[MAINT] Create custom golangci-lint to integrate tfproviderlint

.custom-gcl.yml

@@ -0,0 +1,5 @@
+version: v2.10.1 # should be in sync with GNUmakefile
+
+plugins:
+  - module: "github.com/integrations/terraform-provider-github/tools/tfproviderlint"
+    path: ./tools/tfproviderlint

.github/workflows/ci-linter.yaml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - release-v*
+    paths:
+      - tools/tfproviderlint/**
+  pull_request:
+    branches:
+      - main
+      - release-v*
+    paths:
+      - tools/tfproviderlint/**
+
+concurrency:
+  group: ci-linter-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  test:
+    name: Custom Linter Tests
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set-up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: |
+            go.sum
+            tools/tfproviderlint/go.sum
+      - run: make test-tools

.github/workflows/ci.yaml

@@ -16,15 +16,19 @@ concurrency:
 
 permissions: read-all
 
+env:
+  GOLANGCI_LINT_VERSION: v2.10.1
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
-  ci:
+  test:
     name: Continuous Integration
     runs-on: ubuntu-latest
     permissions:
       contents: read
-    defaults:
-      run:
-        shell: bash
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -33,6 +37,48 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - run: make tools
-      - run: make build
+      - run: make build -o lintcheck
       - run: make test
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set-up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        with:
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+  golangci-new:
+    name: lint-new
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set-up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: go.mod
+          cache: true
+          cache-dependency-path: |
+            go.sum
+            tools/tfproviderlint/go.sum
+            custom-gcl
+      - run: make .golangci.new.yml
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        with:
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          only-new-issues: true
+          args: --config=.golangci.new.yml

.gitignore

@@ -27,8 +27,10 @@ website/node_modules
 *.tfvars
 .vscode/
 testdata/
+!tools/tfproviderlint/**/testdata/
 website/vendor
 terraform-provider-github
+.golangci.new.yml
 
 # Test exclusions
 !command/test-fixtures/**/*.tfstate

.golangci.strict.yml

@@ -0,0 +1,34 @@
+# This file is for linting rules we want to start enforcing, but can't enable for the whole codebase yet.
+# Always try adding new rules to .golangci.yml first. If they cause too many issues to fix, add them here.
+# Once a rule in here has been fixed across the codebase, remove it from here and add it to .golangci.yml.
+version: "2"
+
+linters:
+  enable:
+    - forcetypeassert
+    - revive
+
+  settings:
+    custom:
+      tfproviderlint:
+        settings:
+          # https://github.com/bflad/tfproviderlint/tree/main?tab=readme-ov-file#standard-acceptance-test-checks
+          enabled-checks:
+            - AT009 # https://github.com/bflad/tfproviderlint/tree/main/passes/AT009
+            - R002 # https://github.com/bflad/tfproviderlint/tree/main/passes/R002
+            - R004 # https://github.com/bflad/tfproviderlint/tree/main/passes/R004
+            - R009 # https://github.com/bflad/tfproviderlint/tree/main/passes/R009
+            - R010 # https://github.com/bflad/tfproviderlint/tree/main/passes/R010
+            - R018 # https://github.com/bflad/tfproviderlint/tree/main/passes/R018
+            - S006 # https://github.com/bflad/tfproviderlint/tree/main/passes/S006
+            - S013 # https://github.com/bflad/tfproviderlint/tree/main/passes/S013
+            - S019 # https://github.com/bflad/tfproviderlint/tree/main/passes/S019
+            - S020 # https://github.com/bflad/tfproviderlint/tree/main/passes/S020
+            - XR002 # https://github.com/bflad/tfproviderlint/tree/main/passes/XR002
+            - XR003 # https://github.com/bflad/tfproviderlint/tree/main/passes/XR003
+            - XR005 # https://github.com/bflad/tfproviderlint/tree/main/passes/XR005
+            - XR007 # https://github.com/bflad/tfproviderlint/tree/main/passes/XR007
+            - XS001 # https://github.com/bflad/tfproviderlint/tree/main/passes/XS001
+            # Custom local checks
+            - L002 # file:///./tools/tfproviderlint/checks/L002/L002.go
+            - L003 # file:///./tools/tfproviderlint/checks/L003/L003.go

