Change check-lint to use golangci-lint (#3465)

golint is deprecated. The author of the code no longer supports the
codebase. golangci-lint is faster than golint, and is in use by other
opa repositories (e.g. Gatekeeper).

This commit changes tools.go to reference golangci (so it ends up in
vendor) and modifies check-lint to use golangci instead.

Breaking API Changes:

- plugins/rest/rest.go: Fix typo "AllowInsureTLS" -> "AllowInsecureTLS"
- storage/errors.go: Removed unused IndexingNotSupportedErr

Signed-off-by: Will Beason <willbeason@google.com>

.golangci.yaml

@@ -0,0 +1,27 @@
+linter-settings:
+  lll:
+    line-length: 200
+
+  misspell:
+    locale: US
+
+linters:
+  disable-all: true
+  enable:
+    - errcheck
+    - govet
+    - ineffassign
+#    - golint # deprecated and no longer supported
+    - revive # replacement for golint
+    - goconst
+    - gofmt
+    - goimports
+    - unused
+    - varcheck
+    - deadcode
+    - misspell
+    - typecheck
+    - structcheck
+    - staticcheck
+    - gosimple
+    # - gosec # too many false positives

ast/capabilities.go

@@ -34,10 +34,7 @@ func CapabilitiesForThisVersion() *Capabilities {
 		f.WasmABIVersions = append(f.WasmABIVersions, WasmABIVersion{Version: vers[0], Minor: vers[1]})
 	}
 
-	for _, bi := range Builtins {
-		f.Builtins = append(f.Builtins, bi)
-	}
-
+	f.Builtins = append(f.Builtins, Builtins...)
 	sort.Slice(f.Builtins, func(i, j int) bool {
 		return f.Builtins[i].Name < f.Builtins[j].Name
 	})

ast/check.go

@@ -180,7 +180,7 @@ func (tc *typeChecker) checkRule(env *TypeEnv, as *annotationSet, rule *Rule) {
 
 	if schemaAnnots := getRuleAnnotation(as, rule); schemaAnnots != nil {
 		for _, schemaAnnot := range schemaAnnots {
-			ref, refType, err := processAnnotation(tc.ss, schemaAnnot, env, rule)
+			ref, refType, err := processAnnotation(tc.ss, schemaAnnot, rule)
 			if err != nil {
 				tc.err([]*Error{err})
 				continue
@@ -379,24 +379,24 @@ func unify2(env *TypeEnv, a *Term, typeA types.Type, b *Term, typeB types.Type)
 
 	switch a.Value.(type) {
 	case *Array:
-		return unify2Array(env, a, typeA, b, typeB)
+		return unify2Array(env, a, b)
 	case *object:
-		return unify2Object(env, a, typeA, b, typeB)
+		return unify2Object(env, a, b)
 	case Var:
 		switch b.Value.(type) {
 		case Var:
 			return unify1(env, a, types.A, false) && unify1(env, b, env.Get(a), false)
 		case *Array:
-			return unify2Array(env, b, typeB, a, typeA)
+			return unify2Array(env, b, a)
 		case *object:
-			return unify2Object(env, b, typeB, a, typeA)
+			return unify2Object(env, b, a)
 		}
 	}
 
 	return false
 }
 
-func unify2Array(env *TypeEnv, a *Term, typeA types.Type, b *Term, typeB types.Type) bool {
+func unify2Array(env *TypeEnv, a *Term, b *Term) bool {
 	arr := a.Value.(*Array)
 	switch bv := b.Value.(type) {
 	case *Array:
@@ -414,7 +414,7 @@ func unify2Array(env *TypeEnv, a *Term, typeA types.Type, b *Term, typeB types.T
 	return false
 }
 
-func unify2Object(env *TypeEnv, a *Term, typeA types.Type, b *Term, typeB types.Type) bool {
+func unify2Object(env *TypeEnv, a *Term, b *Term) bool {
 	obj := a.Value.(Object)
 	switch bv := b.Value.(type) {
 	case *object:
@@ -682,7 +682,7 @@ func (rc *refChecker) checkRef(curr *TypeEnv, node *typeTreeNode, ref Ref, idx i
 	// potentially refers to data for which no type information exists,
 	// checking should never fail.
 	node.Children().Iter(func(_, child util.T) bool {
-		rc.checkRef(curr, child.(*typeTreeNode), ref, idx+1)
+		_ = rc.checkRef(curr, child.(*typeTreeNode), ref, idx+1) // ignore error
 		return false
 	})
 
@@ -1062,7 +1062,7 @@ func getPrefix(env *TypeEnv, ref Ref) (Ref, types.Type) {
 
 // override takes a type t and returns a type obtained from t where the path represented by ref within it has type o (overriding the original type of that path)
 func override(ref Ref, t types.Type, o types.Type, rule *Rule) (types.Type, *Error) {
-	newStaticProps := []*types.StaticProperty{}
+	var newStaticProps []*types.StaticProperty
 	obj, ok := t.(*types.Object)
 	if !ok {
 		newType, err := getObjectType(ref, o, rule, types.NewDynamicProperty(types.A, types.A))
@@ -1158,7 +1158,7 @@ func getRuleAnnotation(as *annotationSet, rule *Rule) (result []*SchemaAnnotatio
 	return result
 }
 
-func processAnnotation(ss *SchemaSet, annot *SchemaAnnotation, env *TypeEnv, rule *Rule) (Ref, types.Type, *Error) {
+func processAnnotation(ss *SchemaSet, annot *SchemaAnnotation, rule *Rule) (Ref, types.Type, *Error) {
 
 	var schema interface{}
 

ast/compile.go

@@ -214,8 +214,6 @@ type QueryCompilerStageDefinition struct {
 	Stage      QueryCompilerStage
 }
 
-const compileStageMetricPrefex = "ast_compile_stage_"
-
 // NewCompiler returns a new empty compiler.
 func NewCompiler() *Compiler {
 
@@ -821,13 +819,13 @@ func (c *Compiler) checkSafetyRuleBodies() {
 		WalkRules(m, func(r *Rule) bool {
 			safe := ReservedVars.Copy()
 			safe.Update(r.Head.Args.Vars())
-			r.Body = c.checkBodySafety(safe, m, r.Body)
+			r.Body = c.checkBodySafety(safe, r.Body)
 			return false
 		})
 	}
 }
 
-func (c *Compiler) checkBodySafety(safe VarSet, m *Module, b Body) Body {
+func (c *Compiler) checkBodySafety(safe VarSet, b Body) Body {
 	reordered, unsafe := reorderBodyForSafety(c.builtins, c.GetArity, safe, b)
 	if errs := safetyErrorSlice(unsafe); len(errs) > 0 {
 		for _, err := range errs {
@@ -1139,7 +1137,7 @@ func (c *Compiler) rewriteComprehensionTerms() {
 	f := newEqualityFactory(c.localvargen)
 	for _, name := range c.sorted {
 		mod := c.Modules[name]
-		rewriteComprehensionTerms(f, mod)
+		_, _ = rewriteComprehensionTerms(f, mod) // ignore error
 	}
 }
 
@@ -1434,7 +1432,7 @@ func (c *Compiler) rewriteWithModifiers() {
 
 			return body, nil
 		})
-		Transform(t, mod)
+		_, _ = Transform(t, mod) // ignore error
 	}
 }
 
@@ -1850,7 +1848,7 @@ type comprehensionIndexRegressionCheckVisitor struct {
 	worse      bool
 }
 
-// TOOD(tsandall): Improve this so that users can either supply this list explicitly
+// TODO(tsandall): Improve this so that users can either supply this list explicitly
 // or the information is maintained on the built-in function declaration. What we really
 // need to know is whether the built-in function allows callers to push down output
 // values or not. It's unlikely that anything outside of OPA does this today so this
@@ -1901,7 +1899,6 @@ func (vis *comprehensionIndexRegressionCheckVisitor) assertEmptyIntersection(vs
 
 type comprehensionIndexNestedCandidateVisitor struct {
 	candidates VarSet
-	nested     bool
 	found      bool
 }
 
@@ -2144,7 +2141,7 @@ func (g *Graph) Sort() (sorted []util.T, ok bool) {
 		return g.sorted, true
 	}
 
-	sort := &graphSort{
+	sorter := &graphSort{
 		sorted: make([]util.T, 0, len(g.nodes)),
 		deps:   g.Dependencies,
 		marked: map[util.T]struct{}{},
@@ -2152,12 +2149,12 @@ func (g *Graph) Sort() (sorted []util.T, ok bool) {
 	}
 
 	for node := range g.nodes {
-		if !sort.Visit(node) {
+		if !sorter.Visit(node) {
 			return nil, false
 		}
 	}
 
-	g.sorted = sort.sorted
+	g.sorted = sorter.sorted
 	return g.sorted, true
 }
 
@@ -3074,7 +3071,7 @@ func rewriteEquals(x interface{}) {
 		}
 		return x, nil
 	})
-	Transform(t, x)
+	_, _ = Transform(t, x) // ignore error
 }
 
 // rewriteDynamics will rewrite the body so that dynamic terms (i.e., refs and

ast/compile_test.go

@@ -790,10 +790,10 @@ func TestCompilerCheckSafetyBodyErrors(t *testing.T) {
 			// Build slice of expected error messages.
 			expected := []string{}
 
-			MustParseTerm(tc.expected).Value.(Set).Iter(func(x *Term) error {
+			_ = MustParseTerm(tc.expected).Value.(Set).Iter(func(x *Term) error {
 				expected = append(expected, makeErrMsg(string(x.Value.(Var))))
 				return nil
-			})
+			}) // cannot return error
 
 			sort.Strings(expected)
 
@@ -2709,11 +2709,11 @@ func TestCompilerSetGraph(t *testing.T) {
 		},
 		{
 			x:    q,
-			want: map[util.T]struct{}{p: struct{}{}, mod5.Rules[1]: struct{}{}, mod5.Rules[3]: struct{}{}, mod5.Rules[5]: struct{}{}},
+			want: map[util.T]struct{}{p: {}, mod5.Rules[1]: {}, mod5.Rules[3]: {}, mod5.Rules[5]: {}},
 		},
 		{
 			x:    r,
-			want: map[util.T]struct{}{p: struct{}{}},
+			want: map[util.T]struct{}{p: {}},
 		},
 	}
 
@@ -3302,11 +3302,11 @@ r3 = 3`,
 func TestCompileCustomBuiltins(t *testing.T) {
 
 	compiler := NewCompiler().WithBuiltins(map[string]*Builtin{
-		"baz": &Builtin{
+		"baz": {
 			Name: "baz",
 			Decl: types.NewFunction([]types.Type{types.S}, types.A),
 		},
-		"foo.bar": &Builtin{
+		"foo.bar": {
 			Name: "foo.bar",
 			Decl: types.NewFunction([]types.Type{types.S}, types.A),
 		},
@@ -3999,7 +3999,7 @@ func TestQueryCompilerWithStageAfterWithMetrics(t *testing.T) {
 
 func TestQueryCompilerWithUnsafeBuiltins(t *testing.T) {
 	c := NewCompiler().WithUnsafeBuiltins(map[string]struct{}{
-		"count": struct{}{},
+		"count": {},
 	})
 
 	_, err := c.QueryCompiler().WithUnsafeBuiltins(map[string]struct{}{}).Compile(MustParseBody("count([])"))
@@ -4258,7 +4258,7 @@ func TestCompilerWithUnsafeBuiltins(t *testing.T) {
 	// Rego includes a number of built-in functions. In some cases, you may not
 	// want all builtins to be available to a program. This test shows how to
 	// mark a built-in as unsafe.
-	compiler := NewCompiler().WithUnsafeBuiltins(map[string]struct{}{"re_match": struct{}{}})
+	compiler := NewCompiler().WithUnsafeBuiltins(map[string]struct{}{"re_match": {}})
 
 	// This query should not compile because the `re_match` built-in is no
 	// longer available.

ast/errors.go

@@ -24,9 +24,9 @@ func (e Errors) Error() string {
 		return fmt.Sprintf("1 error occurred: %v", e[0].Error())
 	}
 
-	s := []string{}
-	for _, err := range e {
-		s = append(s, err.Error())
+	s := make([]string, len(e))
+	for i, err := range e {
+		s[i] = err.Error()
 	}
 
 	return fmt.Sprintf("%d errors occurred:\n%s", len(e), strings.Join(s, "\n"))
@@ -124,7 +124,6 @@ func NewError(code string, loc *Location, f string, a ...interface{}) *Error {
 
 var (
 	errPartialRuleAssignOperator = fmt.Errorf("partial rules must use = operator (not := operator)")
-	errElseAssignOperator        = fmt.Errorf("else keyword cannot be used on rule declared with := operator")
 	errFunctionAssignOperator    = fmt.Errorf("functions must use = operator (not := operator)")
 )
 

ast/index.go

@@ -6,7 +6,6 @@ package ast
 
 import (
 	"fmt"
-	"io"
 	"sort"
 	"strings"
 
