set up golangci-lint

.golangci.yml

@@ -0,0 +1,87 @@
+version: "2"
+
+run:
+  modules-download-mode: vendor
+
+linters:
+  default: none
+  enable:
+    - bodyclose
+    - depguard
+    - forbidigo
+    - gocritic
+    - gosec
+    - govet
+    - ineffassign
+    - makezero
+    - misspell
+    - noctx
+    - nolintlint
+    - revive
+    - staticcheck
+    - testifylint
+    - unused
+    - whitespace
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: "io/ioutil"
+              desc: The io/ioutil package has been deprecated.
+    forbidigo:
+      forbid:
+        - pattern: ^fmt\.Errorf(# use errors\.Errorf instead)?$
+        - pattern: ^platforms\.DefaultString(# use platforms\.Format(platforms\.DefaultSpec()) instead\.)?$
+    importas:
+      alias:
+        - pkg: "github.com/opencontainers/image-spec/specs-go/v1"
+          alias: "ocispecs"
+        - pkg: "github.com/opencontainers/go-digest"
+          alias: "digest"
+    testifylint:
+      disable:
+        - empty
+        - bool-compare
+        - len
+        - negative-positive
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - revive
+        text: stutters
+      - linters:
+          - revive
+        text: var-naming
+      - linters:
+          - revive
+        text: empty-block
+      - linters:
+          - revive
+        text: superfluous-else
+      - linters:
+          - revive
+        text: unused-parameter
+      - linters:
+          - revive
+        text: redefines-builtin-id
+      - linters:
+          - revive
+        text: if-return
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0

cmd/gotestmetrics/parse.go

@@ -40,7 +40,7 @@ func (c *parseCmd) Run(ctx *Context) error {
 		if err != nil {
 			return errors.Wrap(err, "failed to marshal result")
 		}
-		if err := os.WriteFile(c.Output, dt, 0644); err != nil {
+		if err := os.WriteFile(c.Output, dt, 0600); err != nil {
 			return errors.Wrap(err, "failed to write result to output file")
 		}
 	}

cmd/refcandidates/main.go

@@ -1,13 +1,13 @@
 package main
 
 import (
+	"crypto/rand"
 	"encoding/json"
 	"log"
-	"math/rand"
+	"math/big"
 	"os"
 	"path/filepath"
 	"strings"
-	"time"
 
 	"github.com/alecthomas/kong"
 	"github.com/moby/buildkit-bench/util/candidates"
@@ -60,7 +60,7 @@ func writeFile(f string, c *candidates.Candidates) error {
 	if err != nil {
 		return errors.Wrap(err, "failed to marshal candidates")
 	}
-	if err := os.WriteFile(f, dt, 0644); err != nil {
+	if err := os.WriteFile(f, dt, 0600); err != nil {
 		return errors.Wrap(err, "failed to write candidates to output file")
 	}
 	log.Printf("Candidates written to %q", f)
@@ -106,12 +106,15 @@ func setGhaOutput(name string, c *candidates.Candidates) error {
 	}
 
 	if gha.IsPullRequestEvent() {
-		r := rand.New(rand.NewSource(time.Now().UnixNano()))
 		if len(includes) > 2 {
 			s := make([]include, 0, 2)
 			si := make(map[int]struct{})
 			for len(s) < 2 {
-				idx := r.Intn(len(includes))
+				n, err := rand.Int(rand.Reader, big.NewInt(int64(len(includes))))
+				if err != nil {
+					return errors.Wrap(err, "failed to sample candidate")
+				}
+				idx := int(n.Int64())
 				if _, exists := si[idx]; !exists {
 					si[idx] = struct{}{}
 					s = append(s, includes[idx])

docker-bake.hcl

@@ -77,7 +77,7 @@ group "default" {
 }
 
 group "validate" {
-  targets = ["validate-vendor"]
+  targets = ["lint", "validate-vendor"]
 }
 
 target "_common" {
@@ -191,6 +191,12 @@ target "vendor" {
   output = ["."]
 }
 
+target "lint" {
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/lint.Dockerfile"
+  output = ["type=cacheonly"]
+}
+
 variable "WEBSITE_PUBLIC_PATH" {
   default = null
 }

hack/dockerfiles/lint.Dockerfile

@@ -0,0 +1,13 @@
+# syntax=docker/dockerfile:1
+
+ARG GO_VERSION=1.25
+ARG ALPINE_VERSION=3.23
+ARG GOLANGCI_LINT_VERSION=v2.8.0
+
+FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION}
+RUN apk add --no-cache gcc musl-dev
+ARG GOLANGCI_LINT_VERSION
+RUN wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s ${GOLANGCI_LINT_VERSION}
+WORKDIR /go/src/github.com/moby/buildkit-bench
+RUN --mount=target=. --mount=target=/root/.cache,type=cache \
+  golangci-lint run

test/build_test.go

@@ -2,13 +2,15 @@ package test
 
 import (
 	"fmt"
+	"os"
 	"strings"
 	"sync"
 	"testing"
 