.golangci.yml

@@ -12,7 +12,6 @@ linters:
     - errcheck
     - errname
     - errorlint
-    # - forcetypeassert TODO: Re-enable when we can fix the issues
     - godot
     - govet
     - ineffassign
@@ -27,6 +26,64 @@ linters:
     - unparam
     - unused
     - usetesting
+    - tfproviderlint
+
+  settings:
+    custom:
+      tfproviderlint:
+        type: module
+        description: Reports Terraform provider linting issues.
+        original-url: github.com/bflad/tfproviderlint/cmd/tfproviderlintx
+        settings:
+          # https://github.com/bflad/tfproviderlint/tree/main?tab=readme-ov-file#standard-acceptance-test-checks
+          enabled-checks:
+            - AT005 # https://github.com/bflad/tfproviderlint/tree/main/passes/AT005
+            - AT008 # https://github.com/bflad/tfproviderlint/tree/main/passes/AT008
+            - R005 # https://github.com/bflad/tfproviderlint/tree/main/passes/R005
+            - R006 # https://github.com/bflad/tfproviderlint/tree/main/passes/R006
+            - R011 # https://github.com/bflad/tfproviderlint/tree/main/passes/R011
+            - R012 # https://github.com/bflad/tfproviderlint/tree/main/passes/R012
+            - R013 # https://github.com/bflad/tfproviderlint/tree/main/passes/R013
+            - R015 # https://github.com/bflad/tfproviderlint/tree/main/passes/R015
+            - R016 # https://github.com/bflad/tfproviderlint/tree/main/passes/R016
+            - R017 # https://github.com/bflad/tfproviderlint/tree/main/passes/R017
+            - S001 # https://github.com/bflad/tfproviderlint/tree/main/passes/S001
+            - S002 # https://github.com/bflad/tfproviderlint/tree/main/passes/S002
+            - S003 # https://github.com/bflad/tfproviderlint/tree/main/passes/S003
+            - S004 # https://github.com/bflad/tfproviderlint/tree/main/passes/S004
+            - S005 # https://github.com/bflad/tfproviderlint/tree/main/passes/S005
+            - S007 # https://github.com/bflad/tfproviderlint/tree/main/passes/S007
+            - S008 # https://github.com/bflad/tfproviderlint/tree/main/passes/S008
+            - S009 # https://github.com/bflad/tfproviderlint/tree/main/passes/S009
+            - S010 # https://github.com/bflad/tfproviderlint/tree/main/passes/S010
+            - S011 # https://github.com/bflad/tfproviderlint/tree/main/passes/S011
+            - S012 # https://github.com/bflad/tfproviderlint/tree/main/passes/S012
+            - S014 # https://github.com/bflad/tfproviderlint/tree/main/passes/S014
+            - S015 # https://github.com/bflad/tfproviderlint/tree/main/passes/S015
+            - S016 # https://github.com/bflad/tfproviderlint/tree/main/passes/S016
+            - S017 # https://github.com/bflad/tfproviderlint/tree/main/passes/S017
+            - S018 # https://github.com/bflad/tfproviderlint/tree/main/passes/S018
+            - S021 # https://github.com/bflad/tfproviderlint/tree/main/passes/S021
+            - S022 # https://github.com/bflad/tfproviderlint/tree/main/passes/S022
+            - S023 # https://github.com/bflad/tfproviderlint/tree/main/passes/S023
+            - S024 # https://github.com/bflad/tfproviderlint/tree/main/passes/S024
+            - S025 # https://github.com/bflad/tfproviderlint/tree/main/passes/S025
+            - S026 # https://github.com/bflad/tfproviderlint/tree/main/passes/S026
+            - S027 # https://github.com/bflad/tfproviderlint/tree/main/passes/S027
+            - S028 # https://github.com/bflad/tfproviderlint/tree/main/passes/S028
+            - S029 # https://github.com/bflad/tfproviderlint/tree/main/passes/S029
+            - S030 # https://github.com/bflad/tfproviderlint/tree/main/passes/S030
+            - S031 # https://github.com/bflad/tfproviderlint/tree/main/passes/S031
+            - S032 # https://github.com/bflad/tfproviderlint/tree/main/passes/S032
+            - S033 # https://github.com/bflad/tfproviderlint/tree/main/passes/S033
+            - S035 # https://github.com/bflad/tfproviderlint/tree/main/passes/S035
+            - S036 # https://github.com/bflad/tfproviderlint/tree/main/passes/S036
+            - S037 # https://github.com/bflad/tfproviderlint/tree/main/passes/S037
+            - XR004 # https://github.com/bflad/tfproviderlint/tree/main/passes/XR004
+            - XR006 # https://github.com/bflad/tfproviderlint/tree/main/passes/XR006
+            - XR008 # https://github.com/bflad/tfproviderlint/tree/main/passes/XR008
+            # Custom local checks
+            - L001 # file:///./tools/tfproviderlint/checks/L001/L001.go
 