@@ -421,7 +420,7 @@ func (node *trieNode) String() string {
 		flags = append(flags, fmt.Sprintf("array:%p", node.array))
 	}
 	if len(node.scalars) > 0 {
-		buf := []string{}
+		buf := make([]string, 0, len(node.scalars))
 		for k, v := range node.scalars {
 			buf = append(buf, fmt.Sprintf("scalar(%v):%p", k, v))
 		}
@@ -575,7 +574,10 @@ func (node *trieNode) traverse(resolver ValueResolver, tr *trieTraversalResult)
 	}
 
 	if node.undefined != nil {
-		node.undefined.Traverse(resolver, tr)
+		err = node.undefined.Traverse(resolver, tr)
+		if err != nil {
+			return err
+		}
 	}
 
 	if v == nil {
@@ -583,7 +585,10 @@ func (node *trieNode) traverse(resolver ValueResolver, tr *trieTraversalResult)
 	}
 
 	if node.any != nil {
-		node.any.Traverse(resolver, tr)
+		err = node.any.Traverse(resolver, tr)
+		if err != nil {
+			return err
+		}
 	}
 
 	if err := node.traverseValue(resolver, tr, v); err != nil {
@@ -632,7 +637,10 @@ func (node *trieNode) traverseArray(resolver ValueResolver, tr *trieTraversalRes
 	}
 
 	if node.any != nil {
-		node.any.traverseArray(resolver, tr, arr.Slice(1, -1))
+		err := node.any.traverseArray(resolver, tr, arr.Slice(1, -1))
+		if err != nil {
+			return err
+		}
 	}
 
 	child, ok := node.scalars[head]
@@ -674,18 +682,6 @@ func (node *trieNode) traverseUnknown(resolver ValueResolver, tr *trieTraversalR
 	return nil
 }
 
-type triePrinter struct {
-	depth int
-	w     io.Writer
-}
-
-func (p triePrinter) Do(x interface{}) trieWalker {
-	padding := strings.Repeat(" ", p.depth)
-	fmt.Fprintf(p.w, "%v%v\n", padding, x)
-	p.depth++
-	return p
-}
-
 func eqOperandsToRefAndValue(isVirtual func(Ref) bool, a, b *Term) (Ref, Value, bool) {
 
 	ref, ok := a.Value.(Ref)

ast/internal/scanner/scanner.go

@@ -19,14 +19,13 @@ const bom = 0xFEFF
 // Scanner is used to tokenize an input stream of
 // Rego source code.
 type Scanner struct {
-	offset   int
-	row      int
-	col      int
-	bs       []byte
-	curr     rune
-	width    int
-	errors   []Error
-	filename string
+	offset int
+	row    int
+	col    int
+	bs     []byte
+	curr   rune
+	width  int
+	errors []Error
 }
 
 // Error represents a scanner error.
@@ -347,13 +346,6 @@ func (s *Scanner) next() {
 	}
 }
 
-func (s *Scanner) peek(i int) rune {
-	if s.offset+i < len(s.bs) {
-		return rune(s.bs[s.offset+i])
-	}
-	return 0
-}
-
 func (s *Scanner) literalStart() int {
 	// The current offset is at the first character past the literal delimiter (#, ", `, etc.)
 	// Need to subtract width of first character (plus one for the delimiter).

ast/parser.go

@@ -167,7 +167,7 @@ func (p *Parser) Parse() ([]Statement, []*Comment, Errors) {
 		}
 
 		p.restore(s)
-		s = p.save()
+		p.save() // no need to save return value to s
 
 		if body := p.parseQuery(true, tokens.EOF); body != nil {
 			stmts = append(stmts, body)
@@ -1541,7 +1541,7 @@ func (p *Parser) setLoc(term *Term, loc *location.Location, offset, end int) *Te
 
 func (p *Parser) validateDefaultRuleValue(rule *Rule) bool {
 	if rule.Head.Value == nil {
-		p.error(rule.Loc(), fmt.Sprintf("illegal default rule (must have a value)"))
+		p.error(rule.Loc(), "illegal default rule (must have a value)")
 		return false
 	}
 

ast/parser_bench_test.go

@@ -165,7 +165,7 @@ func generateObject(width, depth int) map[string]interface{} {
 	for i := 0; i < width; i++ {
 		key := fmt.Sprintf("entry-%d", i)
 		if depth <= 1 {
-			o[key] = fmt.Sprintf("value")
+			o[key] = "value"
 		} else {
 			o[key] = generateObject(width, depth-1)
 		}

ast/parser_ext.go

@@ -547,29 +547,6 @@ func ParseStatement(input string) (Statement, error) {
 	return stmts[0], nil
 }
 
-type commentKey struct {
-	File string
-	Row  int
-	Col  int
-}
-
-func (a commentKey) Compare(other commentKey) int {
-	if a.File < other.File {
-		return -1
-	} else if a.File > other.File {
-		return 1
-	} else if a.Row < other.Row {
-		return -1
-	} else if a.Row > other.Row {
-		return 1
-	} else if a.Col < other.Col {
-		return -1
-	} else if a.Col > other.Col {
-		return 1
-	}
-	return 0
-}
-
 // ParseStatements is deprecated. Use ParseStatementWithOpts instead.
 func ParseStatements(filename, input string) ([]Statement, []*Comment, error) {
 	return ParseStatementsWithOpts(filename, input, ParserOptions{})

ast/parser_test.go

@@ -2712,7 +2712,7 @@ public_servers[server] {
 }`,
 			expNumComments: 4,
 			expAnnotations: []*Annotations{
-				&Annotations{
+				{
 					Schemas: []*SchemaAnnotation{
 						{Path: dataServers, Schema: schemaServers},
 					},
@@ -2742,7 +2742,7 @@ public_servers[server] {
 }`,
 			expNumComments: 6,
 			expAnnotations: []*Annotations{
-				&Annotations{
+				{
 					Schemas: []*SchemaAnnotation{
 						{Path: dataServers, Schema: schemaServers},
 						{Path: dataNetworks, Schema: schemaNetworks},
@@ -2776,7 +2776,7 @@ public_servers[server] {
 }`,
 			expNumComments: 7,
 			expAnnotations: []*Annotations{
-				&Annotations{
+				{
 					Schemas: []*SchemaAnnotation{
 						{Path: dataServers, Schema: schemaServers},
 						{Path: dataNetworks, Schema: schemaNetworks},
@@ -2809,7 +2809,7 @@ public_servers[server] {
 }`,
 			expNumComments: 7,
 			expAnnotations: []*Annotations{
-				&Annotations{
+				{
 					Schemas: []*SchemaAnnotation{
 						{Path: dataServers, Schema: schemaServers},
 						{Path: dataNetworks, Schema: schemaNetworks},
@@ -2957,7 +2957,7 @@ public_servers_1[server] {
 }`,
 			expNumComments: 7,
 			expAnnotations: []*Annotations{
-				&Annotations{
+				{
 					Schemas: []*SchemaAnnotation{
 						{Path: dataServers, Schema: schemaServers},
 						{Path: dataNetworks, Schema: schemaNetworks},
@@ -2995,14 +2995,14 @@ public_servers_1[server] {
 }`,
 			expNumComments: 9,
 			expAnnotations: []*Annotations{
-				&Annotations{
+				{
 					Schemas: []*SchemaAnnotation{
 						{Path: dataServers, Schema: schemaServers},
 					},
 					Scope: annotationScopeRule,
 					node:  MustParseRule(`public_servers[server] { server = servers[i] }`),
 				},
-				&Annotations{
+				{
 					Schemas: []*SchemaAnnotation{
 
 						{Path: dataNetworks, Schema: schemaNetworks},
@@ -3105,7 +3105,7 @@ import data.foo`,
 p { input = "str" }`,
 			expNumComments: 3,
 			expAnnotations: []*Annotations{
-				&Annotations{
+				{
 					Schemas: []*SchemaAnnotation{
 						{Path: InputRootRef, Definition: &stringSchema},
 					},

ast/policy.go

@@ -20,7 +20,6 @@ import (
 // subsequent lookups. If the hash seeds are out of sync, lookups will fail.
 var hashSeed = rand.New(rand.NewSource(time.Now().UnixNano()))
 var hashSeed0 = (uint64(hashSeed.Uint32()) << 32) | uint64(hashSeed.Uint32())
-var hashSeed1 = (uint64(hashSeed.Uint32()) << 32) | uint64(hashSeed.Uint32())
 
 // DefaultRootDocument is the default root document.
 //
@@ -416,8 +415,6 @@ func (mod *Module) Equal(other *Module) bool {
 }
 
 func (mod *Module) String() string {
-	buf := []string{}
-
 	byNode := map[Node][]*Annotations{}
 	for _, a := range mod.Annotations {
 		byNode[a.node] = append(byNode[a.node], a)
@@ -433,6 +430,7 @@ func (mod *Module) String() string {
 		return buf
 	}
 
+	buf := []string{}
 	buf = appendAnnotationStrings(buf, mod.Package)
 	buf = append(buf, mod.Package.String())
 
@@ -1567,12 +1565,6 @@ func (rs RuleSet) String() string {
 	return "{" + strings.Join(buf, ", ") + "}"
 }
 
-type ruleSlice []*Rule
-
-func (s ruleSlice) Less(i, j int) bool { return Compare(s[i], s[j]) < 0 }
-func (s ruleSlice) Swap(i, j int)      { x := s[i]; s[i] = s[j]; s[j] = x }
-func (s ruleSlice) Len() int           { return len(s) }
-
 // Returns true if the equality or assignment expression referred to by expr
 // has a valid number of arguments.
 func validEqAssignArgCount(expr *Expr) bool {

ast/schema_test.go

@@ -15,7 +15,7 @@ func testParseSchema(t *testing.T, schema string, expectedType types.Type) {
 	}
 	newtype, err := loadSchema(sch)
 	if err != nil {
-		t.Fatalf("unexpected error: %s", err)
+		t.Fatalf("unexpected error: %v", err)
 	}
 	if newtype == nil {
 		t.Fatalf("parseSchema returned nil type")
@@ -149,9 +149,12 @@ func TestParseSchemaWithSchemaBadSchema(t *testing.T) {
 	}
 	jsonSchema, err := compileSchema(sch)
 	if err != nil {
-		t.Fatalf("Unable to compile schema")
+		t.Fatalf("Unable to compile schema: %v", err)
 	}
 	newtype, err := parseSchema(jsonSchema) // Did not pass the subschema
+	if err == nil {
+		t.Fatalf("Expected parseSchema() = error, got nil")
+	}
 	if newtype != nil {
 		t.Fatalf("Incorrect return from parseSchema with a bad schema")
 	}

ast/term.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+// nolint: deadcode // Public API.
 package ast
 
 import (
@@ -888,9 +889,8 @@ func (ref Ref) Insert(x *Term, pos int) Ref {
 // other will be converted to a string.
 func (ref Ref) Extend(other Ref) Ref {
 	dst := make(Ref, len(ref)+len(other))
-	for i := range ref {
-		dst[i] = ref[i]
-	}
+	copy(dst, ref)
+
 	head := other[0].Copy()
 	head.Value = String(head.Value.(Var))
 	offset := len(ref)
@@ -907,9 +907,8 @@ func (ref Ref) Concat(terms []*Term) Ref {
 		return ref
 	}
 	cpy := make(Ref, len(ref)+len(terms))
-	for i := range ref {
-		cpy[i] = ref[i]
-	}
+	copy(cpy, ref)
+
 	for i := range terms {
 		cpy[len(ref)+i] = terms[i]
 	}
@@ -1233,10 +1232,10 @@ func (arr *Array) Until(f func(*Term) bool) bool {
 
 // Foreach calls f on each element in arr.
 func (arr *Array) Foreach(f func(*Term)) {
-	arr.Iter(func(t *Term) error {
+	_ = arr.Iter(func(t *Term) error {
 		f(t)
 		return nil
-	})
+	}) // ignore error
 }
 
 // Append appends a term to arr, returning the appended array.
@@ -1443,10 +1442,10 @@ func (s *set) Until(f func(*Term) bool) bool {
 
 // Foreach calls f on each element in s.
 func (s *set) Foreach(f func(*Term)) {
-	s.Iter(func(t *Term) error {
+	_ = s.Iter(func(t *Term) error {
 		f(t)
 		return nil
-	})
+	}) // ignore error
 }
 
 // Map returns a new Set obtained by applying f to each value in s.
@@ -1917,10 +1916,10 @@ func (obj *object) Until(f func(*Term, *Term) bool) bool {
 
 // Foreach calls f for each key-value pair in the object.
 func (obj *object) Foreach(f func(*Term, *Term)) {
-	obj.Iter(func(k, v *Term) error {
+	_ = obj.Iter(func(k, v *Term) error {
 		f(k, v)
 		return nil
-	})
+	}) // ignore error
 }
 
 // Map returns a new Object constructed by mapping each element in the object

ast/transform.go

@@ -357,18 +357,6 @@ func transformBody(t Transformer, body Body) (Body, error) {
 	return r, nil
 }
 
-func transformExpr(t Transformer, expr *Expr) (*Expr, error) {
-	y, err := Transform(t, expr)
-	if err != nil {
-		return nil, err
-	}
-	h, ok := y.(*Expr)
-	if !ok {
-		return nil, fmt.Errorf("illegal transform: %T != %T", expr, y)
-	}
-	return h, nil
-}
-
 func transformTerm(t Transformer, term *Term) (*Term, error) {
 	v, err := transformValue(t, term.Value)
 	if err != nil {

ast/transform_test.go

@@ -84,6 +84,9 @@ p := 7`, ParserOptions{ProcessAnnotation: true})
 			return x, nil
 		},
 	}, module)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	resultMod, ok := result.(*Module)
 	if !ok {

ast/unify.go

@@ -116,12 +116,12 @@ func (u *unifier) unify(a *Term, b *Term) {
 			u.markAllSafe(a)
 		case *object:
 			if a.Len() == b.Len() {
-				a.Iter(func(k, v *Term) error {
+				_ = a.Iter(func(k, v *Term) error {
 					if v2 := b.Get(k); v2 != nil {
 						u.unify(v, v2)
 					}
 					return nil
-				})
+				}) // impossible to return error
 			}
 		}
 

build/check-lint.sh

@@ -11,12 +11,10 @@ source $OPA_DIR/build/utils.sh
 function opa::check_lint() {
     exec 5>&1
     exit_code=0
-    for pkg in $(opa::go_packages); do
-        __output=$(go run ./vendor/golang.org/x/lint/golint $pkg | tee >(cat - >&5))
-        if [ ! -z "$__output" ]; then
-            exit_code=1
-        fi
-    done
+    __output=$(go run ./vendor/github.com/golangci/golangci-lint/cmd/golangci-lint/main.go run | tee >(cat - >&5))
+    if [ ! -z "$__output" ]; then
+        exit_code=1
+    fi
     exit $exit_code
 }
 

bundle/bundle.go

@@ -591,7 +591,6 @@ type Writer struct {
 	usePath       bool
 	disableFormat bool
 	w             io.Writer
-	signingConfig *SigningConfig
 }
 
