enable additional linters

.circleci/config.yml

@@ -168,7 +168,7 @@ jobs:
 
   format-go:
     docker:
-      - image: cimg/go:1.21.4
+      - image: cimg/go:1.23.4
     steps:
       - run:
           name: Install gofumpt
@@ -186,7 +186,7 @@ jobs:
   # Build types and cosmwam package without cgo
   wasmvm_no_cgo:
     docker:
-      - image: cimg/go:1.21.4
+      - image: cimg/go:1.23.4
     steps:
       - checkout
       - run:
@@ -205,7 +205,7 @@ jobs:
   # Build types and cosmwasm with libwasmvm linking disabled
   nolink_libwasmvm:
     docker:
-      - image: cimg/go:1.21.4
+      - image: cimg/go:1.23.4
     steps:
       - checkout
       - run:
@@ -223,7 +223,7 @@ jobs:
 
   tidy-go:
     docker:
-      - image: cimg/go:1.21.4
+      - image: cimg/go:1.23.4
     steps:
       - checkout
       - run:
@@ -241,7 +241,7 @@ jobs:
 
   format-scripts:
     docker:
-      - image: cimg/go:1.21.4
+      - image: cimg/go:1.23.4
     steps:
       - run:
           name: Install shfmt
@@ -298,7 +298,7 @@ jobs:
   # Test the Go project and run benchmarks
   wasmvm_test:
     docker:
-      - image: cimg/go:1.21.4
+      - image: cimg/go:1.23.4
     environment:
       GORACE: "halt_on_error=1"
       BUILD_VERSION: $(echo ${CIRCLE_SHA1} | cut -c 1-10)

.github/workflows/lint-go.yml

@@ -20,6 +20,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
+
+
           go-version: "1.23.4"
           cache: false
       - name: golangci-lint

.golangci.yml

@@ -1,10 +1,83 @@
+run:
+  tests: true
+  timeout: 5m
+  skip-dirs:
+    - vendor/
+    - third_party/
+
 linters:
   # Enable specific linter
   # https://golangci-lint.run/usage/linters/#enabled-by-default
   enable:
-    - gofumpt
-    - goimports
+    - errcheck # Detect unchecked errors
+    - gosimple # Simplify code
+    - govet # Reports suspicious constructs
+    - ineffassign # Detect unused assignments
+    - staticcheck # Go static analysis
+    - typecheck # Go type checker
+    - unused # Detect unused constants, variables, functions and types
+
+    # Additional recommended linters
+    - gocritic # A more opinionated linter
+    - gosec # Security checker
+    - misspell # Find commonly misspelled words
+    - revive # a metalinter with more checks
+    - bodyclose # Check HTTP response bodies are closed
+    - goconst # Find repeated strings that could be constants
+    #    - gocyclo # Check function complexity
+    - godot # Check comment endings
+    - gocognit # Check cognitive complexity
+    - whitespace # Check trailing whitespace
+    - thelper # Detect test helpers not using t.Helper()
+    - tparallel # Detect incorrect usage of t.Parallel()
 
 linters-settings:
-  goimports:
-    local-prefixes: github.com/CosmWasm/wasmvm
+  gci:
+    # Section configuration to compare against.
+    # Section names are case-insensitive and may contain parameters in ().
+    # The default order of sections is `standard > default > custom > blank > dot > alias > localmodule`,
+    # If `custom-order` is `true`, it follows the order of `sections` option.
+    # Default: ["standard", "default"]
+    sections:
+      - standard # Standard section: captures all standard packages.
+      - default # Default section: contains all imports that could not be matched to another section type.
+      - prefix(github.com/cosmos/cosmos-sdk) # Custom section: groups all imports with the specified Prefix.
+      - prefix(github.com/cosmos/ibc-go)
+      - blank # Blank section: contains all blank imports. This section is not present unless explicitly enabled.
+      - dot # Dot section: contains all dot imports. This section is not present unless explicitly enabled.
+      - alias # Alias section: contains all alias imports. This section is not present unless explicitly enabled.
+      - localmodule # Local module section: contains all local packages. This section is not present unless explicitly enabled.
+    # Skip generated files.
+    # Default: true
+    skip-generated: false
+    # Enable custom order of sections.
+    # If `true`, make the section order the same as the order of `sections`.
+    # Default: false
+    custom-order: true
+    # Drops lexical ordering for custom sections.
+    # Default: false
+    no-lex-order: true
+  gocritic:
+    # Enable all gocritic checks.
+    disabled-checks:
+      - dupSubExpr
+  gocyclo:
+    min-complexity: 15
+  gocognit:
+    min-complexity: 20
+  dupl:
+    threshold: 100
+  goconst:
+    min-len: 3
+    min-occurrences: 3
+  revive:
+    rules:
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#var-naming
+      - name: var-naming
+        severity: warning
+        disabled: true
+
+issues:
+  exclude-use-default: false
+  max-issues-per-linter: 0
+  max-same-issues: 0

cmd/demo/main.go

@@ -4,53 +4,91 @@ import (
 	"fmt"
 	"math"
 	"os"
+	"path/filepath"
+	"strings"
 
 	wasmvm "github.com/CosmWasm/wasmvm/v2"
 )
 
+// PrintDebug enables debug printing when true.
 const (
-	PRINT_DEBUG  = true
-	MEMORY_LIMIT = 32  // MiB
-	CACHE_SIZE   = 100 // MiB
+	PrintDebug = true
+	// MemoryLimit defines the memory limit in MiB.
+	MemoryLimit = 32
+	// CacheSize defines the cache size in MiB.
+	CacheSize = 100
 )
 
