Fix linting issues and improve code quality

.golangci.yml

@@ -1,22 +1,124 @@
 version: '2'
-linters:
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+
+run:
+  go: '1.26.3'
+  timeout: 5m
+
+issues:
+  max-same-issues: 0
+  max-issues-per-linter: 0
+
 formatters:
   enable:
+    - gci
     - gofmt
+    - gofumpt
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(go.wpm.so/cli)
+    gofmt:
+      simplify: true
+      rewrite-rules:
+        - pattern: 'interface{}'
+          replacement: 'any'
+    gofumpt:
+      extra-rules: true
+  exclusions:
+    generated: strict
+
+linters:
+  enable:
+    - asasalint # Detects "[]any" used as argument for variadic "func(...any)".
+    - bodyclose
+    - copyloopvar # Detects places where loop variables are copied.
+    - depguard
+    - dogsled # Detects assignments with too many blank identifiers.
+    - dupword # Detects duplicate words.
+    - durationcheck # Detect cases where two time.Duration values are being multiplied in possibly erroneous ways.
+    - errcheck
+    - errchkjson # Detects unsupported types passed to json encoding functions and reports if checks for the returned error can be omitted.
+    - exhaustive # Detects missing options in enum switch statements.
+    - exptostd # Detects functions from golang.org/x/exp/ that can be replaced by std functions.
+    - fatcontext # Detects nested contexts in loops and function literals.
+    - forbidigo
+    - gocheckcompilerdirectives # Detects invalid go compiler directive comments (//go:).
+    - gocritic # Metalinter; detects bugs, performance, and styling issues.
+    - gocyclo
+    - gosec # Detects security problems.
+    - govet
+    - iface # Detects incorrect use of interfaces. Currently only used for "identical" interfaces in the same package.
+    - importas # Enforces consistent import aliases.
+    - ineffassign
+    - makezero # Finds slice declarations with non-zero initial length.
+    - mirror # Detects wrong mirror patterns of bytes/strings usage.
+    - misspell # Detects commonly misspelled English words in comments.
+    - nakedret # Detects uses of naked returns.
+    - nilnesserr # Detects returning nil errors. It combines the features of nilness and nilerr,
+    - nosprintfhostport # Detects misuse of Sprintf to construct a host with port in a URL.
+    - nolintlint # Detects ill-formed or insufficient nolint directives.
+    - perfsprint # Detects fmt.Sprintf uses that can be replaced with a faster alternative.
+    - prealloc # Detects slice declarations that could potentially be pre-allocated.
+    - predeclared # Detects code that shadows one of Go's predeclared identifiers
+    - reassign # Detects reassigning a top-level variable in another package.
+    - revive # Metalinter; drop-in replacement for golint.
+    - spancheck # Detects mistakes with OpenTelemetry/Census spans.
+    - staticcheck
+    - thelper # Detects test helpers without t.Helper().
+    - tparallel # Detects inappropriate usage of t.Parallel().
+    - unconvert # Detects unnecessary type conversions.
+    - unparam
+    - unused
+    - usestdlibvars # Detects the possibility to use variables/constants from the Go standard library.
+    - usetesting # Reports uses of functions with replacement inside the testing package.
+    - wastedassign # Detects wasted assignment statements.
+  settings:
+    staticcheck:
+      checks:
+        - all
+    gocyclo:
+      min-complexity: 16
+    gosec:
+      excludes:
+        - G306 # G306: Expect WriteFile permissions to be 0600 or less (too restrictive; also flags "0o644" permissions)
+    govet:
+      enable:
+        - shadow
+      settings:
+        shadow:
+          strict: true
+    nakedret:
+      max-func-lines: 0
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: 'log'
+              desc: 'Use logrus for logging instead of the standard log package.'
+            - pkg: 'io/ioutil'
+              desc: "The io/ioutil package has been deprecated, use 'os' or 'io' directly."
+    revive:
+      rules:
+        - name: empty-block # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#empty-block
+        - name: empty-lines # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#empty-lines
+        - name: import-shadowing # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#import-shadowing
+        - name: line-length-limit # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#line-length-limit
+          arguments: [200]
+        - name: unused-receiver # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-receiver
+        - name: use-any # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#use-any
+        - name: use-errors-new # https://github.com/mgechev/revive/blob/HEAD/RULES_DESCRIPTIONS.md#use-errors-new
   exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+    generated: strict
+    warn-unused: true
+    rules:
+      - text: 'ST1000: at least one file in a package should have a package comment'
+        linters:
+          - staticcheck
+      - text: '^ST1003: '
+        linters:
+          - staticcheck
+      - text: '^shadow: declaration of "(err|ok)" shadows declaration'
+        linters:
+          - govet

.vscode/settings.json

@@ -1,7 +1,7 @@
 {
   // Go
   "go.lintTool": "golangci-lint-v2",
-  "go.lintFlags": ["--path-mode=abs", "--fast-only"],
+  "go.lintFlags": ["--path-mode=abs"],
   "go.formatTool": "custom",
   "go.alternateTools": {
     "customFormatter": "golangci-lint-v2"

cli/cobra.go

@@ -6,16 +6,16 @@ import (
 	"sort"
 	"strings"
 