 // NewWriter returns a bundle writer that writes to w.

bundle/bundle_test.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+// nolint: goconst // string duplication is for test readability.
 package bundle
 
 import (
@@ -245,8 +246,12 @@ func TestReadWithSignatures(t *testing.T) {
 	otherSignedTokenHS256 := `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZvbyJ9.eyJmaWxlcyI6W3sibmFtZSI6ImEvYi9jL2RhdGEuanNvbiIsImhhc2giOiJmOWNhYzA3MTQ3MDVkMjBkMWEyMDg4MDE4NWNkZWQ2ZTBmNmQwNDA2NjJkMmViYjA5NjFkM2Q5ZjMxN2Q4YWNiIn1dLCJpYXQiOjE1OTIyNDgwMjcsImlzcyI6IkpXVFNlcnZpY2UiLCJzY29wZSI6IndyaXRlIn0.WJhnUjwaVvckSgOd4QcVvKThN6oc99NiPiwHKYnoG7c`
 	defaultSigner, _ := GetSigner(defaultSignerID)
 	defaultVerifier, _ := GetVerifier(defaultVerifierID)
-	RegisterSigner("_bar", defaultSigner)
-	RegisterVerifier("_bar", defaultVerifier)
+	if err := RegisterSigner("_bar", defaultSigner); err != nil {
+		t.Fatal(err)
+	}
+	if err := RegisterVerifier("_bar", defaultVerifier); err != nil {
+		t.Fatal(err)
+	}
 
 	tests := map[string]struct {
 		files   [][2]string
@@ -684,8 +689,8 @@ func TestReadErrorBadGzip(t *testing.T) {
 func TestReadErrorBadTar(t *testing.T) {
 	var buf bytes.Buffer
 	gw := gzip.NewWriter(&buf)
-	gw.Write([]byte("bad tar bytes"))
-	gw.Close()
+	_, _ = gw.Write([]byte("bad tar bytes"))
+	_ = gw.Close()
 	_, err := NewReader(&buf).Read()
 	if err == nil {
 		t.Fatal("expected error")
@@ -929,8 +934,12 @@ func TestGenerateSignatureWithPlugin(t *testing.T) {
 
 	defaultSigner, _ := GetSigner(defaultSignerID)
 	defaultVerifier, _ := GetVerifier(defaultVerifierID)
-	RegisterSigner("_foo", defaultSigner)
-	RegisterVerifier("_foo", defaultVerifier)
+	if err := RegisterSigner("_foo", defaultSigner); err != nil {
+		t.Fatal(err)
+	}
+	if err := RegisterVerifier("_foo", defaultVerifier); err != nil {
+		t.Fatal(err)
+	}
 	sc := NewSigningConfig("secret", "HS256", "").WithPlugin("_foo")
 
 	err := bundle.GenerateSignature(sc, "", false)
@@ -1201,8 +1210,8 @@ func TestParsedModules(t *testing.T) {
 
 func TestMergeCorruptManifest(t *testing.T) {
 	_, err := Merge([]*Bundle{
-		&Bundle{},
-		&Bundle{},
+		{},
+		{},
 	})
 	if err == nil || err.Error() != "bundle manifest not initialized" {
 		t.Fatal("unexpected error:", err)
@@ -1224,7 +1233,7 @@ func TestMerge(t *testing.T) {
 		{
 			note: "no op",
 			bundles: []*Bundle{
-				&Bundle{
+				{
 					Manifest: Manifest{
 						Revision: "abcdef",
 					},

bundle/hash.go

@@ -95,7 +95,7 @@ func walk(v interface{}, h io.Writer) {
 
 	switch x := v.(type) {
 	case map[string]interface{}:
-		h.Write([]byte("{"))
+		_, _ = h.Write([]byte("{"))
 
 		var keys []string
 		for k := range x {
@@ -105,30 +105,30 @@ func walk(v interface{}, h io.Writer) {
 
 		for i, key := range keys {
 			if i > 0 {
-				h.Write([]byte(","))
+				_, _ = h.Write([]byte(","))
 			}
 
-			h.Write(encodePrimitive(key))
-			h.Write([]byte(":"))
+			_, _ = h.Write(encodePrimitive(key))
+			_, _ = h.Write([]byte(":"))
 			walk(x[key], h)
 		}
 
-		h.Write([]byte("}"))
+		_, _ = h.Write([]byte("}"))
 	case []interface{}:
-		h.Write([]byte("["))
+		_, _ = h.Write([]byte("["))
 
 		for i, e := range x {
 			if i > 0 {
-				h.Write([]byte(","))
+				_, _ = h.Write([]byte(","))
 			}
 			walk(e, h)
 		}
 
-		h.Write([]byte("]"))
+		_, _ = h.Write([]byte("]"))
 	case []byte:
-		h.Write(x)
+		_, _ = h.Write(x)
 	default:
-		h.Write(encodePrimitive(x))
+		_, _ = h.Write(encodePrimitive(x))
 	}
 }
 
@@ -136,6 +136,6 @@ func encodePrimitive(v interface{}) []byte {
 	var buf bytes.Buffer
 	encoder := json.NewEncoder(&buf)
 	encoder.SetEscapeHTML(false)
-	encoder.Encode(v)
-	return []byte(strings.Trim(string(buf.Bytes()), "\n"))
+	_ = encoder.Encode(v)
+	return []byte(strings.Trim(buf.String(), "\n"))
 }

bundle/sign_test.go

@@ -203,7 +203,9 @@ func TestCustomSigner(t *testing.T) {
 	if err == nil {
 		t.Fatalf("Expected error when registering with default ID")
 	}
-	RegisterSigner("_test", custom)
+	if err := RegisterSigner("_test", custom); err != nil {
+		t.Fatal(err)
+	}
 	defaultSigner, err := GetSigner(defaultSignerID)
 	if err != nil {
 		t.Fatalf("Unexpected error %v", err)

bundle/store_test.go

@@ -282,6 +282,9 @@ func TestBundleLifecycle(t *testing.T) {
 	// Ensure the bundle was activated
 	txn = storage.NewTransactionOrDie(ctx, mockStore)
 	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	if len(names) != len(bundles) {
 		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
@@ -360,6 +363,9 @@ func TestBundleLifecycle(t *testing.T) {
 	// Expect the store to have been cleared out after deactivating the bundles
 	txn = storage.NewTransactionOrDie(ctx, mockStore)
 	names, err = ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	if len(names) != 0 {
 		t.Fatalf("expected 0 bundles in store, found %d", len(names))
@@ -734,7 +740,6 @@ type testWriteModuleCase struct {
 	compilerMods map[string]*ast.Module
 	storeData    map[string]interface{}
 	expectErr    bool
-	writeToStore bool
 }
 
 func TestWriteModules(t *testing.T) {
@@ -752,24 +757,21 @@ func TestWriteModules(t *testing.T) {
 					},
 				},
 			},
-			expectErr:    false,
-			writeToStore: true,
+			expectErr: false,
 		},
 		{
 			note: "extra modules only",
 			extraMods: map[string]*ast.Module{
 				"mod1": ast.MustParseModule("package a\np = true"),
 			},
-			expectErr:    false,
-			writeToStore: true,
+			expectErr: false,
 		},
 		{
 			note: "compiler modules only",
 			compilerMods: map[string]*ast.Module{
 				"mod1": ast.MustParseModule("package a\np = true"),
 			},
-			expectErr:    false,
-			writeToStore: true,
+			expectErr: false,
 		},
 		{
 			note: "module files and extra modules",
@@ -786,8 +788,7 @@ func TestWriteModules(t *testing.T) {
 			extraMods: map[string]*ast.Module{
 				"mod2": ast.MustParseModule("package b\np = false"),
 			},
-			expectErr:    false,
-			writeToStore: true,
+			expectErr: false,
 		},
 		{
 			note: "module files and compiler modules",
@@ -804,8 +805,7 @@ func TestWriteModules(t *testing.T) {
 			compilerMods: map[string]*ast.Module{
 				"mod2": ast.MustParseModule("package b\np = false"),
 			},
-			expectErr:    false,
-			writeToStore: true,
+			expectErr: false,
 		},
 		{
 			note: "extra modules and compiler modules",
@@ -815,8 +815,7 @@ func TestWriteModules(t *testing.T) {
 			compilerMods: map[string]*ast.Module{
 				"mod2": ast.MustParseModule("package b\np = false"),
 			},
-			expectErr:    false,
-			writeToStore: true,
+			expectErr: false,
 		},
 		{
 			note: "compile error: path conflict",
@@ -835,8 +834,7 @@ func TestWriteModules(t *testing.T) {
 					"p": "foo",
 				},
 			},
-			expectErr:    true,
-			writeToStore: false,
+			expectErr: true,
 		},
 	}
 

bundle/verify_test.go

@@ -298,7 +298,9 @@ func TestCustomVerifier(t *testing.T) {
 	if err == nil {
 		t.Fatalf("Expected error when registering with default ID")
 	}
-	RegisterVerifier("_test", custom)
+	if err := RegisterVerifier("_test", custom); err != nil {
+		t.Fatal(err)
+	}
 	defaultVerifier, err := GetVerifier(defaultVerifierID)
 	if err != nil {
 		t.Fatalf("Unexpected error %v", err)

cmd/bench.go

@@ -74,7 +74,9 @@ The optional "gobench" output format conforms to the Go Benchmark Data Format.
 			return validateEvalParams(&params.evalCommandParams, args)
 		},
 		Run: func(_ *cobra.Command, args []string) {
-			os.Exit(benchMain(args, params, os.Stdout, &goBenchRunner{}))
+			exit, err := benchMain(args, params, os.Stdout, &goBenchRunner{})
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(exit)
 		},
 	}
 
@@ -106,11 +108,11 @@ type benchRunner interface {
 	run(ctx context.Context, ectx *evalContext, params benchmarkCommandParams, f func(context.Context, ...rego.EvalOption) error) (testing.BenchmarkResult, error)
 }
 
-func benchMain(args []string, params benchmarkCommandParams, w io.Writer, r benchRunner) int {
+func benchMain(args []string, params benchmarkCommandParams, w io.Writer, r benchRunner) (int, error) {
 	ectx, err := setupEval(args, params.evalCommandParams)
 	if err != nil {
-		renderBenchmarkError(params, err, w)
-		return 1
+		errRender := renderBenchmarkError(params, err, w)
+		return 1, errRender
 	}
 
 	ctx := context.Background()
@@ -120,8 +122,8 @@ func benchMain(args []string, params benchmarkCommandParams, w io.Writer, r benc
 		// Take the eval context and prepare anything else we possible can before benchmarking the evaluation
 		pq, err := ectx.r.PrepareForEval(ctx)
 		if err != nil {
-			renderBenchmarkError(params, err, w)
-			return 1
+			errRender := renderBenchmarkError(params, err, w)
+			return 1, errRender
 		}
 
 		benchFunc = func(ctx context.Context, opts ...rego.EvalOption) error {
@@ -137,8 +139,8 @@ func benchMain(args []string, params benchmarkCommandParams, w io.Writer, r benc
 		// As with normal evaluation, prepare as much as possible up front.
 		pq, err := ectx.r.PrepareForPartial(ctx)
 		if err != nil {
-			renderBenchmarkError(params, err, w)
-			return 1
+			errRender := renderBenchmarkError(params, err, w)
+			return 1, errRender
 		}
 
 		benchFunc = func(ctx context.Context, opts ...rego.EvalOption) error {
@@ -156,13 +158,13 @@ func benchMain(args []string, params benchmarkCommandParams, w io.Writer, r benc
 	for i := 0; i < params.count; i++ {
 		br, err := r.run(ctx, ectx, params, benchFunc)
 		if err != nil {
-			renderBenchmarkError(params, err, w)
-			return 1
+			errRender := renderBenchmarkError(params, err, w)
+			return 1, errRender
 		}
 		renderBenchmarkResult(params, br, w)
 	}
 
-	return 0
+	return 0, nil
 }
 
 type goBenchRunner struct {
@@ -254,7 +256,7 @@ func (r *goBenchRunner) run(ctx context.Context, ectx *evalContext, params bench
 func renderBenchmarkResult(params benchmarkCommandParams, br testing.BenchmarkResult, w io.Writer) {
 	switch params.outputFormat.String() {
 	case evalJSONOutput:
-		presentation.JSON(w, br)
+		_ = presentation.JSON(w, br)
 	case benchmarkGoBenchOutput:
 		fmt.Fprintf(w, "BenchmarkOPAEval\t%s", br.String())
 		if params.benchMem {

cmd/bench_test.go

@@ -29,7 +29,10 @@ func TestRunBenchmark(t *testing.T) {
 	args := []string{"1 + 1"}
 	var buf bytes.Buffer
 
-	rc := benchMain(args, params, &buf, &goBenchRunner{})
+	rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	if rc != 0 {
 		t.Fatalf("Unexpected return code %d, expected 0", rc)
@@ -37,7 +40,7 @@ func TestRunBenchmark(t *testing.T) {
 
