feat(mggolangcilint): use default config with specific linters

Based on our current commonly used subset of linters, and preferred Go
version for projects that will integrate this toolchain (>=1.17).

main.go

@@ -60,34 +60,34 @@ func initMageTools() {
 	}
 
 	// Write tools.mk
-	err = os.WriteFile(filepath.Join(mageDir, "tools.mk"), []byte(toolsMk), 0o644)
+	err = os.WriteFile(filepath.Join(mageDir, "tools.mk"), []byte(toolsMk), 0o600)
 	if err != nil {
 		panic(err)
 	}
 
 	// Write main.go
-	err = os.WriteFile(filepath.Join(mageDir, "main.go"), []byte(mageMain), 0o644)
+	err = os.WriteFile(filepath.Join(mageDir, "main.go"), []byte(mageMain), 0o600)
 	if err != nil {
 		panic(err)
 	}
 
 	// Write magefile.go
-	err = os.WriteFile(filepath.Join(mageDir, "magefile.go"), []byte(magefile), 0o644)
+	err = os.WriteFile(filepath.Join(mageDir, "magefile.go"), []byte(magefile), 0o600)
 	if err != nil {
 		panic(err)
 	}
 
 	_, err = os.Stat("Makefile")
 	if err != nil {
 		// Write Makefile
-		err = os.WriteFile("Makefile", []byte(makefile), 0o644)
+		err = os.WriteFile("Makefile", []byte(makefile), 0o600)
 		if err != nil {
 			panic(err)
 		}
 	} else {
 		const mm = "Makefile.MAGE"
 		logger.Info(fmt.Sprintf("Makefile already exist, writing to %s", mm))
-		err = os.WriteFile(mm, []byte(makefile), 0o644)
+		err = os.WriteFile(mm, []byte(makefile), 0o600)
 		if err != nil {
 			panic(err)
 		}
@@ -101,7 +101,7 @@ func initMageTools() {
 	if err := mgtool.RunInDir("go", mageDir, []string{"mod", "tidy"}...); err != nil {
 		panic(err)
 	}
-	gitIgnore, err := os.OpenFile(".gitignore", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+	gitIgnore, err := os.OpenFile(".gitignore", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
 	if err != nil {
 		panic(err)
 	}

mgmake/generate.go

@@ -42,15 +42,15 @@ func GenerateMakefile(makefile string) error {
 			// Create unique makefile if target is namespaced
 			name := "mage_" + strcase.ToSnake(strings.Split(target, ":")[0])
 			filename := fmt.Sprintf("%s.mk", filepath.Join(genDir, strcase.ToKebab(name)))
-			f, err = os.OpenFile(filename, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+			f, err = os.OpenFile(filename, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
 			if err != nil {
 				return err
 			}
 			if _, ok := mgMakefiles[name]; !ok {
 				mgMakefiles[name] = filename
 			}
 		} else {
-			f, err = os.OpenFile(mgDefaultTargets, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+			f, err = os.OpenFile(mgDefaultTargets, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
 			if err != nil {
 				return err
 			}
@@ -76,7 +76,7 @@ endif{{end}}
 			return err
 		}
 	}
-	err = os.WriteFile(makefile, createMakefileVariablesFromMap(mgMakefiles), 0o644)
+	err = os.WriteFile(makefile, createMakefileVariablesFromMap(mgMakefiles), 0o600)
 	if err != nil {
 		return err
 	}

mgtool/build.go

@@ -10,7 +10,7 @@ import (
 	"github.com/magefile/mage/sh"
 )
 
-func GoInstall(ctx context.Context, goPkg string, version string) (string, error) {
+func GoInstall(ctx context.Context, goPkg, version string) (string, error) {
 	toolDir, err := filepath.Abs(GetPath())
 	if err != nil {
 		return "", err

mgtool/configuration.go

@@ -17,6 +17,7 @@ const (
 // Path This should only be used to set a custom value.
 // Targets should use path() instead which performs
 // validation on whether a path is set.
+// nolint: gochecknoglobals
 var mgToolPath = GetGitRootPath(".mage/tools")
 
 func GetCWDPath(path string) string {
@@ -54,7 +55,7 @@ func SetPath(p string) {
 	mgToolPath = p
 }
 
-func IsSupportedVersion(versions []string, version string, name string) error {
+func IsSupportedVersion(versions []string, version, name string) error {
 	for _, a := range versions {
 		if a == version {
 			return nil

mgtool/doc.go

@@ -0,0 +1,2 @@
+// Package mgtool provides primitives for downloading and invoking tools.
+package mgtool