   exclusions:
     generated: lax

GNUmakefile

@@ -4,6 +4,7 @@ TEST?=./$(PKG_NAME)/...
 WEBSITE_REPO=github.com/hashicorp/terraform-website
 
 COVERAGEARGS?=-race -coverprofile=coverage.txt -covermode=atomic
+BIN="$$(pwd -P)"/bin
 
 # VARIABLE REFERENCE:
 #
@@ -27,23 +28,49 @@ endif
 
 default: build
 
-tools:
-	go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10.1
+bin/golangci-lint:
+	@echo "==> Installing golangci-lint..."
+	mkdir -p $(BIN)
+	GOBIN=$(BIN) go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10.1
+
+tools_go_files = $(shell find tools \( -name '*.go' -or -name '*.mod' -or -name '*.sum' \) -and -not -name '*_test.go' -maxdepth 4)
+bin/custom-gcl: bin/golangci-lint $(tools_go_files)
+	@echo "==> Building custom-gcl..."
+	@$(BIN)/golangci-lint custom --name custom-gcl --destination $(BIN)
+
+tools: bin/custom-gcl go.sum
+
+go.sum: go.mod $(shell find github -name '*.go')
+	@go mod tidy
 
 build: lintcheck
 	CGO_ENABLED=0 go build -ldflags="-s -w" ./...
 
-fmt:
+fmt: tools
 	@echo "==> Fixing source code formatting..."
-	golangci-lint fmt ./...
+	$(BIN)/custom-gcl fmt ./... ./tools/...
 
-lint:
+lint: tools
 	@echo "==> Checking source code against linters and fixing..."
-	golangci-lint run --fix ./...
+	$(BIN)/custom-gcl run --fix ./...
+
+lintcheck: tools
+	@branch=$$(git rev-parse --abbrev-ref HEAD); \
+	printf "==> Checking source code against linters on branch: \033[1m%s\033[0m...\n" "🌿 $$branch 🌿"
+	$(BIN)/custom-gcl run ./...
 
-lintcheck:
-	@echo "==> Checking source code against linters..."
-	golangci-lint run ./...
+.golangci.new.yml: .golangci.yml .golangci.strict.yml
+	@yq eval-all 'select(fileIndex == 0) *+ select(fileIndex == 1)' .golangci.yml .golangci.strict.yml > .golangci.new.yml 
+
+lintcheck-new: tools .golangci.new.yml
+	@branch=$$(git rev-parse --abbrev-ref HEAD); \
+	printf "==> Checking changed source code against linters on branch: \033[1m%s\033[0m...\n" "🌿 $$branch 🌿"
+	$(BIN)/custom-gcl run ./... --new-from-merge-base main --config .golangci.new.yml
+
+lintcheck-strict: tools .golangci.new.yml
+	@branch=$$(git rev-parse --abbrev-ref HEAD); \
+	printf "==> Checking source code against strict linters on branch: \033[1m%s\033[0m...\n" "🌿 $$branch 🌿"
+	$(BIN)/custom-gcl run ./... --config .golangci.new.yml
 
 test:
 	@branch=$$(git rev-parse --abbrev-ref HEAD); \
@@ -56,6 +83,10 @@ test:
 		$(RUNARGS) $(TESTARGS) \
 		-count 1;
 
