Golang 1.24.1 / Golangci-lint 1.64.7

This patch updates VM Operator to use Golang 1.24.1 and
Golangci-lint 1.64.7 (as it supports Golang 1.24.1).

This patch also addresses several new linter errors:

* Loop variables no longer need to be captured due to Go 1.22
* There are a massive number of false positives regarding int
  overflows. See securego/gosec#1212
  The linter directive G115 is used surgically to disable the
  false-positives but also places where we know there is not a
  chance for an overflow.

  There is also a good blog on the issue at
  https://dev.to/ccoveille/about-the-gosec-g115-drama-or-how-i-faced-back-integer-conversion-overflow-in-go-1302.

Author: akutz

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ env:
   # sometimes we need to explicitly override the Go version, ex. CVEs,
   # when it is not possible to update the go.mod version yet, ex. the
   # internal builds do not yet support that version of Go.
-  GO_VERSION: 1.23.6
+  GO_VERSION:
 
 on:
   pull_request:

.golangci.yml

@@ -170,11 +170,11 @@ linters:
   enable:
   - asciicheck
   - bodyclose
+  - copyloopvar
   - depguard
   - dogsled
   - errcheck
   - errorlint
-  - exportloopref
   - goconst
   - gocritic
   - gocyclo

Makefile

@@ -285,17 +285,19 @@ lint: ## Run all the lint targets
 
 GOLANGCI_LINT_FLAGS ?= --fast=true
 GOLANGCI_LINT_ABS_PATH := $(abspath $(GOLANGCI_LINT))
+
+GO_MOD_DIRS_TO_LINT := $(GO_MOD_DIRS)
+GO_MOD_DIRS_TO_LINT := $(filter-out ./external%,$(GO_MOD_DIRS_TO_LINT))
+GO_MOD_DIRS_TO_LINT := $(filter-out ./hack/tools%,$(GO_MOD_DIRS_TO_LINT))
+GO_LINT_DIR_TARGETS := $(addprefix lint-,$(GO_MOD_DIRS_TO_LINT))
+
+.PHONY: $(GO_LINT_DIR_TARGETS)
+$(GO_LINT_DIR_TARGETS): | $(GOLANGCI_LINT)
+	cd $(subst lint-,,$@) && $(GOLANGCI_LINT_ABS_PATH) run -v $(GOLANGCI_LINT_FLAGS)
+
 .PHONY: lint-go
-lint-go: $(GOLANGCI_LINT)
+lint-go: $(GO_LINT_DIR_TARGETS)
 lint-go: ## Lint codebase
-	@for dir in $(GO_MOD_DIRS); do \
-		if [[ "$$dir" == ./external* || "$$dir" == ./hack/tools* ]]; then \
-			echo "Skipping $$dir"; \
-			continue; \
-		fi; \
-		echo "Running golangci-lint in $$dir"; \
-		(cd $$dir && $(GOLANGCI_LINT_ABS_PATH) run -v $(GOLANGCI_LINT_FLAGS)); \
-	done
 
 .PHONY: lint-go-full
 lint-go-full: GOLANGCI_LINT_FLAGS = --fast=false

controllers/virtualmachine/volume/volume_controller.go

@@ -374,8 +374,6 @@ func (r *Reconciler) reconcileInstanceStoragePVCs(ctx *pkgctx.VolumeContext) (bo
 	createPVCs := len(selectedNode) > 0
 
 	for _, pvc := range pvcList {
-		pvc := pvc
-
 		if !pvc.DeletionTimestamp.IsZero() {
 			// Ignore PVC that is being deleted. Likely this is from a previous failed
 			// placement and CSI hasn't fully cleaned up yet (a finalizer is still present).