 	// Expect a json serialized benchmark result with histogram fields
 	var br testing.BenchmarkResult
-	err := util.UnmarshalJSON(buf.Bytes(), &br)
+	err = util.UnmarshalJSON(buf.Bytes(), &br)
 	if err != nil {
 		t.Fatalf("Unexpected error unmarshalling output: %s", err)
 	}
@@ -62,7 +65,10 @@ func TestRunBenchmarkFailFast(t *testing.T) {
 	args := []string{"a := 1; a > 2"}
 	var buf bytes.Buffer
 
-	rc := benchMain(args, params, &buf, &goBenchRunner{})
+	rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	if rc != 1 {
 		t.Fatalf("Unexpected return code %d, expected 1", rc)
@@ -70,7 +76,7 @@ func TestRunBenchmarkFailFast(t *testing.T) {
 
 	// Expect a json serialized benchmark result with histogram fields
 	var pr presentation.Output
-	err := util.UnmarshalJSON(buf.Bytes(), &pr)
+	err = util.UnmarshalJSON(buf.Bytes(), &pr)
 	if err != nil {
 		t.Fatalf("Unexpected error unmarshalling output: %s", err)
 	}
@@ -100,7 +106,10 @@ func TestBenchPartial(t *testing.T) {
 	args := []string{"input=1"}
 	var buf bytes.Buffer
 
-	rc := benchMain(args, params, &buf, &mockBenchRunner{})
+	rc, err := benchMain(args, params, &buf, &mockBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	if rc != 0 {
 		t.Fatalf("Unexpected return code %d, expected 0", rc)
@@ -112,7 +121,10 @@ func TestBenchMainErrPreparing(t *testing.T) {
 	args := []string{"???"} // query compile error
 	var buf bytes.Buffer
 
-	rc := benchMain(args, params, &buf, &mockBenchRunner{})
+	rc, err := benchMain(args, params, &buf, &mockBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	if rc != 1 {
 		t.Fatalf("Unexpected return code %d, expected 1", rc)
@@ -129,7 +141,10 @@ func TestBenchMainErrRunningBenchmark(t *testing.T) {
 		return testing.BenchmarkResult{}, errors.New("error error error")
 	}
 
-	rc := benchMain(args, params, &buf, mockRunner)
+	rc, err := benchMain(args, params, &buf, mockRunner)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	if rc != 1 {
 		t.Fatalf("Unexpected return code %d, expected 1", rc)
@@ -150,7 +165,10 @@ func TestBenchMainWithCount(t *testing.T) {
 		return testing.BenchmarkResult{}, nil
 	}
 
-	rc := benchMain(args, params, &buf, mockRunner)
+	rc, err := benchMain(args, params, &buf, mockRunner)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	if rc != 0 {
 		t.Fatalf("Unexpected return code %d, expected 0", rc)
@@ -175,7 +193,10 @@ func TestBenchMainWithNegativeCount(t *testing.T) {
 		return testing.BenchmarkResult{}, nil
 	}
 
-	rc := benchMain(args, params, &buf, mockRunner)
+	rc, err := benchMain(args, params, &buf, mockRunner)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	if rc != 0 {
 		t.Fatalf("Unexpected return code %d, expected 0", rc)
@@ -212,7 +233,10 @@ func validateBenchMainPrep(t *testing.T, args []string, params benchmarkCommandP
 		return testing.BenchmarkResult{}, nil
 	}
 
-	rc := benchMain(args, params, &buf, mockRunner)
+	rc, err := benchMain(args, params, &buf, mockRunner)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 	if rc != 0 {
 		t.Fatalf("Unexpected return code %d, expected 0", rc)
 	}
@@ -255,7 +279,10 @@ func TestBenchMainInvalidInputFile(t *testing.T) {
 
 		var buf bytes.Buffer
 
-		rc := benchMain(args, params, &buf, &mockBenchRunner{})
+		rc, err := benchMain(args, params, &buf, &mockBenchRunner{})
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
 		if rc != 1 {
 			t.Fatalf("Unexpected return code %d, expected 1", rc)
 		}
@@ -306,7 +333,10 @@ func TestBenchMainWithBundleData(t *testing.T) {
 			t.Fatalf("Unexpected error: %s", err)
 		}
 
-		params.bundlePaths.Set(bundlePath)
+		err = params.bundlePaths.Set(bundlePath)
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
 
 		args := []string{"data.a.b.x"}
 
@@ -317,7 +347,10 @@ func TestBenchMainWithBundleData(t *testing.T) {
 
 func TestRenderBenchmarkResultJSONOutput(t *testing.T) {
 	params := testBenchParams()
-	params.outputFormat.Set(evalJSONOutput)
+	err := params.outputFormat.Set(evalJSONOutput)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	br := fakeBenchResults()
 
@@ -356,7 +389,10 @@ func TestRenderBenchmarkResultJSONOutput(t *testing.T) {
 func TestRenderBenchmarkResultPrettyOutput(t *testing.T) {
 	params := testBenchParams()
 	params.benchMem = false
-	params.outputFormat.Set(evalPrettyOutput)
+	err := params.outputFormat.Set(evalPrettyOutput)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	br := fakeBenchResults()
 
@@ -390,7 +426,10 @@ func TestRenderBenchmarkResultPrettyOutput(t *testing.T) {
 func TestRenderBenchmarkResultPrettyOutputShowAllocs(t *testing.T) {
 	params := testBenchParams()
 	params.benchMem = true
-	params.outputFormat.Set(evalPrettyOutput)
+	err := params.outputFormat.Set(evalPrettyOutput)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	br := fakeBenchResults()
 
@@ -426,7 +465,10 @@ func TestRenderBenchmarkResultPrettyOutputShowAllocs(t *testing.T) {
 func TestRenderBenchmarkResultGoBenchOutputShowAllocs(t *testing.T) {
 	params := testBenchParams()
 	params.benchMem = true
-	params.outputFormat.Set(benchmarkGoBenchOutput)
+	err := params.outputFormat.Set(benchmarkGoBenchOutput)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	br := fakeBenchResults()
 
@@ -446,13 +488,19 @@ func TestRenderBenchmarkResultGoBenchOutputShowAllocs(t *testing.T) {
 
 func TestRenderBenchmarkErrorJSONOutput(t *testing.T) {
 	params := testBenchParams()
-	params.outputFormat.Set(evalJSONOutput)
+	err := params.outputFormat.Set(evalJSONOutput)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	var buf bytes.Buffer
 
-	_, err := ast.ParseBody("???")
+	_, err = ast.ParseBody("???")
 
-	renderBenchmarkError(params, err, &buf)
+	err = renderBenchmarkError(params, err, &buf)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
 
 	actual := buf.String()
 	expected := `{
@@ -481,14 +529,20 @@ func TestRenderBenchmarkErrorJSONOutput(t *testing.T) {
 
 func TestRenderBenchmarkErrorPrettyOutput(t *testing.T) {
 	params := testBenchParams()
-	params.outputFormat.Set(evalPrettyOutput)
+	err := params.outputFormat.Set(evalPrettyOutput)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	testPrettyBenchmarkOutput(t, params)
 }
 
 func TestRenderBenchmarkErrorGoBenchOutput(t *testing.T) {
 	params := testBenchParams()
-	params.outputFormat.Set(benchmarkGoBenchOutput)
+	err := params.outputFormat.Set(benchmarkGoBenchOutput)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	testPrettyBenchmarkOutput(t, params)
 }
@@ -498,7 +552,10 @@ func testPrettyBenchmarkOutput(t *testing.T, params benchmarkCommandParams) {
 
 	_, err := ast.ParseBody("???")
 
-	renderBenchmarkError(params, err, &buf)
+	err = renderBenchmarkError(params, err, &buf)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
 
 	actual := buf.String()
 	expected := `1 error occurred: 1:1: rego_parse_error: illegal token
@@ -514,7 +571,7 @@ func testBenchParams() benchmarkCommandParams {
 	params := newBenchmarkEvalParams()
 	params.benchMem = true
 	params.metrics = true
-	params.outputFormat.Set(evalJSONOutput)
+	_ = params.outputFormat.Set(evalJSONOutput)
 	params.count = 1
 	return params
 }

cmd/eval.go

@@ -52,7 +52,6 @@ type evalCommandParams struct {
 	ignore              []string
 	outputFormat        *util.EnumFlag
 	profile             bool
-	profileTopResults   bool
 	profileCriteria     repeatedStringFlag
 	profileLimit        intFlag
 	prettyLimit         intFlag
@@ -267,8 +266,6 @@ Loads a single JSON file, applying it to the input document; or all the schema f
 	RootCommand.AddCommand(evalCommand)
 }
 
-const schemaVar = "schema"
-
 func eval(args []string, params evalCommandParams, w io.Writer) (bool, error) {
 
 	ectx, err := setupEval(args, params)

cmd/eval_test.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+// nolint: goconst // string duplication is for test readability.
 package cmd
 
 import (
@@ -249,7 +250,7 @@ func testEvalWithSchemaFile(t *testing.T, input string, query string, schema str
 	return err
 }
 
-func testEvalWithInvalidSchemaFile(t *testing.T, input string, query string, schema string) error {
+func testEvalWithInvalidSchemaFile(input string, query string, schema string) error {
 	files := map[string]string{
 		"input.json":  input,
 		"schema.json": schema,
@@ -274,7 +275,7 @@ func testEvalWithInvalidSchemaFile(t *testing.T, input string, query string, sch
 	return err
 }
 
-func testReadParamWithSchemaDir(t *testing.T, input string, query string, inputSchema string) error {
+func testReadParamWithSchemaDir(input string, inputSchema string) error {
 	files := map[string]string{
 		"input.json":                          input,
 		"schemas/input.json":                  inputSchema,
@@ -288,9 +289,10 @@ func testReadParamWithSchemaDir(t *testing.T, input string, query string, inputS
 		params.inputPath = filepath.Join(path, "input.json")
 		params.schemaPath = filepath.Join(path, "schemas")
 
-		schemaSet, err := loader.Schemas(params.schemaPath)
-		if err != nil {
-			err = fmt.Errorf("Unexpected error or undefined from evaluation: %v", err)
+		// Don't assign over "err" or "err =" does nothing.
+		schemaSet, errSchema := loader.Schemas(params.schemaPath)
+		if errSchema != nil {
+			err = fmt.Errorf("Unexpected error or undefined from evaluation: %v", errSchema)
 			return
 		}
 
@@ -400,7 +402,7 @@ func TestEvalWithJSONSchema(t *testing.T) {
 		t.Fatalf("unexpected error: %s", err)
 	}
 
-	err = testReadParamWithSchemaDir(t, input, query, schema)
+	err = testReadParamWithSchemaDir(input, schema)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -427,7 +429,7 @@ func TestEvalWithInvalidSchemaFile(t *testing.T) {
 		t.Fatalf("expected error but err == nil")
 	}
 
-	err = testEvalWithInvalidSchemaFile(t, input, query, schema)
+	err = testEvalWithInvalidSchemaFile(input, query, schema)
 	if err == nil {
 		t.Fatalf("expected error but err == nil")
 	}

cmd/fmt.go

@@ -190,8 +190,14 @@ func doDiff(old, new []byte) (stdout, stderr bytes.Buffer, err error) {
 	defer os.Remove(n.Name())
 	defer n.Close()
 
-	o.Write(old)
-	n.Write(new)
+	_, err = o.Write(old)
+	if err != nil {
+		return stdout, stderr, err
+	}
+	_, err = n.Write(new)
+	if err != nil {
+		return stdout, stderr, err
+	}
 
 	cmd := exec.Command("diff", "-u", o.Name(), n.Name())
 	cmd.Stdout = &stdout

cmd/fmt_test.go

@@ -11,6 +11,15 @@ import (
 	"github.com/open-policy-agent/opa/util/test"
 )
 
+const formatted = `package test
+
+p {
+	a == 1
+	true
+	1 + 3
+}
+`
+
 func TestFmtFormatFile(t *testing.T) {
 	params := fmtCommandParams{}
 	var stdout bytes.Buffer
@@ -25,15 +34,6 @@ func TestFmtFormatFile(t *testing.T) {
 	
 	`
 
-	formatted := `package test
-
-p {
-	a == 1
-	true
-	1 + 3
-}
-`
-
 	files := map[string]string{
 		"policy.rego": unformatted,
 	}
@@ -57,17 +57,8 @@ func TestFmtFormatFileNoChanges(t *testing.T) {
 	params := fmtCommandParams{}
 	var stdout bytes.Buffer
 
-	policyContent := `package test
-
-p {
-	a == 1
-	true
-	1 + 3
-}
-`
-
 	files := map[string]string{
-		"policy.rego": policyContent,
+		"policy.rego": formatted,
 	}
 
 	test.WithTempFS(files, func(path string) {
@@ -79,8 +70,8 @@ p {
 		}
 
 		actual := stdout.String()
-		if actual != policyContent {
-			t.Fatalf("Expected:%s\n\nGot:\n%s\n\n", policyContent, actual)
+		if actual != formatted {
+			t.Fatalf("Expected:%s\n\nGot:\n%s\n\n", formatted, actual)
 		}
 	})
 }
@@ -91,17 +82,8 @@ func TestFmtFormatFileDiff(t *testing.T) {
 	}
 	var stdout bytes.Buffer
 
-	policyContent := `package test
-
-p {
-	a == 1
-	true
-	1 + 3
-}
-`
-
 	files := map[string]string{
-		"policy.rego": policyContent,
+		"policy.rego": formatted,
 	}
 
 	test.WithTempFS(files, func(path string) {
@@ -126,17 +108,8 @@ func TestFmtFormatFileList(t *testing.T) {
 	}
 	var stdout bytes.Buffer
 
