---
# golangci-lint unified config for orca (v0.2 P03, REQ-040).
# Supersedes per-tool invocations. The linters here are picked for
# the minimalist pillar: only what's needed to catch real bugs and
# security issues, nothing cosmetic.

linters:
  disable-all: true
  enable:
    - gosec       # security; integrated with .coreci.yml validate
    - govet       # standard go vet
    - ineffassign # unreachable error returns
    - misspell    # common typos
    - gocritic    # opinionated style/lint checks (subset below)

linters-settings:
  gosec:
    # Severity filter: don't fail on LOW; HIGH is a blocker.
    # The P03 plan asks for hardcoded-credential (G101) to be a
    # build-breaking finding; the gosec default severity is HIGH
    # for G101, so the default config satisfies that.
    severity: high
    confidence: medium

issues:
  # Exclude generated or vendored paths.
  exclude-rules:
    - path: "_test\\.go"
      linters: [gosec]
      text: "G404" # Insecure random number source (math/rand) is fine in tests
    - path: "internal/security/testdata/"
      linters: [gosec, misspell]

run:
  # golangci-lint uses .golangci.yml by default; we keep the
  # timeout short because the codebase is small. CI overrides
  # this in .coreci.yml.
  timeout: 5m
  tests: true