+test-tools:
+	@echo "==> Running tools tests..."
+	$(MAKE) test -C tools/tfproviderlint
+
 testacc:
 	@branch=$$(git rev-parse --abbrev-ref HEAD); \
 	printf "==> Running acceptance tests on branch: \033[1m%s\033[0m...\n" "🌿 $$branch 🌿"
@@ -79,4 +110,4 @@ ifeq (,$(wildcard $(GOPATH)/src/$(WEBSITE_REPO)))
 endif
 	@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider-test PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
 
-.PHONY: build test testacc fmt lint lintcheck tools website website-test sweep
+.PHONY: build test testacc fmt lint lintcheck lintcheck-new lintcheck-strict tools test-tools website website-test sweep

github/resource_github_team_settings.go

@@ -225,7 +225,7 @@ func resourceGithubTeamSettingsRead(ctx context.Context, d *schema.ResourceData,
 }
 
 func resourceGithubTeamSettingsUpdate(ctx context.Context, d *schema.ResourceData, m any) diag.Diagnostics {
-	if d.HasChange("review_request_delegation") || d.HasChange("notify") {
+	if d.HasChanges("review_request_delegation", "notify") {
 		meta := m.(*Owner)
 		graphql := meta.v4client
 		reviewRequestDelegation := d.Get("review_request_delegation").([]any)

tools/tfproviderlint/GNUmakefile

@@ -0,0 +1,13 @@
+test_go_sums = $(patsubst %/go.mod,%/go.sum,$(wildcard checks/*/testdata/go.mod)) 
+
+.SECONDEXPANSION:                                                                                                                                                                                                                                                                                                        
+checks/%/testdata/go.sum: checks/%/testdata/go.mod $$(wildcard checks/$$*/*.go)
+	@cd $(dir $@) && go mod tidy
+
+go.sum: go.mod $(shell find checks -name '*.go' -maxdepth 2)
+	@go mod tidy
+
+test: go.sum $(test_go_sums)
+	CGO_ENABLED=0 go test ./... -v -count=1 -timeout=30s -parallel=4
+
+.PHONY: test

tools/tfproviderlint/checks/L001/L001.go

@@ -0,0 +1,46 @@
+// Package L001 defines an Analyzer that checks for
+// Schema with ValidateFunc configured
+package L001
+
+import (
+	"github.com/bflad/tfproviderlint/helper/terraformtype/helper/schema"
+	"github.com/bflad/tfproviderlint/passes/commentignore"
+	"github.com/bflad/tfproviderlint/passes/helper/schema/schemainfo"
+	"golang.org/x/tools/go/analysis"
+)
+
+const Doc = `check for Schema with ValidateFunc configured
+
+The L001 analyzer reports cases of schemas which configures ValidateFunc instead of ValidateDiagFunc
+, which will fail provider schema validation.
+
+This is because ValidateFunc is deprecated.`
+
+const analyzerName = "L001"
+
+var Analyzer = &analysis.Analyzer{
+	Name: analyzerName,
+	Doc:  Doc,
+	Requires: []*analysis.Analyzer{
+		commentignore.Analyzer,
+		schemainfo.Analyzer,
+	},
+	Run: run,
+}
+
+func run(pass *analysis.Pass) (any, error) {
+	ignorer := pass.ResultOf[commentignore.Analyzer].(*commentignore.Ignorer)
+	schemaInfos := pass.ResultOf[schemainfo.Analyzer].([]*schema.SchemaInfo)
+	for _, schemaInfo := range schemaInfos {
+		if ignorer.ShouldIgnore(analyzerName, schemaInfo.AstCompositeLit) {
+			continue
+		}
+
+		if !schemaInfo.DeclaresField("ValidateFunc") {
+			continue
+		}
+
+		pass.Reportf(schemaInfo.AstCompositeLit.Pos(), "%s: schema should not configure ValidateFunc, replace it with ValidateDiagFunc", analyzerName)
+	}
+	return nil, nil
+}