-	policyContent := `package test
-
-p {
-	a == 1
-	true
-	1 + 3
-}
-`
-
 	files := map[string]string{
-		"policy.rego": policyContent,
+		"policy.rego": formatted,
 	}
 
 	test.WithTempFS(files, func(path string) {
@@ -160,17 +133,8 @@ func TestFmtFailFileNoChanges(t *testing.T) {
 		fail: true,
 	}
 
-	policyContent := `package test
-
-p {
-	a == 1
-	true
-	1 + 3
-}
-`
-
 	files := map[string]string{
-		"policy.rego": policyContent,
+		"policy.rego": formatted,
 	}
 
 	test.WithTempFS(files, func(path string) {
@@ -178,7 +142,7 @@ p {
 		info, err := os.Stat(policyFile)
 		err = formatFile(&params, ioutil.Discard, policyFile, info, err)
 		if err != nil {
-			t.Fatalf("Expected error but did not recieve one")
+			t.Fatalf("Expected error but did not receive one")
 		}
 	})
 }

cmd/parse.go

@@ -54,7 +54,7 @@ func parse(args []string, stdout io.Writer, stderr io.Writer) int {
 	switch parseParams.format.String() {
 	case parseFormatJSON:
 		if err != nil {
-			pr.JSON(stderr, pr.Output{Errors: pr.NewOutputErrors(err)})
+			_ = pr.JSON(stderr, pr.Output{Errors: pr.NewOutputErrors(err)})
 			return 1
 		}
 

cmd/sign.go

@@ -10,19 +10,16 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"strings"
-
-	initload "github.com/open-policy-agent/opa/internal/runtime/init"
-
-	"github.com/open-policy-agent/opa/bundle"
-
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 
+	"github.com/open-policy-agent/opa/bundle"
+	initload "github.com/open-policy-agent/opa/internal/runtime/init"
 	"github.com/open-policy-agent/opa/util"
 )
 

cmd/sign_test.go

@@ -1,25 +1,20 @@
 // Copyright 2018 The OPA Authors.  All rights reserved.
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
-
 package cmd
 
 import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-
-	"github.com/open-policy-agent/opa/keys"
-
-	"github.com/open-policy-agent/opa/internal/file/archive"
-
-	"github.com/open-policy-agent/opa/bundle"
-
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/open-policy-agent/opa/bundle"
+	"github.com/open-policy-agent/opa/internal/file/archive"
+	"github.com/open-policy-agent/opa/keys"
 	"github.com/open-policy-agent/opa/util/test"
 )
 

cmd/test.go

@@ -345,7 +345,7 @@ func filterTrace(params *testCommandParams, trace []*topdown.Event) []*topdown.E
 func init() {
 	testCommand.Flags().BoolVarP(&testParams.verbose, "verbose", "v", false, "set verbose reporting mode")
 	testCommand.Flags().BoolVarP(&testParams.failureLine, "show-failure-line", "l", false, "show test failure line")
-	testCommand.Flags().MarkDeprecated("show-failure-line", "use -v instead")
+	_ = testCommand.Flags().MarkDeprecated("show-failure-line", "use -v instead")
 	testCommand.Flags().DurationVar(&testParams.timeout, "timeout", 0, "set test timeout (default 5s, 30s when benchmarking)")
 	testCommand.Flags().VarP(testParams.outputFormat, "format", "f", "set output format")
 	testCommand.Flags().BoolVarP(&testParams.coverage, "coverage", "c", false, "report coverage (overrides debug tracing)")

cmd/test_test.go

@@ -48,7 +48,10 @@ func TestFilterTraceVerbose(t *testing.T) {
 
 func TestFilterTraceExplainFails(t *testing.T) {
 	p := newTestCommandParams()
-	p.explain.Set(explainModeFails)
+	err := p.explain.Set(explainModeFails)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
 	expected := `Enter data.testing.test_p = _
 | Enter data.testing.test_p
 | | Enter data.testing.p
@@ -65,7 +68,10 @@ func TestFilterTraceExplainFails(t *testing.T) {
 
 func TestFilterTraceExplainNotes(t *testing.T) {
 	p := newTestCommandParams()
-	p.explain.Set(explainModeNotes)
+	err := p.explain.Set(explainModeNotes)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
 	expected := `Enter data.testing.test_p = _
 | Enter data.testing.test_p
 | | Enter data.testing.p
@@ -80,7 +86,10 @@ func TestFilterTraceExplainNotes(t *testing.T) {
 
 func TestFilterTraceExplainFull(t *testing.T) {
 	p := newTestCommandParams()
-	p.explain.Set(explainModeFull)
+	err := p.explain.Set(explainModeFull)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
 	expected := `Enter data.testing.test_p = _
 | Eval data.testing.test_p = _
 | Index data.testing.test_p (matched 1 rule)

cmd/version_test.go

@@ -88,8 +88,8 @@ func expectOutputKeys(t *testing.T, stdout string, expectedKeys []string) {
 		t.Fatalf("expected %v but got %v", expectedKeys, gotKeys)
 	}
 
-	for i := range expectedKeys {
-		if expectedKeys[i] != gotKeys[i] {
+	for i, got := range gotKeys {
+		if expectedKeys[i] != got {
 			t.Fatalf("expected %v but got %v", expectedKeys, gotKeys)
 		}
 	}
@@ -103,7 +103,7 @@ func getTestServer(update interface{}, statusCode int) (baseURL string, teardown
 		w.WriteHeader(statusCode)
 		bs, _ := json.Marshal(update)
 		w.Header().Set("Content-Type", "application/json")
-		w.Write(bs)
+		_, _ = w.Write(bs)
 	})
 	return ts.URL, ts.Close
 }

compile/compile.go

@@ -92,7 +92,7 @@ func (c *Compiler) WithAsBundle(enabled bool) *Compiler {
 }
 
 // WithEntrypoints sets the policy entrypoints on the compiler. Entrypoints tell the
-// compiler what rules to expect and where optimizations can be targetted. The wasm
+// compiler what rules to expect and where optimizations can be targeted. The wasm
 // target requires at least one entrypoint as does optimization.
 func (c *Compiler) WithEntrypoints(e ...string) *Compiler {
 	c.entrypoints = c.entrypoints.Append(e...)
@@ -446,7 +446,10 @@ func (c *Compiler) compileWasm(ctx context.Context) error {
 	}
 
 	// dump policy IR (if "debug" wasn't requested, debug.Witer will discard it)
-	ir.Pretty(c.debug.Writer(), policy)
+	err = ir.Pretty(c.debug.Writer(), policy)
+	if err != nil {
+		return err
+	}
 
 	// Compile the policy into a wasm binary.
 	m, err := compiler.WithPolicy(policy).WithDebug(c.debug.Writer()).Compile()
@@ -533,9 +536,7 @@ func pruneBundleEntrypoints(b *bundle.Bundle, entrypointrefs []*ast.Term) error
 		pkgPath := mf.Parsed.Package.Path.String()
 		if imports, ok := requiredImports[pkgPath]; ok {
 			mf.Raw = nil
-			for _, newImport := range imports {
-				mf.Parsed.Imports = append(mf.Parsed.Imports, newImport)
-			}
+			mf.Parsed.Imports = append(mf.Parsed.Imports, imports...)
 		}
 	}
 

compile/compile_test.go

@@ -248,7 +248,7 @@ func TestCompilerInputBundle(t *testing.T) {
 
 	b := &bundle.Bundle{
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				URL:    "/foo.rego",
 				Path:   "/foo.rego",
 				Raw:    []byte("package test\np = 7"),
@@ -274,13 +274,13 @@ func TestCompilerInputInvalidBundle(t *testing.T) {
 
 	b := &bundle.Bundle{
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				URL:    "/url",
 				Path:   "/foo.rego",
 				Raw:    []byte("package test\np = 0"),
 				Parsed: ast.MustParseModule("package test\np = 0"),
 			},
-			bundle.ModuleFile{
+			{
 				URL:    "/url",
 				Path:   "/bar.rego",
 				Raw:    []byte("package test\nq = 1"),
@@ -360,12 +360,15 @@ func TestCompilerOptimizationL1(t *testing.T) {
 		// here. If this becomes a common pattern, we could refactor (e.g.,
 		// allow caller to control var prefix, split into a reusable function,
 		// etc.)
-		ast.TransformVars(optimizedExp, func(x ast.Var) (ast.Value, error) {
+		_, err = ast.TransformVars(optimizedExp, func(x ast.Var) (ast.Value, error) {
 			if x == ast.Var("X") {
 				return ast.Var("$_term_1_01"), nil
 			}
 			return x, nil
 		})
+		if err != nil {
+			t.Fatal(err)
+		}
 
 		if len(compiler.bundle.Modules) != 1 {
 			t.Fatalf("expected 1 module but got: %v", compiler.bundle.Modules)
@@ -494,8 +497,8 @@ func TestCompilerWasmTargetWithCapabilitiesMismatch(t *testing.T) {
 	test.WithTempFS(files, func(root string) {
 
 		for note, wabis := range map[string][]ast.WasmABIVersion{
-			"none":     []ast.WasmABIVersion{},
-			"mismatch": []ast.WasmABIVersion{{Version: 0}, {Version: 1, Minor: 2}},
+			"none":     {},
+			"mismatch": {{Version: 0}, {Version: 1, Minor: 2}},
 		} {
 			t.Run(note, func(t *testing.T) {
 				caps := ast.CapabilitiesForThisVersion()

docs/content/configuration.md

@@ -588,7 +588,7 @@ func (p *Plugin) Start(ctx context.Context) error {
 func (p *Plugin) Stop(ctx context.Context) {
 	done := make(chan struct{})
 	p.stop <- done
-	_ = <-done
+	<-done
 	p.manager.UpdatePluginStatus(Name, &plugins.Status{State: plugins.StateNotReady})
 	return
 }

docs/content/kubernetes-debugging.md

@@ -18,7 +18,7 @@ If you are loading policies into OPA via
 [kube-mgmt](https://github.com/open-policy-agent/kube-mgmt) you can check the
 `openpolicyagent.org/policy-status` annotation on ConfigMaps that contain your
 policies. The annotation should be set to `"ok"` if the policy was loaded
-successfully. If errors occured during loading (e.g., because the policy
+successfully. If errors occurred during loading (e.g., because the policy
 contained a syntax error) the cause will be reported here.
 
 If the annotation is
@@ -167,4 +167,4 @@ patches = [
 Also, for more examples of how to construct mutating policies and integrating
 them with validating policies, see [these
 examples](https://github.com/open-policy-agent/library/tree/master/kubernetes/mutating-admission)
-in https://github.com/open-policy-agent/library.
+in https://github.com/open-policy-agent/library.

docs/website/scripts/live-blocks/src/preprocess/acquireOPAVersion.js

@@ -110,7 +110,7 @@ async function getReleaseAssetURL(version) {
       }
     }
   } catch (e) {
-    throw new ChainedError(`error occured while getting the OPA release asset URL for ${version} on ${PLATFORM} from ${releaseURL}`, e)
+    throw new ChainedError(`error occurred while getting the OPA release asset URL for ${version} on ${PLATFORM} from ${releaseURL}`, e)
   }
   throw new Error(`unable to get the OPA release asset URL for ${version} on ${PLATFORM} from ${releaseURL}`)
 }

docs/website/scripts/live-blocks/src/preprocess/index.js

@@ -50,7 +50,7 @@ async function start() {
   }
 }
 
-// Processes a file at a path, may reject with one or more errors (the latter as an array) that occured while trying to do so.
+// Processes a file at a path, may reject with one or more errors (the latter as an array) that occurred while trying to do so.
 async function processFile(path) {
   const version = getVersion(path)
 

docs/website/scripts/live-blocks/src/preprocess/localEval.js

@@ -36,7 +36,7 @@ export default async function localEval(groups, groupName, opaVersion) {
       if (pretty === 'undefined') { // Special undefined case, use the same message as the playground.
         throw new OPAErrors('undefined decision', undefined)
 
-      } else { // Some other error occured, reevaluate to get the JSON-formatted version of the errors so that they can be compared against what the block expects.
+      } else { // Some other error occurred, reevaluate to get the JSON-formatted version of the errors so that they can be compared against what the block expects.
         try {
           await execFile(opa, args('json'))
           throw new Error('subsequent eval of failing evaluation did not fail')
@@ -55,7 +55,7 @@ export default async function localEval(groups, groupName, opaVersion) {
             }
             throw opaErrors
           } else { // Reevaluation didn't produce output
-            throw new ChainedError('an error occured while trying to get details about an evaluation failure', e2)
+            throw new ChainedError('an error occurred while trying to get details about an evaluation failure', e2)
           }
         }
       }
@@ -111,6 +111,6 @@ async function prepEval(groups, groupName) {
 
     return [(format) => [...base, `--format=${format}`, ...rest], moduleFilenameMap]
   } catch (e) {
-    throw new ChainedError('a problem occured while preparing to evaluate', e)
+    throw new ChainedError('a problem occurred while preparing to evaluate', e)
   }
 }

docs/website/scripts/live-blocks/src/web/index.js

@@ -257,7 +257,7 @@ async function runHandlers(handlers) {
   try {
     await batchProcess(0, handlers)
   } catch (errs) {
-    report('one or more errors occured in change handlers', handlers, errs)
+    report('one or more errors occurred in change handlers', handlers, errs)
   }
 }
 

download/download.go

@@ -102,7 +102,8 @@ func (d *Downloader) Start(ctx context.Context) {
 	go d.doStart(ctx)
 }
 
-func (d *Downloader) doStart(ctx context.Context) {
+func (d *Downloader) doStart(context.Context) {
+	// We'll revisit context passing/usage later.
 	ctx, cancel := context.WithCancel(context.Background())
 
 	d.wg.Add(1)
@@ -112,14 +113,13 @@ func (d *Downloader) doStart(ctx context.Context) {
 	cancel()
 	d.wg.Wait()
 	close(done)
-	return
 }
 
