golangci-lint

CodeRabbit runs golangci-lint to find issues in changed Go code.

golangci-lint is a fast Go linters runner. CodeRabbit runs golangci-lint version 2.13.2.

Files

golangci-lint will run on files with the following extensions:

• .go
• go.mod

Configuration

golangci-lint is enabled by default. Enable or disable it with .coderabbit.yaml or the CodeRabbit web UI:

.coderabbit.yaml

.coderabbit.yaml

reviews:
  tools:
    golangci-lint:
      enabled: true

Web UI

Go to Reviews → Tools → golangci-lint in your organization or repository settings and toggle golangci-lint on or off.

The configuration schema accepts an optional repository-relative config_file value with no default. The current sandbox runtime discovers these standard filenames in each Go module root:

• .golangci.yml
• .golangci.yaml
• .golangci.toml
• .golangci.json

What CodeRabbit runs

We run golangci-lint in a sandbox with JSON output and per-module scoping. No plugins or external binaries are loaded.

When no repository config is found, CodeRabbit generates a profile-based configuration:

• Chill enables govet, staticcheck, bodyclose, sqlclosecheck, durationcheck, nilerr, rowserrcheck, makezero, noctx, and fatcontext.
• Assertive includes the Chill linters and adds errcheck, copyloopvar, spancheck, reassign, ineffassign, unused, gosec, unconvert, wastedassign, errchkjson, errorlint, forcetypeassert, misspell, predeclared, loggercheck, zerologlint, protogetter, and contextcheck.

Security policy and restrictions

• Plugins are disallowed. If plugins are referenced in config, we skip.
• Advanced or unsafe options cause a skip: top-level plugins, non-empty linters-settings entries outside CodeRabbit’s allowlist of built-in linters, or non-empty preset bundles.
• Config version is validated; an “unsafe” evaluation returns version 0 and we fail-closed.
• Blocked configurations include:
  • Any plugins entries (in any form)
  • Non-empty linters-settings entries for linters outside the built-in allowlist
  • Non-empty linters.presets or top-level presets arrays

When we skip golangci-lint

CodeRabbit will skip running golangci-lint when:

• The config references plugins (in any form).
• The config contains advanced or unsafe options we can’t guarantee are safe.
• CodeRabbit cannot safely inspect the configuration for disallowed plugins.
• The config declares a major version newer than the installed golangci-lint major version.
• A changed Go file has no ancestor go.mod.
• golangci-lint is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

Links

• golangci-lint Configuration