Golang 1.24.1 / Golangci-lint 1.64.7

This patch updates VM Operator to use Golang 1.24.1 and
Golangci-lint 1.64.7 (as it supports Golang 1.24.1).

This patch also addresses several new linter errors:

* Loop variables no longer need to be captured due to Go 1.22
* There are a massive number of false positives regarding int
  overflows. See securego/gosec#1212
  for more information. For now the safecast package is used to
  avoid these linter errors. The linter directive G115 was not
  disabled because it *does* catch some valid issues, such as
  trying to convert an int32 to a uint8.

  There is also a good blog on the issue at
  https://dev.to/ccoveille/about-the-gosec-g115-drama-or-how-i-faced-back-integer-conversion-overflow-in-go-1302.

Author: akutz

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ env:
   # sometimes we need to explicitly override the Go version, ex. CVEs,
   # when it is not possible to update the go.mod version yet, ex. the
   # internal builds do not yet support that version of Go.
-  GO_VERSION: 1.23.6
+  GO_VERSION:
 
 on:
   pull_request:

.golangci.yml

@@ -170,11 +170,11 @@ linters:
   enable:
   - asciicheck
   - bodyclose
+  - copyloopvar
   - depguard
   - dogsled
   - errcheck
   - errorlint
-  - exportloopref
   - goconst
   - gocritic
   - gocyclo

Makefile

@@ -285,17 +285,19 @@ lint: ## Run all the lint targets
 
 GOLANGCI_LINT_FLAGS ?= --fast=true
 GOLANGCI_LINT_ABS_PATH := $(abspath $(GOLANGCI_LINT))
+
+GO_MOD_DIRS_TO_LINT := $(GO_MOD_DIRS)
+GO_MOD_DIRS_TO_LINT := $(filter-out ./external%,$(GO_MOD_DIRS_TO_LINT))
+GO_MOD_DIRS_TO_LINT := $(filter-out ./hack/tools%,$(GO_MOD_DIRS_TO_LINT))
+GO_LINT_DIR_TARGETS := $(addprefix lint-,$(GO_MOD_DIRS_TO_LINT))
+
+.PHONY: $(GO_LINT_DIR_TARGETS)
+$(GO_LINT_DIR_TARGETS): | $(GOLANGCI_LINT)
+	cd $(subst lint-,,$@) && $(GOLANGCI_LINT_ABS_PATH) run -v $(GOLANGCI_LINT_FLAGS)
+
 .PHONY: lint-go
-lint-go: $(GOLANGCI_LINT)
+lint-go: $(GO_LINT_DIR_TARGETS)
 lint-go: ## Lint codebase
-	@for dir in $(GO_MOD_DIRS); do \
-		if [[ "$$dir" == ./external* || "$$dir" == ./hack/tools* ]]; then \
-			echo "Skipping $$dir"; \
-			continue; \
-		fi; \
-		echo "Running golangci-lint in $$dir"; \
-		(cd $$dir && $(GOLANGCI_LINT_ABS_PATH) run -v $(GOLANGCI_LINT_FLAGS)); \
-	done
 
 .PHONY: lint-go-full
 lint-go-full: GOLANGCI_LINT_FLAGS = --fast=false

controllers/virtualmachine/volume/volume_controller.go

@@ -374,8 +374,6 @@ func (r *Reconciler) reconcileInstanceStoragePVCs(ctx *pkgctx.VolumeContext) (bo
 	createPVCs := len(selectedNode) > 0
 
 	for _, pvc := range pvcList {
-		pvc := pvc
-
 		if !pvc.DeletionTimestamp.IsZero() {
 			// Ignore PVC that is being deleted. Likely this is from a previous failed
 			// placement and CSI hasn't fully cleaned up yet (a finalizer is still present).