 // Stop tells the Downloader to stop downloading bundles.
 func (d *Downloader) Stop(context.Context) {
 	done := make(chan struct{})
 	d.stop <- done
-	_ = <-done
+	<-done
 }
 
 func (d *Downloader) loop(ctx context.Context) {

format/format.go

@@ -141,12 +141,11 @@ func defaultLocation(x ast.Node) *ast.Location {
 type writer struct {
 	buf bytes.Buffer
 
-	indent        string
-	level         int
-	inline        bool
-	beforeEnd     *ast.Comment
-	delay         bool
-	wildcardNames map[string]string
+	indent    string
+	level     int
+	inline    bool
+	beforeEnd *ast.Comment
+	delay     bool
 }
 
 func (w *writer) writeModule(module *ast.Module) {
@@ -259,15 +258,15 @@ func (w *writer) writeRule(rule *ast.Rule, isElse bool, comments []*ast.Comment)
 
 	comments = w.writeBody(rule.Body, comments)
 
-	var close *ast.Location
+	var closeLoc *ast.Location
 
 	if len(rule.Head.Args) > 0 {
-		close = closingLoc('(', ')', '{', '}', rule.Location)
+		closeLoc = closingLoc('(', ')', '{', '}', rule.Location)
 	} else {
-		close = closingLoc('[', ']', '{', '}', rule.Location)
+		closeLoc = closingLoc('[', ']', '{', '}', rule.Location)
 	}
 
-	comments = w.insertComments(comments, close)
+	comments = w.insertComments(comments, closeLoc)
 
 	w.down()
 	w.startLine()
@@ -322,7 +321,7 @@ func (w *writer) writeElse(rule *ast.Rule, comments []*ast.Comment) []*ast.Comme
 		w.startLine()
 	}
 
-	rule.Else.Head.Name = ast.Var("else")
+	rule.Else.Head.Name = "else"
 	rule.Else.Head.Args = nil
 	comments = w.insertComments(comments, rule.Else.Head.Location)
 
@@ -474,7 +473,7 @@ func (w *writer) writeFunctionCall(expr *ast.Expr, comments []*ast.Comment) []*a
 	if numCallArgs == numDeclArgs {
 		// Print infix where result is unassigned (e.g., x != y)
 		comments = w.writeTerm(terms[1], comments)
-		w.write(" " + string(bi.Infix) + " ")
+		w.write(" " + bi.Infix + " ")
 		return w.writeTerm(terms[2], comments)
 	} else if numCallArgs == numDeclArgs+1 {
 		// Print infix where result is assigned (e.g., z = x + y)
@@ -490,7 +489,7 @@ func (w *writer) writeFunctionCall(expr *ast.Expr, comments []*ast.Comment) []*a
 }
 
 func (w *writer) writeFunctionCallPlain(terms []*ast.Term, comments []*ast.Comment) []*ast.Comment {
-	w.write(string(terms[0].String()) + "(")
+	w.write(terms[0].String() + "(")
 	if len(terms) > 1 {
 		for _, v := range terms[1 : len(terms)-1] {
 			comments = w.writeTerm(v, comments)
@@ -546,7 +545,7 @@ func (w *writer) writeTermParens(parens bool, term *ast.Term, comments []*ast.Co
 	case ast.Var:
 		w.write(w.formatVar(x))
 	case ast.Call:
-		comments = w.writeCall(parens, x, term.Location, comments)
+		comments = w.writeCall(parens, x, comments)
 	case fmt.Stringer:
 		w.write(x.String())
 	}
@@ -596,11 +595,11 @@ func (w *writer) formatVar(v ast.Var) string {
 	return v.String()
 }
 
-func (w *writer) writeCall(parens bool, x ast.Call, loc *ast.Location, comments []*ast.Comment) []*ast.Comment {
+func (w *writer) writeCall(parens bool, x ast.Call, comments []*ast.Comment) []*ast.Comment {
 
 	bi, ok := ast.BuiltinMap[x[0].String()]
 	if !ok || bi.Infix == "" {
-		return w.writeFunctionCallPlain([]*ast.Term(x), comments)
+		return w.writeFunctionCallPlain(x, comments)
 	}
 
 	// TODO(tsandall): improve to consider precedence?
@@ -929,15 +928,8 @@ func locCmp(a, b interface{}) int {
 func getLoc(x interface{}) *ast.Location {
 	switch x := x.(type) {
 	case ast.Statement:
+		// Implicitly matches *ast.Head, *ast.Expr, *ast.With, *ast.Term.
 		return x.Loc()
-	case *ast.Head:
-		return x.Location
-	case *ast.Expr:
-		return x.Location
-	case *ast.With:
-		return x.Location
-	case *ast.Term:
-		return x.Location
 	case *ast.Location:
 		return x
 	case [2]*ast.Term:
@@ -1087,13 +1079,6 @@ func (w *writer) startMultilineSeq() {
 	w.startLine()
 }
 
-func (w *writer) endMultilineSeq() {
-	w.write(",")
-	w.endLine()
-	w.down()
-	w.startLine()
-}
-
 // up increases the indentation level
 func (w *writer) up() {
 	w.level++

go.mod

@@ -5,15 +5,14 @@ go 1.15
 require (
 	github.com/OneOfOne/xxhash v1.2.8
 	github.com/bytecodealliance/wasmtime-go v0.26.1
-	github.com/cpuguy83/go-md2man v1.0.10 // indirect
 	github.com/fortytw2/leaktest v1.3.0
 	github.com/fsnotify/fsnotify v1.4.9
 	github.com/ghodss/yaml v1.0.0
 	github.com/gobwas/glob v0.2.3
 	github.com/golang/protobuf v1.4.3 // indirect
-	github.com/gorilla/mux v1.7.3
-	github.com/mattn/go-runewidth v0.0.9 // indirect
-	github.com/olekukonko/tablewriter v0.0.1
+	github.com/golangci/golangci-lint v1.40.1
+	github.com/gorilla/mux v1.8.0
+	github.com/olekukonko/tablewriter v0.0.5
 	github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.7.1
@@ -21,17 +20,15 @@ require (
 	github.com/prometheus/procfs v0.2.0 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
 	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v0.0.3
-	github.com/spf13/pflag v1.0.1
-	github.com/stretchr/testify v1.4.0
+	github.com/spf13/cobra v1.1.3
+	github.com/spf13/pflag v1.0.5
+	github.com/stretchr/testify v1.7.0
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415
 	github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b
 	go.uber.org/automaxprocs v1.4.0
-	golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5
-	golang.org/x/net v0.0.0-20201021035429-f5854403a974
-	golang.org/x/sys v0.0.0-20210503173754-0981d6026fa6 // indirect
+	golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4
 	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba
-	golang.org/x/tools v0.1.0
-	gopkg.in/yaml.v2 v2.3.0
+	golang.org/x/tools v0.1.2-0.20210512205948-8287d5da45e4
+	gopkg.in/yaml.v2 v2.4.0
 )

internal/compiler/wasm/wasm.go

@@ -3,6 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // Package wasm contains an IR->WASM compiler backend.
+// nolint: deadcode,varcheck // Package in development (2021).
 package wasm
 
 import (
@@ -802,12 +803,6 @@ func (c *Compiler) compileFunc(fn *ir.Func) error {
 		},
 	}
 
-	var params []types.ValueType
-
-	for i := 0; i < len(fn.Params); i++ {
-		params = append(params, types.I32)
-	}
-
 	return c.storeFunc(fn.Name, c.code)
 }
 
@@ -1149,7 +1144,10 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 			instrs = append(instrs, instruction.Call{Index: c.function(opaSetAdd)})
 		default:
 			var buf bytes.Buffer
-			ir.Pretty(&buf, stmt)
+			err := ir.Pretty(&buf, stmt)
+			if err != nil {
+				return nil, err
+			}
 			return instrs, fmt.Errorf("illegal statement: %v", buf.String())
 		}
 	}

internal/compiler/wasm/wasm_test.go

@@ -43,7 +43,7 @@ func TestCompilerBadDataSegment(t *testing.T) {
 
 	_, err = getLowestFreeDataSegmentOffset(&module.Module{Data: module.DataSection{
 		Segments: []module.DataSegment{
-			module.DataSegment{
+			{
 				Offset: module.Expr{
 					Instrs: []instruction.Instruction{},
 				},
@@ -56,7 +56,7 @@ func TestCompilerBadDataSegment(t *testing.T) {
 
 	_, err = getLowestFreeDataSegmentOffset(&module.Module{Data: module.DataSection{
 		Segments: []module.DataSegment{
-			module.DataSegment{
+			{
 				Offset: module.Expr{
 					Instrs: []instruction.Instruction{
 						instruction.I64Const{Value: 100},
@@ -71,7 +71,7 @@ func TestCompilerBadDataSegment(t *testing.T) {
 
 	result, err = getLowestFreeDataSegmentOffset(&module.Module{Data: module.DataSection{
 		Segments: []module.DataSegment{
-			module.DataSegment{
+			{
 				Init: []byte("foo"),
 				Offset: module.Expr{
 					Instrs: []instruction.Instruction{
@@ -79,7 +79,7 @@ func TestCompilerBadDataSegment(t *testing.T) {
 					},
 				},
 			},
-			module.DataSegment{
+			{
 				Init: []byte("bar"),
 				Offset: module.Expr{
 					Instrs: []instruction.Instruction{

internal/config/config_test.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+// nolint: goconst // string duplication is for test readability.
 package config
 
 import (
@@ -30,7 +31,7 @@ func TestSubEnvVarsVarsSubOne(t *testing.T) {
 
 	actual := subEnvVars(configYaml)
 
-	if string(actual) != expected {
+	if actual != expected {
 		t.Errorf("Expected: '%s'\nActual: '%s'", expected, actual)
 	}
 }
@@ -224,7 +225,7 @@ func TestMergeValuesOverrideSingleList(t *testing.T) {
 	dest := map[string]interface{}{
 		"a": map[string]interface{}{
 			"b": []map[string]interface{}{
-				map[string]interface{}{
+				{
 					"k1": "v1",
 					"k2": "v2",
 				},
@@ -234,7 +235,7 @@ func TestMergeValuesOverrideSingleList(t *testing.T) {
 	src := map[string]interface{}{
 		"a": map[string]interface{}{
 			"b": []map[string]interface{}{
-				map[string]interface{}{
+				{
 					"k3": "v3",
 				},
 			},
@@ -247,7 +248,7 @@ func TestMergeValuesOverrideSingleList(t *testing.T) {
 	expected := map[string]interface{}{
 		"a": map[string]interface{}{
 			"b": []map[string]interface{}{
-				map[string]interface{}{
+				{
 					"k3": "v3",
 				},
 			},

internal/gojsonschema/errors.go

@@ -1,3 +1,4 @@
+// nolint: goconst // String duplication will be handled later by using errors.Is.
 package gojsonschema
 
 import (

internal/gojsonschema/schema.go

@@ -581,21 +581,21 @@ func (d *Schema) parseSchema(documentNode interface{}, currentSchema *SubSchema)
 		}
 	}
 
-	if required, err := getSlice(m, KeyRequired); err != nil {
+	required, err := getSlice(m, KeyRequired)
+	if err != nil {
 		return err
-	} else if required != nil {
-		for _, requiredValue := range required {
-			if s, isString := requiredValue.(string); !isString {
-				return invalidType(TypeString, KeyRequired)
-			} else if isStringInSlice(currentSchema.required, s) {
-				return errors.New(formatErrorDescription(
-					Locale.KeyItemsMustBeUnique(),
-					ErrorDetails{"key": KeyRequired},
-				))
-			} else {
-				currentSchema.required = append(currentSchema.required, s)
-			}
+	}
+	for _, requiredValue := range required {
+		s, isString := requiredValue.(string)
+		if !isString {
+			return invalidType(TypeString, KeyRequired)
+		} else if isStringInSlice(currentSchema.required, s) {
+			return errors.New(formatErrorDescription(
+				Locale.KeyItemsMustBeUnique(),
+				ErrorDetails{"key": KeyRequired},
+			))
 		}
+		currentSchema.required = append(currentSchema.required, s)
 	}
 
 	// validation : array
@@ -663,61 +663,61 @@ func (d *Schema) parseSchema(documentNode interface{}, currentSchema *SubSchema)
 		currentSchema._const = is
 	}
 
-	if enum, err := getSlice(m, KeyEnum); err != nil {
+	enum, err := getSlice(m, KeyEnum)
+	if err != nil {
 		return err
-	} else if enum != nil {
-		for _, v := range enum {
-			is, err := marshalWithoutNumber(v)
-			if err != nil {
-				return err
-			}
-			if isStringInSlice(currentSchema.enum, *is) {
-				return errors.New(formatErrorDescription(
-					Locale.KeyItemsMustBeUnique(),
-					ErrorDetails{"key": KeyEnum},
-				))
-			}
-			currentSchema.enum = append(currentSchema.enum, *is)
+	}
+	for _, v := range enum {
+		is, err := marshalWithoutNumber(v)
+		if err != nil {
+			return err
 		}
+		if isStringInSlice(currentSchema.enum, *is) {
+			return errors.New(formatErrorDescription(
+				Locale.KeyItemsMustBeUnique(),
+				ErrorDetails{"key": KeyEnum},
+			))
+		}
+		currentSchema.enum = append(currentSchema.enum, *is)
 	}
 
