version: "2"

# go-firewall is a multi-platform library: each backend lives behind a GOOS
# build tag (iptables/nft/ufw/firewalld/csf/apf on linux, pf on darwin+freebsd,
# wf on windows). golangci-lint only analyzes one GOOS per run, so the firewall
# is linted once per platform — see the `lint` target in the Makefile, which is
# the canonical entry point.
#
# The linux run is authoritative for the `unused` linter: linux compiles every
# backend plus all shared helpers, so it alone can tell dead code from a helper
# that only a subset of backends use. The cross-compiled runs disable `unused`
# (a linux-only helper unavoidably reads as dead code under another GOOS) but
# keep errcheck/govet/ineffassign/staticcheck.

run:
  # Analyze test files too, so the integration suites are held to the same bar.
  tests: true

linters:
  # The conservative standard set: errcheck, govet, ineffassign, staticcheck, unused.
  default: standard

issues:
  # Report every occurrence; the defaults cap repeats and hide real work.
  max-issues-per-linter: 0
  max-same-issues: 0

formatters:
  # Enforce canonical gofmt formatting as part of the same run.
  enable:
    - gofmt