
 			os.Exit(run.Run())
 		},
 	}
@@ -339,7 +339,7 @@ func main() {
 		Use:   "remove",
 		Short: "Remove your self-hosted runner",
 		Args:  cobra.MaximumNArgs(0),
-		Run: func(cmd *cobra.Command, args []string) {
+		Run: func(_ *cobra.Command, _ []string) {
 			remove.ReadFromEnvironment()
 			var settings *runnerconfiguration.RunnerSettings
 			var err error
@@ -396,7 +396,7 @@ func main() {
 		Use:   "worker",
 		Short: "Run as self-hosted runner worker, can be used to create ephemeral worker without exposing other job requests",
 		Args:  cobra.MaximumNArgs(0),
-		Run: func(cmd *cobra.Command, args []string) {
+		Run: func(_ *cobra.Command, _ []string) {
 			ccontext, cancelccontext := context.WithCancel(context.Background())
 			go func() {
 				execcontext, cancelExec := context.WithCancel(context.Background())
@@ -459,7 +459,7 @@ func main() {
 	svcRun := &cobra.Command{
 		Use:   "run",
 		Short: "Used as service entrypoint",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			err := os.Chdir(wd)
 			if err != nil {
 				return err
@@ -492,7 +492,7 @@ func main() {
 	svcInstall := &cobra.Command{
 		Use:   "install",
 		Short: "Install the service may require admin privileges",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			svc, err := service.New(&RunRunnerSvc{}, getSvcConfig(wd, envFile))
 
 			if err != nil {
@@ -510,7 +510,7 @@ func main() {
 	svcUninstall := &cobra.Command{
 		Use:   "uninstall",
 		Short: "Uninstall the service may require admin privileges",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			svc, err := service.New(&RunRunnerSvc{}, getSvcConfig(wd, envFile))
 
 			if err != nil {
@@ -522,7 +522,7 @@ func main() {
 	svcStart := &cobra.Command{
 		Use:   "start",
 		Short: "Start the service may require admin privileges",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			svc, err := service.New(&RunRunnerSvc{}, getSvcConfig(wd, envFile))
 
 			if err != nil {
@@ -534,7 +534,7 @@ func main() {
 	svcStop := &cobra.Command{
 		Use:   "stop",
 		Short: "Stop the service may require admin privileges",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			svc, err := service.New(&RunRunnerSvc{}, getSvcConfig(wd, envFile))
 
 			if err != nil {

protocol/connection.go

@@ -216,7 +216,7 @@ func (vssConnection *VssConnection) requestWithContextNoAuth(
 	if err != nil {
 		return 0, err
 	}
-	if len(apiversion) > 0 {
+	if apiversion != "" {
 		// vssservice always needs a version, even if there is no content
 		if parsedURL, parseErr := url.Parse(requesturl); parseErr == nil {
 			query := parsedURL.Query()
@@ -242,7 +242,7 @@ func (vssConnection *VssConnection) requestWithContextNoAuth(
 			header.Set(acceptHeader, "application/json")
 		}
 	}
-	if len(apiversion) > 0 {
+	if apiversion != "" {
 		// vssservice does only accept contenttype in a single line
 		if len(header[contentTypeHeader]) > 0 {
 			header[contentTypeHeader][0] += apiVersionSuffix + apiversion
@@ -254,9 +254,9 @@ func (vssConnection *VssConnection) requestWithContextNoAuth(
 		header["X-TFS-FedAuthRedirect"] = []string{"Suppress"}
 		header["X-TFS-Session"] = []string{uuid.NewString()}
 	}
-	if len(vssConnection.Token) > 0 {
+	if vssConnection.Token != "" {
 		header["Authorization"] = []string{"bearer " + vssConnection.Token}
-	} else if len(vssConnection.AuthHeader) > 0 {
+	} else if vssConnection.AuthHeader != "" {
 		header["Authorization"] = []string{vssConnection.AuthHeader}
 	}
 	if vssConnection.Trace {

protocol/logger/job_logger.go

@@ -113,7 +113,7 @@ func (logger *WebsocketLiveloggerWithFallback) InitializeVssLogger() {
 
 func (logger *WebsocketLiveloggerWithFallback) Initialize() {
 	_ = logger.Close() // Ignore error for cleanup
-	if len(logger.FeedStreamURL) > 0 {
+	if logger.FeedStreamURL != "" {
 		wslogger := &WebsocketLivelogger{
 			JobRequest:    logger.JobRequest,
 			Connection:    logger.Connection,

protocol/template_token.go

@@ -35,6 +35,11 @@ const (
 
 	// Template directive names
 	insertDirective = "insert"
+
+	// Integer overflow protection constants
+	MaxInt32  = 2147483647  // Maximum value for int32
+	MinInt32  = -2147483648 // Minimum value for int32
+	MaxUint32 = 4294967295  // Maximum value for uint32
 )
 
 type MapEntry struct {
@@ -407,10 +412,13 @@ func (converter *TemplateTokenConverter) ToYamlNode(token *TemplateToken) (ret *
 func (converter *TemplateTokenConverter) FromYamlNode(node *yaml.Node) (ret *TemplateToken, err error) {
 	defer func() {
 		if ret != nil && (node.Column != 0 || node.Line != 0) {
-			column := int32(node.Column)
-			line := int32(node.Line)
-			ret.Column = &column
-			ret.Line = &line
+			// Check for integer overflow before conversion
+			if node.Column <= MaxInt32 && node.Line <= MaxInt32 && node.Column >= MinInt32 && node.Line >= MinInt32 {
+				column := int32(node.Column) //nolint:gosec // bounds checked above
+				line := int32(node.Line)     //nolint:gosec // bounds checked above
+				ret.Column = &column
+				ret.Line = &line
+			}
 		}
 	}()
 	retNil := func() *TemplateToken {

runnerconfiguration/add.go

@@ -92,7 +92,7 @@ func (config *ConfigureRunner) Configure(
 		if len(taskAgentPools) == 0 {
 			return nil, fmt.Errorf("failed to configure runner, no self-hosted runner group available")
 		}
-		if len(config.RunnerGroup) > 0 {
+		if config.RunnerGroup != "" {
 			taskAgentPool = config.RunnerGroup
 		} else {
 			taskAgentPool = taskAgentPools[0]
@@ -115,7 +115,11 @@ func (config *ConfigureRunner) Configure(
 
 	taskAgent := &protocol.TaskAgent{}
 	bs := make([]byte, rsaExponentBytes)
-	ui := uint32(key.E)
+	// Check for integer overflow before conversion
+	if key.E > protocol.MaxUint32 {
+		return nil, fmt.Errorf("RSA exponent too large for uint32 conversion")
+	}
+	ui := uint32(key.E) //nolint:gosec // bounds checked above
 	binary.BigEndian.PutUint32(bs, ui)
 	expof := 0
 	for ; expof < 3 && bs[expof] == 0; expof++ { //nolint:revive // empty-block: intentionally empty loop to find non-zero bytes
@@ -136,7 +140,7 @@ func (config *ConfigureRunner) Configure(
 		}
 	}
 	if !config.Unattended && len(config.Labels) == 0 {
-		if res := survey.GetInput("Please enter custom labels of your new runner (case insensitive, separated by ','):", ""); len(res) > 0 {
+		if res := survey.GetInput("Please enter custom labels of your new runner (case insensitive, separated by ','):", ""); res != "" {
 			config.Labels = strings.Split(res, ",")
 		}
 	}