 	// validation : SubSchema
-	if oneOf, err := getSlice(m, KeyOneOf); err != nil {
+	oneOf, err := getSlice(m, KeyOneOf)
+	if err != nil {
 		return err
-	} else if oneOf != nil {
-		for _, v := range oneOf {
-			newSchema := &SubSchema{Property: KeyOneOf, Parent: currentSchema, Ref: currentSchema.Ref}
-			currentSchema.oneOf = append(currentSchema.oneOf, newSchema)
-			err := d.parseSchema(v, newSchema)
-			if err != nil {
-				return err
-			}
+	}
+	for _, v := range oneOf {
+		newSchema := &SubSchema{Property: KeyOneOf, Parent: currentSchema, Ref: currentSchema.Ref}
+		currentSchema.oneOf = append(currentSchema.oneOf, newSchema)
+		err := d.parseSchema(v, newSchema)
+		if err != nil {
+			return err
 		}
 	}
 
-	if anyOf, err := getSlice(m, KeyAnyOf); err != nil {
+	anyOf, err := getSlice(m, KeyAnyOf)
+	if err != nil {
 		return err
-	} else if anyOf != nil {
-		for _, v := range anyOf {
-			newSchema := &SubSchema{Property: KeyAnyOf, Parent: currentSchema, Ref: currentSchema.Ref}
-			currentSchema.anyOf = append(currentSchema.anyOf, newSchema)
-			err := d.parseSchema(v, newSchema)
-			if err != nil {
-				return err
-			}
+	}
+	for _, v := range anyOf {
+		newSchema := &SubSchema{Property: KeyAnyOf, Parent: currentSchema, Ref: currentSchema.Ref}
+		currentSchema.anyOf = append(currentSchema.anyOf, newSchema)
+		err := d.parseSchema(v, newSchema)
+		if err != nil {
+			return err
 		}
 	}
 
-	if allOf, err := getSlice(m, KeyAllOf); err != nil {
+	allOf, err := getSlice(m, KeyAllOf)
+	if err != nil {
 		return err
-	} else if allOf != nil {
-		for _, v := range allOf {
-			newSchema := &SubSchema{Property: KeyAllOf, Parent: currentSchema, Ref: currentSchema.Ref}
-			currentSchema.allOf = append(currentSchema.allOf, newSchema)
-			err := d.parseSchema(v, newSchema)
-			if err != nil {
-				return err
-			}
+	}
+	for _, v := range allOf {
+		newSchema := &SubSchema{Property: KeyAllOf, Parent: currentSchema, Ref: currentSchema.Ref}
+		currentSchema.allOf = append(currentSchema.allOf, newSchema)
+		err := d.parseSchema(v, newSchema)
+		if err != nil {
+			return err
 		}
 	}
 

internal/gojsonschema/schemaPool.go

@@ -82,7 +82,10 @@ func (p *schemaPool) parseReferencesRecursive(document interface{}, ref gojsonre
 	switch m := document.(type) {
 	case []interface{}:
 		for _, v := range m {
-			p.parseReferencesRecursive(v, ref, draft)
+			err := p.parseReferencesRecursive(v, ref, draft)
+			if err != nil {
+				return err
+			}
 		}
 	case map[string]interface{}:
 		localRef := &ref
@@ -128,11 +131,17 @@ func (p *schemaPool) parseReferencesRecursive(document interface{}, ref gojsonre
 			if k == KeyProperties || k == KeyDependencies || k == KeyPatternProperties {
 				if child, ok := v.(map[string]interface{}); ok {
 					for _, v := range child {
-						p.parseReferencesRecursive(v, *localRef, draft)
+						err := p.parseReferencesRecursive(v, *localRef, draft)
+						if err != nil {
+							return err
+						}
 					}
 				}
 			} else {
-				p.parseReferencesRecursive(v, *localRef, draft)
+				err := p.parseReferencesRecursive(v, *localRef, draft)
+				if err != nil {
+					return err
+				}
 			}
 		}
 	}
@@ -203,7 +212,10 @@ func (p *schemaPool) GetDocument(reference gojsonreference.JsonReference) (*sche
 	}
 
 	// add the whole document to the pool for potential re-use
-	p.parseReferences(document, refToURL, true)
+	err = p.parseReferences(document, refToURL, true)
+	if err != nil {
+		return nil, err
+	}
 
 	_, draft, _ = parseSchemaURL(document)
 

internal/gojsonschema/schemaReferencePool.go

@@ -49,7 +49,7 @@ func (p *schemaReferencePool) Get(ref string) (r *SubSchema, o bool) {
 
 	if sch, ok := p.documents[ref]; ok {
 		if internalLogEnabled {
-			internalLog(fmt.Sprintf(" From pool"))
+			internalLog(" From pool")
 		}
 		return sch, true
 	}

internal/gojsonschema/schema_test.go

@@ -23,6 +23,7 @@
 //
 // created          16-06-2013
 
+// nolint: deadcode // Package in development (2021).
 package gojsonschema
 
 import (
@@ -37,8 +38,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-const displayErrorMessages = false
-
 const circularReference = `{
 	"type": "object",
 	"properties": {

internal/gojsonschema/utils.go

@@ -23,6 +23,7 @@
 //
 // created          26-02-2013
 
+// nolint: deadcode,unused,varcheck // Package in development (2021).
 package gojsonschema
 
 import (

internal/ir/pretty.go

@@ -11,13 +11,13 @@ import (
 )
 
 // Pretty writes a human-readable representation of an IR object to w.
-func Pretty(w io.Writer, x interface{}) {
+func Pretty(w io.Writer, x interface{}) error {
 
 	pp := &prettyPrinter{
 		depth: -1,
 		w:     w,
 	}
-	Walk(pp, x)
+	return Walk(pp, x)
 }
 
 type prettyPrinter struct {

internal/jwx/buffer/buffer_test.go

@@ -8,7 +8,7 @@ import (
 
 func TestBuffer_FromUint(t *testing.T) {
 	b := FromUint(1)
-	if bytes.Compare([]byte{1}, b.Bytes()) != 0 {
+	if !bytes.Equal([]byte{1}, b.Bytes()) {
 		t.Fatal("mismatched buffer values")
 	}
 }
@@ -16,13 +16,13 @@ func TestBuffer_FromUint(t *testing.T) {
 func TestBuffer_Convert(t *testing.T) {
 	v1 := []byte{'a', 'b', 'c'}
 	b := Buffer(v1)
-	if bytes.Compare(v1, b.Bytes()) != 0 {
+	if !bytes.Equal(v1, b.Bytes()) {
 		t.Fatal("mismatched buffer values")
 	}
 
 	v2 := "abc"
 	b = Buffer(v2)
-	if bytes.Compare([]byte(v2), b.Bytes()) != 0 {
+	if !bytes.Equal([]byte(v2), b.Bytes()) {
 		t.Fatal("mismatched buffer values")
 	}
 }
@@ -33,7 +33,7 @@ func TestBuffer_Base64Encode(t *testing.T) {
 	if err != nil {
 		t.Fatal("failed to base64 encode")
 	}
-	if bytes.Compare([]byte{'Y', 'W', 'J', 'j'}, v) != 0 {
+	if !bytes.Equal([]byte{'Y', 'W', 'J', 'j'}, v) {
 		t.Fatal("mismatched buffer values")
 	}
 }
@@ -55,7 +55,7 @@ func TestJSON(t *testing.T) {
 		t.Fatal("failed to marshal buffer")
 	}
 
-	if bytes.Compare(b1, b2) != 0 {
+	if !bytes.Equal(b1, b2) {
 		t.Fatal("mismatched buffer values")
 	}
 }
@@ -75,7 +75,7 @@ func TestFunky(t *testing.T) {
 func TestBuffer_NData(t *testing.T) {
 	payload := []byte("Alice")
 	nd := Buffer(payload).NData()
-	if bytes.Compare([]byte{0, 0, 0, 5, 65, 108, 105, 99, 101}, nd) != 0 {
+	if !bytes.Equal([]byte{0, 0, 0, 5, 65, 108, 105, 99, 101}, nd) {
 		t.Fatal("mismatched byte buffer values")
 	}
 
@@ -83,7 +83,7 @@ func TestBuffer_NData(t *testing.T) {
 	if err != nil {
 		t.Fatal("failed to extract data")
 	}
-	if bytes.Compare(payload, b1.Bytes()) != 0 {
+	if !bytes.Equal(payload, b1.Bytes()) {
 		t.Fatal("mismatched byte values ")
 	}
 }

internal/jwx/jwk/ecdsa_test.go

@@ -6,11 +6,12 @@ import (
 	"crypto/rand"
 	"encoding/json"
 	"fmt"
+	"reflect"
+	"testing"
+
 	"github.com/open-policy-agent/opa/internal/jwx/buffer"
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 	"github.com/open-policy-agent/opa/internal/jwx/jwk"
-	"reflect"
-	"testing"
 )
 
 func TestECDSA(t *testing.T) {
@@ -38,7 +39,7 @@ func TestECDSA(t *testing.T) {
 			t.Fatalf("Failed to unmarshal JWK Set: %s", err.Error())
 		}
 		if len(rawKeySetJSON.Keys) != 1 {
-			t.Fatalf("Failed to parse JWK Set: %s", err.Error())
+			t.Fatalf("Failed to parse JWK Set: %v", err)
 		}
 		rawKeyJSON := rawKeySetJSON.Keys[0]
 		curveName := rawKeyJSON.Crv
@@ -50,7 +51,7 @@ func TestECDSA(t *testing.T) {
 		if err == nil {
 			t.Fatal("Key generation should fail")
 		}
-		rawKeyJSON.Crv = jwa.EllipticCurveAlgorithm("P-256")
+		rawKeyJSON.Crv = jwa.P256
 		rawKeyJSON.D = buffer.Buffer("1234")
 		_, err = rawKeyJSON.GenerateKey()
 		if err == nil {
@@ -234,12 +235,12 @@ func TestECDSA(t *testing.T) {
   "y": "lf0u0pMj4lGAzZix5u4Cm5CMQIgMNpkwy163wtKYVKI",
   "d": "0g5vAEKzugrXaRbgKG0Tj2qJ5lMP4Bezds1_sTybkfk"
 }`
-		rawKeyJson := &jwk.RawKeyJSON{}
-		err := json.Unmarshal([]byte(jwkSrc), rawKeyJson)
+		rawKeyJSON := &jwk.RawKeyJSON{}
+		err := json.Unmarshal([]byte(jwkSrc), rawKeyJSON)
 		if err != nil {
 			t.Fatalf("Failed to unmarshal JWK Set: %s", err.Error())
 		}
-		_, err = rawKeyJson.GenerateKey()
+		_, err = rawKeyJSON.GenerateKey()
 		if err == nil {
 			t.Fatalf("Key Generation should fail")
 		}

internal/jwx/jwk/headers_test.go

@@ -1,10 +1,11 @@
 package jwk_test
 
 import (
-	"github.com/open-policy-agent/opa/internal/jwx/jwa"
-	"github.com/open-policy-agent/opa/internal/jwx/jwk"
 	"reflect"
 	"testing"
+
+	"github.com/open-policy-agent/opa/internal/jwx/jwa"
+	"github.com/open-policy-agent/opa/internal/jwx/jwk"
 )
 
 func TestHeader(t *testing.T) {
@@ -158,11 +159,11 @@ func TestHeader(t *testing.T) {
 			}
 
 			var s string
-			switch value.(type) {
+			switch v := value.(type) {
 			case jwa.KeyType:
-				s = value.(jwa.KeyType).String()
+				s = v.String()
 			case string:
-				s = value.(string)
+				s = v
 			}
 
 			if got != jwa.KeyType(s) {

internal/jwx/jwk/rsa_test.go

@@ -41,7 +41,7 @@ func TestRSA(t *testing.T) {
 			t.Fatalf("JSON marshal failed: %s", err.Error())
 		}
 
-		if bytes.Compare(jsonBuf1, jsonBuf2) != 0 {
+		if !bytes.Equal(jsonBuf1, jsonBuf2) {
 			t.Fatal("JSON marshal buffers do not match")
 		}
 	}
@@ -61,12 +61,15 @@ func TestRSA(t *testing.T) {
 			t.Fatalf("Failed to unmarshal JWK: %s", err.Error())
 		}
 		jwkKey, err = rawKeyJSON.GenerateKey()
+		if err != nil {
+			t.Fatalf("Failed to generate key: %v", err)
+		}
 		if _, ok := jwkKey.(*jwk.RSAPublicKey); !ok {
 			t.Fatalf("Key type should be of type: %s", fmt.Sprintf("%T", jwkKey))
 		}
 		rsaKey, err := jwkKey.Materialize()
 		if err != nil {
-			t.Fatal("Failed to materialize symmetric key")
+			t.Fatalf("Failed to materialize symmetric key: %v", err)
 		}
 		if jwk.GetKeyTypeFromKey(rsaKey) != jwa.RSA {
 			t.Fatal("Wrong Key Type")
@@ -145,6 +148,9 @@ func TestRSA(t *testing.T) {
 				t.Fatalf("Failed to unmarshal JWK: %s", err.Error())
 			}
 			jwkKey, err = rawKeyJSON.GenerateKey()
+			if err != nil {
+				t.Fatalf("Failed to generate key: %v", err)
+			}
 			if _, ok := jwkKey.(*jwk.RSAPrivateKey); !ok {
 				t.Fatalf("Key type should be of type: %s", fmt.Sprintf("%T", jwkKey))
 			}
@@ -190,7 +196,7 @@ func TestRSA(t *testing.T) {
 			rawKeyJSON := rawKeySetJSON.Keys[0]
 			jwkKey, err = rawKeyJSON.GenerateKey()
 			if err != nil {
-				t.Fatalf("Failed to generate key: %s", err.Error())
+				t.Fatalf("Failed to generate key: %v", err)
 			}
 			if _, ok := jwkKey.(*jwk.RSAPrivateKey); !ok {
 				t.Fatalf("Key type should be of type: %s", fmt.Sprintf("%T", jwkKey))

internal/jwx/jwk/symmetric_test.go

@@ -64,7 +64,7 @@ func TestSymmetric(t *testing.T) {
 		if jwk.GetKeyTypeFromKey(realizedKey0) != jwa.OctetSeq {
 			t.Fatal("Wrong Key Type")
 		}
-		if bytes.Compare(realizedKey0.([]byte), buf1) != 0 {
+		if !bytes.Equal(realizedKey0.([]byte), buf1) {
 			t.Fatalf("Mismatched key values %s:%s", realizedKey0.([]byte), buf1)
 		}
 