-	"go.wpm.so/cli/cli/command"
-	"go.wpm.so/cli/cli/command/completion"
-	cliflags "go.wpm.so/cli/cli/flags"
-
 	"github.com/fvbommel/sortorder"
 	"github.com/moby/term"
 	"github.com/morikuni/aec"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
+
+	"go.wpm.so/cli/cli/command"
+	"go.wpm.so/cli/cli/command/completion"
+	cliflags "go.wpm.so/cli/cli/flags"
 )
 
 // setupCommonRootCommand contains the setup common to
@@ -151,9 +151,13 @@ func commandAliases(cmd *cobra.Command) string {
 		parentPath = cmd.Parent().CommandPath() + " "
 	}
 	aliases := cmd.CommandPath()
+	var builder strings.Builder
 	for _, alias := range cmd.Aliases {
-		aliases += ", " + parentPath + alias
+		builder.WriteString(", ")
+		builder.WriteString(parentPath)
+		builder.WriteString(alias)
 	}
+	aliases += builder.String()
 	return aliases
 }
 

cli/command/auth/cmd.go

@@ -1,10 +1,10 @@
 package auth
 
 import (
+	"github.com/spf13/cobra"
+
 	"go.wpm.so/cli/cli"
 	"go.wpm.so/cli/cli/command"
-
-	"github.com/spf13/cobra"
 )
 
 func NewAuthCommand(wpmCli command.Cli) *cobra.Command {

cli/command/auth/login.go

@@ -4,13 +4,13 @@ import (
 	"context"
 	"fmt"
 
-	"go.wpm.so/cli/cli"
-	"go.wpm.so/cli/cli/command"
-	"go.wpm.so/cli/pkg/output"
-
 	"github.com/morikuni/aec"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
+
+	"go.wpm.so/cli/cli"
+	"go.wpm.so/cli/cli/command"
+	"go.wpm.so/cli/pkg/output"
 )
 
 type loginOptions struct {

cli/command/auth/logout.go

@@ -3,11 +3,11 @@ package auth
 import (
 	"fmt"
 
-	"go.wpm.so/cli/cli"
-	"go.wpm.so/cli/cli/command"
-
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
+
+	"go.wpm.so/cli/cli"
+	"go.wpm.so/cli/cli/command"
 )
 
 func NewLogoutCommand(wpmCli command.Cli) *cobra.Command {
@@ -35,7 +35,7 @@ func runLogout(wpmCli command.Cli) error {
 		return err
 	}
 
-	fmt.Fprintf(wpmCli.Out(), "user logged out successfully\n")
+	_, _ = fmt.Fprintf(wpmCli.Out(), "user logged out successfully\n")
 
 	return nil
 }

cli/command/cli.go

@@ -5,6 +5,8 @@ import (
 	"os"
 	"runtime"
 
+	"github.com/spf13/cobra"
+
 	"go.wpm.so/cli/cli/debug"
 	cliflags "go.wpm.so/cli/cli/flags"
 	"go.wpm.so/cli/cli/version"
@@ -14,8 +16,6 @@ import (
 	"go.wpm.so/cli/pkg/pm/registry"
 	"go.wpm.so/cli/pkg/progress"
 	"go.wpm.so/cli/pkg/streams"
-
-	"github.com/spf13/cobra"
 )
 
 // Streams is an interface which exposes the standard input and output streams
@@ -54,9 +54,8 @@ type WpmCli struct {
 // It applies by default the standard streams, and the content trust from
 // environment.
 func NewWpmCli(ops ...CLIOption) (*WpmCli, error) {
-	defaultOps := []CLIOption{
-		WithStandardStreams(),
-	}
+	defaultOps := make([]CLIOption, 0, len(ops)+1)
+	defaultOps = append(defaultOps, WithStandardStreams())
 	ops = append(defaultOps, ops...)
 
 	cli := &WpmCli{}

cli/command/cli_options.go

@@ -3,9 +3,9 @@ package command
 import (
 	"io"
 
-	"go.wpm.so/cli/pkg/streams"
-
 	"github.com/moby/term"
+
+	"go.wpm.so/cli/pkg/streams"
 )
 
 // CLIOption is a functional argument to apply options to a [WpmCli]. These

cli/command/commands/commands.go

@@ -1,6 +1,8 @@
 package commands
 
 import (
+	"github.com/spf13/cobra"
+
 	"go.wpm.so/cli/cli/command"
 	"go.wpm.so/cli/cli/command/auth"
 	pmInit "go.wpm.so/cli/cli/command/init"
@@ -11,8 +13,6 @@ import (
 	"go.wpm.so/cli/cli/command/uninstall"
 	"go.wpm.so/cli/cli/command/whoami"
 	"go.wpm.so/cli/cli/command/why"
-
-	"github.com/spf13/cobra"
 )
 
 func AddCommands(cmd *cobra.Command, wpmCli command.Cli) {

cli/command/completion/functions.go

@@ -4,11 +4,11 @@ import (
 	"os"
 	"sort"
 
+	"github.com/spf13/cobra"
+
 	"go.wpm.so/cli/pkg/pm/wpmjson"
 	"go.wpm.so/cli/pkg/pm/wpmjson/types"
 	"go.wpm.so/cli/pkg/pm/wpmlock"
-
-	"github.com/spf13/cobra"
 )
 
 // PackagesFromWpmJson offers completion for package names declared in