mgtool/file.go

@@ -55,7 +55,7 @@ func FromRemote(ctx context.Context, addr string, opts ...Opt) error {
 		}
 	}
 	logr.FromContextOrDiscard(ctx).Info("fetching", "address", addr)
-	rStream, cleanup, err := downloadBinary(addr)
+	rStream, cleanup, err := downloadBinary(ctx, addr)
 	if err != nil {
 		return fmt.Errorf("unable to download file: %w", err)
 	}
@@ -121,8 +121,7 @@ func (s *fileState) handleFileStream(inFile io.Reader, filename string) error {
 			return fmt.Errorf("unable to open %s: %w", filename, err)
 		}
 		defer out.Close()
-
-		// Write the body to file
+		// write the body to file
 		_, err = io.Copy(out, inFile)
 		if err != nil {
 			return fmt.Errorf("unable to download remote file: %w", err)
@@ -184,7 +183,7 @@ func WithDestinationDir(path string) Opt {
 // output file is stored as per dst.
 // The output file is stored relative to the destination dir given by
 // WithDestinationDir.
-func WithRenameFile(src string, dst string) Opt {
+func WithRenameFile(src, dst string) Opt {
 	return func(f *fileState) {
 		f.archiveFiles[src] = dst
 	}
@@ -196,15 +195,18 @@ func WithSkipIfFileExists(filepath string) Opt {
 	}
 }
 
-func downloadBinary(url string) (io.ReadCloser, func(), error) {
-	// Get the data
-	// nolint: bodyclose // false positive
-	resp, err := http.Get(url)
+func downloadBinary(ctx context.Context, url string) (io.ReadCloser, func(), error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, func() {}, fmt.Errorf("download binary %s: %w", url, err)
+	}
+	// nolint: bodyclose // false positive due to cleanup function
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
-		return nil, func() {}, fmt.Errorf("unable to get url: %w", err)
+		return nil, func() {}, fmt.Errorf("download binary %s: %w", url, err)
 	}
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		return nil, func() {}, fmt.Errorf("unable to download %s - %d", url, resp.StatusCode)
+		return nil, func() {}, fmt.Errorf("download binary %s: status code %d", url, resp.StatusCode)
 	}
 	return resp.Body, func() { resp.Body.Close() }, nil
 }
@@ -221,6 +223,7 @@ func (s *fileState) extractZip(reader *zip.Reader) ([]string, error) {
 		}
 
 		// Store filename/path for returning and using later on
+		// nolint: gosec // allow file traversal when extracting archive
 		fpath := filepath.Join(s.dstPath, dstName)
 
 		// Check for ZipSlip. More Info: http://bit.ly/2MsjAWE
@@ -248,6 +251,7 @@ func (s *fileState) extractZip(reader *zip.Reader) ([]string, error) {
 			return filenames, err
 		}
 
+		// nolint: gosec // allow potential decompression bomb
 		_, err = io.Copy(outFile, rc)
 
 		// Close the file without defer to close before next iteration of loop
@@ -281,6 +285,7 @@ func (s *fileState) extractTar(reader io.Reader) error {
 			dstName = name
 		}
 
+		// nolint: gosec // allow traversal into archive
 		path := filepath.Join(s.dstPath, dstName)
 
 		switch header.Typeflag {
@@ -301,6 +306,7 @@ func (s *fileState) extractTar(reader io.Reader) error {
 			if err := os.Chmod(path, 0o775); err != nil {
 				return fmt.Errorf("extractTar: Chmod() failed: %w", err)
 			}
+			// nolint: gosec // allow potential decompression bomb
 			if _, err := io.Copy(outFile, tarReader); err != nil {
 				return fmt.Errorf("extractTar: Copy() failed: %w", err)
 			}

targets/mgbuf/targets.go

@@ -14,6 +14,7 @@ import (
 
 const version = "0.55.0"
 
+// nolint: gochecknoglobals
 var executable string
 
 func BufLint(ctx context.Context) error {

targets/mgcocogitto/targets.go

@@ -17,6 +17,7 @@ import (
 
 const version = "4.0.1"
 
+// nolint: gochecknoglobals
 var executable string
 
 func CogCheck(ctx context.Context) error {

targets/mgcommitlint/targets.go

@@ -27,6 +27,7 @@ const commitlintFileContent = `module.exports = {
   ],
 };`
 
+// nolint: gochecknoglobals
 var executable string
 
 func Commitlint(ctx context.Context, branch string) error {
@@ -62,10 +63,10 @@ func prepare(ctx context.Context, commitlintrc string) error {
 	if err := os.MkdirAll(toolDir, 0o755); err != nil {
 		return err
 	}
-	if err := os.WriteFile(commitlintrc, []byte(commitlintFileContent), 0o644); err != nil {
+	if err := os.WriteFile(commitlintrc, []byte(commitlintFileContent), 0o600); err != nil {
 		return err
 	}
-	if err := os.WriteFile(packageJSON, []byte(packageJSONContent), 0o644); err != nil {
+	if err := os.WriteFile(packageJSON, []byte(packageJSONContent), 0o600); err != nil {
 		return err
 	}
 

targets/mgconvco/targets.go

@@ -17,6 +17,7 @@ import (
 
 const version = "0.3.7"
 
+// nolint: gochecknoglobals
 var executable string
 
 func ConvcoCheck(ctx context.Context, rev string) error {