 	"github.com/containerd/continuity/fs/fstest"
 	"github.com/containerd/platforms"
 	"github.com/moby/buildkit-bench/util/testutil"
+	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 )
 
@@ -59,7 +61,7 @@ func BenchmarkBuild(b *testing.B) {
 		benchmarkBuildExportUncompressed,
 		benchmarkBuildExportGzip,
 		benchmarkBuildExportEstargz,
-		//benchmarkBuildExportZstd, https://github.com/moby/buildkit-bench/pull/146#discussion_r1771519112
+		// benchmarkBuildExportZstd, https://github.com/moby/buildkit-bench/pull/146#discussion_r1771519112
 	),
 		testutil.WithMirroredImages(mirroredImages),
 	)
@@ -172,27 +174,42 @@ RUN cp /etc/foo /etc/bar
 	}
 
 	var wg sync.WaitGroup
+	errCh := make(chan error, n)
 	for i := 0; i < n; i++ {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			dir := tmpdir(
-				b,
+			dir, err := os.MkdirTemp("", "bkbench-build-context")
+			if err != nil {
+				errCh <- err
+				return
+			}
+			defer os.RemoveAll(dir)
+			if err := fstest.Apply(
 				fstest.CreateFile("Dockerfile", dockerfile, 0600),
 				fstest.CreateFile("foo", []byte("foo"), 0600),
-			)
+			).Apply(dir); err != nil {
+				errCh <- err
+				return
+			}
 			out, err := buildxBuildCmd(sb, withArgs("--output=type=image", dir))
 			// TODO: use sb.WriteLogFile to write buildx logs in a defer with a
 			//  semaphore using a buffered channel to limit the number of
 			//  concurrent goroutines. This might affect timing.
-			require.NoError(b, err, out)
+			if err != nil {
+				errCh <- errors.Wrap(err, out)
+			}
 		}()
 	}
 	reportBuildkitdAlloc(b, sb, func() {
 		b.StartTimer()
 		wg.Wait()
 		b.StopTimer()
 	})
+	close(errCh)
+	for err := range errCh {
+		require.NoError(b, err)
+	}
 }
 
 func benchmarkBuildFileTransfer(b *testing.B, sb testutil.Sandbox) {
@@ -290,9 +307,7 @@ func benchmarkBuildExportGzip(b *testing.B, sb testutil.Sandbox) {
 func benchmarkBuildExportEstargz(b *testing.B, sb testutil.Sandbox) {
 	benchmarkBuildExport(b, sb, "gzip")
 }
-func benchmarkBuildExportZstd(b *testing.B, sb testutil.Sandbox) {
-	benchmarkBuildExport(b, sb, "zstd")
-}
+
 func benchmarkBuildExport(b *testing.B, sb testutil.Sandbox, compression string) {
 	dockerfile := []byte(`
 FROM python:latest

test/buildx_test.go

@@ -1,6 +1,7 @@
 package test
 
 import (
+	"context"
 	"os"
 	"os/exec"
 	"testing"
@@ -23,14 +24,14 @@ func BenchmarkBuildx(b *testing.B) {
 }
 
 func testBuildxVersion(t *testing.T, sb testutil.Sandbox) {
-	output, err := exec.Command(sb.BuildxBin(), "version").Output()
+	output, err := exec.CommandContext(context.Background(), sb.BuildxBin(), "version").Output() //nolint:gosec // test utility
 	require.NoError(t, err)
 	t.Log(string(output))
 }
 
 func benchmarkBuildxVersion(b *testing.B, sb testutil.Sandbox) {
 	b.StartTimer()
-	err := exec.Command(sb.BuildxBin(), "version").Run()
+	err := exec.CommandContext(context.Background(), sb.BuildxBin(), "version").Run() //nolint:gosec // test utility
 	b.StopTimer()
 	require.NoError(b, err)
 }

test/daemon_test.go

@@ -1,6 +1,7 @@
 package test
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -32,7 +33,7 @@ func BenchmarkDaemon(b *testing.B) {
 func testDaemonVersion(t *testing.T, sb testutil.Sandbox) {
 	buildkitdPath := path.Join(sb.BuildKitBinsDir(), sb.Name(), "buildkitd")
 