controllers/virtualmachine/volume/volume_controller_unit_test.go

@@ -1394,7 +1394,6 @@ func adjustPVCCreationTimestamp(ctx *pkgctx.VolumeContext, testCtx *builder.Unit
 	Expect(err).ToNot(HaveOccurred())
 
 	for _, pvc := range pvcList {
-		pvc := pvc
 		pvc.CreationTimestamp = metav1.NewTime(time.Now().Add(-2 * pkgcfg.FromContext(ctx).InstanceStorage.PVPlacementFailedTTL))
 		Expect(testCtx.Client.Update(ctx, &pvc)).To(Succeed())
 	}
@@ -1431,7 +1430,6 @@ func patchInstanceStoragePVCs(ctx *pkgctx.VolumeContext, testCtx *builder.UnitTe
 	Expect(err).ToNot(HaveOccurred())
 
 	for _, pvc := range pvcList {
-		pvc := pvc
 		if setStatusBound {
 			pvc.Status.Phase = corev1.ClaimBound
 			Expect(testCtx.Client.Status().Update(ctx, &pvc)).To(Succeed())

controllers/virtualmachinereplicaset/virtualmachinereplicaset_controller.go

@@ -28,6 +28,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/go-logr/logr"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
@@ -41,8 +42,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	"github.com/go-logr/logr"
-
 	vmopv1 "github.com/vmware-tanzu/vm-operator/api/v1alpha4"
 	"github.com/vmware-tanzu/vm-operator/pkg/conditions"
 	pkgcfg "github.com/vmware-tanzu/vm-operator/pkg/config"
@@ -154,7 +153,6 @@ func (r *Reconciler) getReplicaSetsForVM(
 
 	var rss []*vmopv1.VirtualMachineReplicaSet
 	for _, rs := range rsList.Items {
-		rs := rs
 		selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
 		if err != nil {
 			continue
@@ -623,9 +621,9 @@ func (r *Reconciler) updateStatus(
 
 	}
 
-	newStatus.Replicas = int32(len(filteredVMs))
-	newStatus.FullyLabeledReplicas = int32(fullyLabeledReplicasCount)
-	newStatus.ReadyReplicas = int32(readyReplicasCount)
+	newStatus.Replicas = int32(len(filteredVMs))                      //nolint:gosec // disable G115
+	newStatus.FullyLabeledReplicas = int32(fullyLabeledReplicasCount) //nolint:gosec // disable G115
+	newStatus.ReadyReplicas = int32(readyReplicasCount)               //nolint:gosec // disable G115
 
 	// Copy the newly calculated status into the VirtualMachineReplicaSet.
 	if rs.Status.Replicas != newStatus.Replicas ||

controllers/virtualmachineservice/virtualmachineservice_controller.go

@@ -699,7 +699,11 @@ func (r *ReconcileVirtualMachineService) generateSubsetsForService(
 			}
 
 			subset.Ports = append(subset.Ports,
-				corev1.EndpointPort{Name: portName, Port: int32(portNum), Protocol: portProto})
+				corev1.EndpointPort{
+					Name:     portName,
+					Port:     int32(portNum), //nolint:gosec // disable G115
+					Protocol: portProto,
+				})
 		}
 
 		subsets = append(subsets, subset)

go.mod

@@ -1,6 +1,6 @@
 module github.com/vmware-tanzu/vm-operator
 
-go 1.23.5
+go 1.24.1
 
 replace (
 	github.com/vmware-tanzu/vm-operator/api => ./api

hack/test.sh

@@ -17,6 +17,10 @@ GO_TEST_FLAGS+=("-v")           # verbose
 GO_TEST_FLAGS+=("-r")           # recursive
 GO_TEST_FLAGS+=("--race")       # check for possible races
 GO_TEST_FLAGS+=("--keep-going") # do not fail on the first error
+GO_TEST_FLAGS+=("--vet=off")    # disable govet during tests until the issue
+                                # outlined at https://github.com/golang/go/issues/60529#issuecomment-2043669945
+                                # and https://github.com/kubernetes/kubernetes/issues/127191
+                                # is able to be solved at point-of-use
 
 # Only run tests that match given labels if LABEL_FILTER is non-empty.
 if [ -n "${LABEL_FILTER:-}" ]; then