-var SUPPORTED_CAPABILITIES = []string{"staking"}
+// SupportedCapabilities defines the list of supported staking capabilities.
+var SupportedCapabilities = []string{"staking"}
 
-// This is just a demo to ensure we can compile a static go binary
+// exitCode tracks the code that the program will exit with.
+var exitCode = 0
+
+// main is the entry point for the demo application that tests wasmvm functionality.
 func main() {
+	defer func() {
+		os.Exit(exitCode)
+	}()
+
+	if len(os.Args) < 2 {
+		fmt.Println("Usage: demo <file|version>")
+		exitCode = 1
+		return
+	}
+
 	file := os.Args[1]
 
 	if file == "version" {
 		libwasmvmVersion, err := wasmvm.LibwasmvmVersion()
 		if err != nil {
-			panic(err)
+			fmt.Printf("Error getting libwasmvm version: %v\n", err)
+			exitCode = 1
+			return
 		}
 		fmt.Printf("libwasmvm: %s\n", libwasmvmVersion)
 		return
 	}
 
 	fmt.Printf("Running %s...\n", file)
-	bz, err := os.ReadFile(file)
+
+	// Validate file path
+	cleanPath := filepath.Clean(file)
+	if filepath.IsAbs(cleanPath) || strings.Contains(cleanPath, "..") {
+		fmt.Println("Error: invalid file path")
+		exitCode = 1
+		return
+	}
+
+	bz, err := os.ReadFile(cleanPath)
 	if err != nil {
-		panic(err)
+		fmt.Printf("Error reading file: %v\n", err)
+		exitCode = 1
+		return
 	}
 	fmt.Println("Loaded!")
 
-	err = os.MkdirAll("tmp", 0o755)
+	err = os.MkdirAll("tmp", 0o750)
 	if err != nil {
-		panic(err)
+		fmt.Printf("Error creating tmp directory: %v\n", err)
+		exitCode = 1
+		return
 	}
-	vm, err := wasmvm.NewVM("tmp", SUPPORTED_CAPABILITIES, MEMORY_LIMIT, PRINT_DEBUG, CACHE_SIZE)
+	vm, err := wasmvm.NewVM("tmp", SupportedCapabilities, MemoryLimit, PrintDebug, CacheSize)
 	if err != nil {
-		panic(err)
+		fmt.Printf("Error creating VM: %v\n", err)
+		exitCode = 1
+		return
 	}
+	defer vm.Cleanup()
 
 	checksum, _, err := vm.StoreCode(bz, math.MaxUint64)
 	if err != nil {
-		panic(err)
+		fmt.Printf("Error storing code: %v\n", err)
+		exitCode = 1
+		return
 	}
 	fmt.Printf("Stored code with checksum: %X\n", checksum)
 
-	vm.Cleanup()
 	fmt.Println("finished")
 }

go.mod

@@ -1,6 +1,6 @@
 module github.com/CosmWasm/wasmvm/v2
 
-go 1.21
+go 1.23
 
 require (
 	github.com/google/btree v1.0.0

ibc_test.go

@@ -70,12 +70,13 @@ type AccountInfo struct {
 	ChannelID string `json:"channel_id"`
 }
 
-// We just check if an error is returned or not
+// We just check if an error is returned or not.
 type AcknowledgeDispatch struct {
 	Err string `json:"error"`
 }
 
 func toBytes(t *testing.T, v interface{}) []byte {
+	t.Helper()
 	bz, err := json.Marshal(v)
 	require.NoError(t, err)
 	return bz
@@ -109,7 +110,7 @@ func TestIBCHandshake(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotNil(t, i.Ok)
 	iResponse := i.Ok
-	require.Equal(t, 0, len(iResponse.Messages))
+	require.Empty(t, iResponse.Messages)
 
 	// channel open
 	gasMeter2 := api.NewMockGasMeter(TESTING_GAS_LIMIT)
@@ -132,7 +133,7 @@ func TestIBCHandshake(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, conn.Ok)
 	connResponse := conn.Ok
-	require.Equal(t, 1, len(connResponse.Messages))
+	require.Len(t, connResponse.Messages, 1)
 
 	// check for the expected custom event
 	expected_events := []types.Event{{
@@ -200,7 +201,7 @@ func TestIBCPacketDispatch(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, conn.Ok)
 	connResponse := conn.Ok
-	require.Equal(t, 1, len(connResponse.Messages))
+	require.Len(t, connResponse.Messages, 1)
 	id := connResponse.Messages[0].ID
 
 	// mock reflect init callback (to store address)
@@ -237,7 +238,7 @@ func TestIBCPacketDispatch(t *testing.T) {
 	var accounts ListAccountsResponse
 	err = json.Unmarshal(qResponse, &accounts)
 	require.NoError(t, err)
-	require.Equal(t, 1, len(accounts.Accounts))
+	require.Len(t, accounts.Accounts, 1)
 	require.Equal(t, CHANNEL_ID, accounts.Accounts[0].ChannelID)
 	require.Equal(t, REFLECT_ADDR, accounts.Accounts[0].Account)
 
@@ -332,7 +333,7 @@ func TestIBCMsgGetChannel(t *testing.T) {
 	require.Equal(t, msg1.GetChannel(), msg4.GetChannel())
 	require.Equal(t, msg1.GetChannel(), msg5.GetChannel())
 	require.Equal(t, msg1.GetChannel(), msg6.GetChannel())
-	require.Equal(t, msg1.GetChannel().Endpoint.ChannelID, CHANNEL_ID)
+	require.Equal(t, CHANNEL_ID, msg1.GetChannel().Endpoint.ChannelID)
 }
 
 func TestIBCMsgGetCounterVersion(t *testing.T) {