-	output, err := exec.Command(buildkitdPath, "--version").Output()
+	output, err := exec.CommandContext(context.Background(), buildkitdPath, "--version").Output()
 	require.NoError(t, err)
 
 	versionParts := strings.Fields(string(output))
@@ -46,7 +47,9 @@ func testDaemonVersion(t *testing.T, sb testutil.Sandbox) {
 func testDaemonDebugHeap(t *testing.T, sb testutil.Sandbox) {
 	client := &http.Client{}
 
-	resp, err := client.Get(fmt.Sprintf("http://%s/debug/pprof/heap?debug=1", sb.DebugAddress()))
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fmt.Sprintf("http://%s/debug/pprof/heap?debug=1", sb.DebugAddress()), nil)
+	require.NoError(t, err)
+	resp, err := client.Do(req)
 	require.NoError(t, err)
 	defer resp.Body.Close()
 
@@ -63,7 +66,7 @@ func testDaemonDebugHeap(t *testing.T, sb testutil.Sandbox) {
 func benchmarkDaemonVersion(b *testing.B, sb testutil.Sandbox) {
 	buildkitdPath := path.Join(sb.BuildKitBinsDir(), sb.Name(), "buildkitd")
 	b.StartTimer()
-	err := exec.Command(buildkitdPath, "--version").Run()
+	err := exec.CommandContext(context.Background(), buildkitdPath, "--version").Run()
 	b.StopTimer()
 	require.NoError(b, err)
 }

test/util.go

@@ -1,11 +1,11 @@
 package test
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"os"
 	"os/exec"
-	"path"
 	"testing"
 
 	"github.com/containerd/continuity/fs/fstest"
@@ -24,12 +24,6 @@ func tmpdir(tb testing.TB, appliers ...fstest.Applier) string {
 
 type cmdOpt func(*exec.Cmd)
 
-func withEnv(env ...string) cmdOpt {
-	return func(cmd *exec.Cmd) {
-		cmd.Env = append(cmd.Env, env...)
-	}
-}
-
 func withArgs(args ...string) cmdOpt {
 	return func(cmd *exec.Cmd) {
 		cmd.Args = append(cmd.Args, args...)
@@ -43,7 +37,7 @@ func withDir(dir string) cmdOpt {
 }
 
 func buildxCmd(sb testutil.Sandbox, opts ...cmdOpt) *exec.Cmd {
-	cmd := exec.Command(sb.BuildxBin())
+	cmd := exec.CommandContext(context.Background(), sb.BuildxBin()) //nolint:gosec // test utility
 	cmd.Env = append([]string{}, os.Environ()...)
 	for _, opt := range opts {
 		opt(cmd)
@@ -64,26 +58,6 @@ func buildxBuildCmd(sb testutil.Sandbox, opts ...cmdOpt) (string, error) {
 	return string(out), err
 }
 
-func buildctlCmd(sb testutil.Sandbox, opts ...cmdOpt) *exec.Cmd {
-	cmd := exec.Command(path.Join(sb.BuildKitBinsDir(), sb.Name(), "buildctl"))
-	cmd.Args = append(cmd.Args, "--debug")
-	if buildkitAddr := sb.Address(); buildkitAddr != "" {
-		cmd.Args = append(cmd.Args, "--addr", buildkitAddr)
-	}
-	cmd.Env = append([]string{}, os.Environ()...)
-	for _, opt := range opts {
-		opt(cmd)
-	}
-	return cmd
-}
-
-func buildctlBuildCmd(sb testutil.Sandbox, opts ...cmdOpt) (string, error) {
-	opts = append([]cmdOpt{withArgs("build", "--frontend=dockerfile.v0")}, opts...)
-	cmd := buildctlCmd(sb, opts...)
-	out, err := cmd.CombinedOutput()
-	return string(out), err
-}
-
 func reportBuildkitdAlloc(b *testing.B, sb testutil.Sandbox, cb func()) {
 	beforeAlloc, errb := buildkitdAlloc(sb)
 	cb()
@@ -95,7 +69,11 @@ func reportBuildkitdAlloc(b *testing.B, sb testutil.Sandbox, cb func()) {
 
 func buildkitdAlloc(sb testutil.Sandbox) (int64, error) {
 	client := &http.Client{}
-	resp, err := client.Get(fmt.Sprintf("http://%s/debug/pprof/heap?gc=1", sb.DebugAddress()))
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fmt.Sprintf("http://%s/debug/pprof/heap?gc=1", sb.DebugAddress()), nil)
+	if err != nil {
+		return 0, err
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return 0, err
 	}