controllers/virtualmachine/volume/volume_controller_unit_test.go

@@ -1394,7 +1394,6 @@ func adjustPVCCreationTimestamp(ctx *pkgctx.VolumeContext, testCtx *builder.Unit
 	Expect(err).ToNot(HaveOccurred())
 
 	for _, pvc := range pvcList {
-		pvc := pvc
 		pvc.CreationTimestamp = metav1.NewTime(time.Now().Add(-2 * pkgcfg.FromContext(ctx).InstanceStorage.PVPlacementFailedTTL))
 		Expect(testCtx.Client.Update(ctx, &pvc)).To(Succeed())
 	}
@@ -1431,7 +1430,6 @@ func patchInstanceStoragePVCs(ctx *pkgctx.VolumeContext, testCtx *builder.UnitTe
 	Expect(err).ToNot(HaveOccurred())
 
 	for _, pvc := range pvcList {
-		pvc := pvc
 		if setStatusBound {
 			pvc.Status.Phase = corev1.ClaimBound
 			Expect(testCtx.Client.Status().Update(ctx, &pvc)).To(Succeed())

controllers/virtualmachinereplicaset/virtualmachinereplicaset_controller.go

@@ -28,6 +28,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/ccoveille/go-safecast"
+	"github.com/go-logr/logr"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
@@ -41,8 +43,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
-	"github.com/go-logr/logr"
-
 	vmopv1 "github.com/vmware-tanzu/vm-operator/api/v1alpha4"
 	"github.com/vmware-tanzu/vm-operator/pkg/conditions"
 	pkgcfg "github.com/vmware-tanzu/vm-operator/pkg/config"
@@ -154,7 +154,6 @@ func (r *Reconciler) getReplicaSetsForVM(
 
 	var rss []*vmopv1.VirtualMachineReplicaSet
 	for _, rs := range rsList.Items {
-		rs := rs
 		selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
 		if err != nil {
 			continue
@@ -623,9 +622,9 @@ func (r *Reconciler) updateStatus(
 
 	}
 
-	newStatus.Replicas = int32(len(filteredVMs))
-	newStatus.FullyLabeledReplicas = int32(fullyLabeledReplicasCount)
-	newStatus.ReadyReplicas = int32(readyReplicasCount)
+	newStatus.Replicas = safecast.MustConvert[int32](len(filteredVMs))
+	newStatus.FullyLabeledReplicas = safecast.MustConvert[int32](fullyLabeledReplicasCount)
+	newStatus.ReadyReplicas = safecast.MustConvert[int32](readyReplicasCount)
 
 	// Copy the newly calculated status into the VirtualMachineReplicaSet.
 	if rs.Status.Replicas != newStatus.Replicas ||

controllers/virtualmachineservice/virtualmachineservice_controller.go

@@ -10,6 +10,7 @@ import (
 	"reflect"
 	"strings"
 
+	"github.com/ccoveille/go-safecast"
 	"github.com/go-logr/logr"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -699,7 +700,11 @@ func (r *ReconcileVirtualMachineService) generateSubsetsForService(
 			}
 
 			subset.Ports = append(subset.Ports,
-				corev1.EndpointPort{Name: portName, Port: int32(portNum), Protocol: portProto})
+				corev1.EndpointPort{
+					Name:     portName,
+					Port:     safecast.MustConvert[int32](portNum),
+					Protocol: portProto,
+				})
 		}
 
 		subsets = append(subsets, subset)

go.mod

@@ -1,6 +1,6 @@
 module github.com/vmware-tanzu/vm-operator
 
-go 1.23.5
+go 1.24.1
 
 replace (
 	github.com/vmware-tanzu/vm-operator/api => ./api
@@ -15,6 +15,7 @@ replace (
 )
 
 require (
+	github.com/ccoveille/go-safecast v1.6.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/go-logr/logr v1.4.2
 	github.com/google/go-cmp v0.7.0

go.sum

@@ -2,6 +2,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/ccoveille/go-safecast v1.6.0 h1:kxc0VIsdEaYoKZbDiGBZBV62zAp0RdtFNH6E3Krev8s=
+github.com/ccoveille/go-safecast v1.6.0/go.mod h1:QqwNjxQ7DAqY0C721OIO9InMk9zCwcsO7tnRuHytad8=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=