@@ -80,7 +80,7 @@ func TestSymmetric(t *testing.T) {
 		if err != nil {
 			t.Fatalf("Failed to materialize key: %s", err.Error())
 		}
-		if bytes.Compare(realizedKey1.([]byte), buf2) != 0 {
+		if !bytes.Equal(realizedKey1.([]byte), buf2) {
 			t.Fatalf("Mismatched key values %s:%s", realizedKey1.([]byte), buf1)
 		}
 	})

internal/jwx/jws/jws_test.go

@@ -8,14 +8,15 @@ import (
 	"crypto/sha512"
 	"encoding/base64"
 	"encoding/json"
+	"math/big"
+	"strings"
+	"testing"
+
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 	"github.com/open-policy-agent/opa/internal/jwx/jwk"
 	"github.com/open-policy-agent/opa/internal/jwx/jws"
 	"github.com/open-policy-agent/opa/internal/jwx/jws/sign"
 	"github.com/open-policy-agent/opa/internal/jwx/jws/verify"
-	"math/big"
-	"strings"
-	"testing"
 )
 
 const examplePayload = `{"iss":"joe",` + "\r\n" + ` "exp":1300819380,` + "\r\n" + ` "http://example.com/is_root":true}`
@@ -42,9 +43,10 @@ func TestParseErrors(t *testing.T) {
 			t.Fatalf("Parsing compact serialization with less than 3 parts should be an error")
 		}
 	})
+	const badValue = "%badvalue%"
 	t.Run("Compact bad header", func(t *testing.T) {
 		parts := strings.Split(exampleCompactSerialization, ".")
-		parts[0] = "%badvalue%"
+		parts[0] = "badValue"
 		incoming := strings.Join(parts, ".")
 
 		_, err := jws.ParseString(incoming)
@@ -54,7 +56,7 @@ func TestParseErrors(t *testing.T) {
 	})
 	t.Run("Compact bad Payload", func(t *testing.T) {
 		parts := strings.Split(exampleCompactSerialization, ".")
-		parts[1] = "%badvalue%"
+		parts[1] = badValue
 		incoming := strings.Join(parts, ".")
 
 		_, err := jws.ParseString(incoming)
@@ -64,7 +66,7 @@ func TestParseErrors(t *testing.T) {
 	})
 	t.Run("Compact bad Signature", func(t *testing.T) {
 		parts := strings.Split(exampleCompactSerialization, ".")
-		parts[2] = "%badvalue%"
+		parts[2] = badValue
 		incoming := strings.Join(parts, ".")
 
 		_, err := jws.ParseString(incoming)
@@ -101,7 +103,7 @@ func TestRoundTrip(t *testing.T) {
 			if err != nil {
 				t.Fatalf("Message verification failed: %s", err.Error())
 			}
-			if bytes.Compare(payload, verified) != 0 {
+			if !bytes.Equal(payload, verified) {
 				t.Fatalf("Mismatched payload (%s):(%s)", payload, verified)
 			}
 		})
@@ -138,7 +140,7 @@ func TestVerifyWithJWKSet(t *testing.T) {
 		t.Fatalf("Failed to verify with JWK: %s", err.Error())
 	}
 
-	if bytes.Compare(payload, verified) != 0 {
+	if !bytes.Equal(payload, verified) {
 		t.Fatalf("Mismatched payload (%s):(%s)", payload, verified)
 	}
 }
@@ -161,7 +163,7 @@ func TestRoundtrip_RSACompact(t *testing.T) {
 			t.Fatalf("Failed to verify signature: %s", err.Error())
 		}
 
-		if bytes.Compare(payload, verified) != 0 {
+		if !bytes.Equal(payload, verified) {
 			t.Fatalf("Mismatched payloads (%s):(%s)", payload, verified)
 		}
 	}
@@ -281,9 +283,6 @@ func TestEncode(t *testing.T) {
 		}
 		hdrBuf := base64.RawURLEncoding.EncodeToString([]byte(hdr))
 		payload := base64.RawURLEncoding.EncodeToString([]byte(examplePayload))
-		if err != nil {
-			t.Fatal("Failed to base64 encode Payload")
-		}
 
 		signingInput := strings.Join(
 			[]string{
@@ -563,6 +562,9 @@ func TestDecode_ES384Compact_NoSigTrim(t *testing.T) {
 		t.Fatalf("Failed to decode signature: %s", err.Error())
 	}
 	publicKey, err := jwkKeySet.Keys[0].Materialize()
+	if err != nil {
+		t.Fatalf("Failed to materialize keys: %v", err)
+	}
 	signingInput := strings.Join(
 		[]string{
 			parts[0],

internal/oracle/oracle.go

@@ -83,7 +83,7 @@ func (o *Oracle) FindDefinition(q DefinitionQuery) (*DefinitionQueryResult, erro
 		}
 	}
 
-	// If the match is a variable, walk inward to find the first occurence of the variable
+	// If the match is a variable, walk inward to find the first occurrence of the variable
 	// in function arguments or the body.
 	top := stack[len(stack)-1]
 	if term, ok := top.(*ast.Term); ok {

internal/planner/planner.go

@@ -25,12 +25,6 @@ type QuerySet struct {
 }
 
 type planiter func() error
-type binaryiter func(ir.LocalOrConst, ir.LocalOrConst) error
-
-type wasmBuiltin struct {
-	*ast.Builtin
-	WasmFunction string
-}
 
 // Planner implements a query planner for Rego queries.
 type Planner struct {
@@ -61,7 +55,7 @@ func (p *Planner) debugf(format string, args ...interface{}) {
 	} else {
 		msg = fmt.Sprintf(format, args...)
 	}
-	p.debug.Output(2, msg)
+	_ = p.debug.Output(2, msg) // ignore error
 }
 
 // New returns a new Planner object.
@@ -1133,16 +1127,6 @@ func (p *Planner) planUnifyObjectsRec(a, b ast.Object, keys []*ast.Term, index i
 	})
 }
 
-func (p *Planner) planBinaryExpr(e *ast.Expr, iter binaryiter) error {
-	return p.planTerm(e.Operand(0), func() error {
-		a := p.ltarget
-		return p.planTerm(e.Operand(1), func() error {
-			b := p.ltarget
-			return iter(a, b)
-		})
-	})
-}
-
 func (p *Planner) planTerm(t *ast.Term, iter planiter) error {
 
 	switch v := t.Value.(type) {
@@ -1211,34 +1195,6 @@ func (p *Planner) planNumber(num ast.Number, iter planiter) error {
 	return iter()
 }
 
-func (p *Planner) planNumberFloat(f float64, iter planiter) error {
-
-	target := p.newLocal()
-
-	p.appendStmt(&ir.MakeNumberFloatStmt{
-		Value:  f,
-		Target: target,
-	})
-
-	p.ltarget = target
-
-	return iter()
-}
-
-func (p *Planner) planNumberInt(i int64, iter planiter) error {
-
-	target := p.newLocal()
-
-	p.appendStmt(&ir.MakeNumberIntStmt{
-		Value:  i,
-		Target: target,
-	})
-
-	p.ltarget = target
-
-	return iter()
-}
-
 func (p *Planner) planString(str ast.String, iter planiter) error {
 
 	p.ltarget = ir.StringIndex(p.getStringConst(string(str)))
@@ -1913,25 +1869,6 @@ func (p *Planner) planScanValues(val *ast.Term, iter scaniter) error {
 	return nil
 }
 
-// planSaveLocals returns a slice of locals holding temporary variables that
-// have been assigned from the supplied vars.
-func (p *Planner) planSaveLocals(vars ...ir.Local) []ir.Local {
-
-	lsaved := make([]ir.Local, len(vars))
-
-	for i := range vars {
-
-		lsaved[i] = p.newLocal()
-
-		p.appendStmt(&ir.AssignVarStmt{
-			Source: vars[i],
-			Target: lsaved[i],
-		})
-	}
-
-	return lsaved
-}
-
 type termsliceiter func([]ir.LocalOrConst) error
 
 func (p *Planner) planTermSlice(terms []*ast.Term, iter termsliceiter) error {

internal/planner/planner_test.go

@@ -358,7 +358,10 @@ q = 2`,
 				t.Fatal(err)
 			}
 			if testing.Verbose() {
-				ir.Pretty(os.Stderr, policy)
+				err = ir.Pretty(os.Stderr, policy)
+				if err != nil {
+					t.Fatal(err)
+				}
 			}
 		})
 	}
@@ -643,7 +646,10 @@ a {
 				t.Fatal(err)
 			}
 			if testing.Verbose() {
-				ir.Pretty(os.Stderr, policy)
+				err = ir.Pretty(os.Stderr, policy)
+				if err != nil {
+					t.Fatal(err)
+				}
 			}
 			start := interface{}(policy)
 			if tc.where != nil {
@@ -685,7 +691,10 @@ func TestMultipleNamedQueries(t *testing.T) {
 	}
 
 	if testing.Verbose() {
-		ir.Pretty(os.Stderr, policy)
+		err = ir.Pretty(os.Stderr, policy)
+		if err != nil {
+			t.Fatal(err)
+		}
 	}
 
 	// Consistency check to make sure two expected plans are emitted.
@@ -931,10 +940,3 @@ func TestOptimizeLookup(t *testing.T) {
 		}
 	})
 }
-
-func expectNoError(t *testing.T, err error) {
-	t.Helper()
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-}

internal/presentation/presentation_test.go

@@ -359,7 +359,7 @@ func TestSource(t *testing.T) {
 
 	buf := new(bytes.Buffer)
 
-	Source(buf, Output{
+	err := Source(buf, Output{
 		Partial: &rego.PartialQueries{
 			Queries: []ast.Body{
 				ast.MustParseBody("a = 1; b = 2"),
@@ -372,6 +372,9 @@ func TestSource(t *testing.T) {
 			},
 		},
 	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
 
 	exp := `# Query 1
 a = 1
@@ -456,7 +459,10 @@ func TestRaw(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
 			buf := new(bytes.Buffer)
-			Raw(buf, tc.output)
+			err := Raw(buf, tc.output)
+			if err != nil {
+				t.Fatalf("unexpected error: %s", err)
+			}
 			if buf.String() != tc.want {
 				t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", tc.want, buf.String())
 			}

internal/report/report_test.go

@@ -175,7 +175,7 @@ func getTestServer(update interface{}, statusCode int) (baseURL string, teardown
 		w.WriteHeader(statusCode)
 		bs, _ := json.Marshal(update)
 		w.Header().Set("Content-Type", "application/json")
-		w.Write(bs)
+		_, _ = w.Write(bs)
 	})
 	return ts.URL, ts.Close
 }

internal/semver/semver.go

@@ -51,7 +51,7 @@ func splitOff(input *string, delim string) (val string) {
 	return val
 }
 
-// NewVersion constucts new SemVers from strings
+// NewVersion constructs new SemVers from strings
 func NewVersion(version string) (*Version, error) {
 	v := Version{}
 
@@ -80,7 +80,7 @@ func (v *Version) Set(version string) error {
 		return fmt.Errorf("failed to validate metadata: %v", err)
 	}
 
-	parsed := make([]int64, 3, 3)
+	parsed := make([]int64, 3)
 
 	for i, v := range dotParts[:3] {
 		val, err := strconv.ParseInt(v, 10, 64)

internal/semver/semver_test.go

@@ -87,11 +87,6 @@ func TestCompare(t *testing.T) {
 	}
 }
 
-type fixtureJSON struct {
-	GreaterVersion *Version
-	LesserVersion  *Version
-}
-
 func TestBadInput(t *testing.T) {
 	bad := []string{
 		"1.2",

internal/storage/mock/mock.go

@@ -245,10 +245,8 @@ func (s *Store) Abort(ctx context.Context, txn storage.Transaction) {
 	mockTxn := txn.(*Transaction)
 	s.inmem.Abort(ctx, mockTxn.txn)
 	mockTxn.Aborted++
-	return
 }
 
 func getRealTxn(txn storage.Transaction) storage.Transaction {
 	return txn.(*Transaction).txn
-
 }

internal/strvals/parser.go

@@ -50,20 +50,6 @@ func Parse(s string) (map[string]interface{}, error) {
 	return vals, err
 }
 
-// ParseFile parses a set line, but its final value is loaded from the file at the path specified by the original value.
-//
-// A set line is of the form name1=path1,name2=path2
-//
-// When the files at path1 and path2 contained "val1" and "val2" respectively, the set line is consumed as
-// name1=val1,name2=val2
-func ParseFile(s string, runesToVal runesToVal) (map[string]interface{}, error) {
-	vals := map[string]interface{}{}
-	scanner := bytes.NewBufferString(s)
-	t := newFileParser(scanner, vals, runesToVal)
-	err := t.parse()
-	return vals, err
-}
-
 // ParseString parses a set line and forces a string value.
 //
 // A set line is of the form name1=value1,name2=value2
@@ -318,7 +304,10 @@ func (t *parser) valList() ([]interface{}, error) {
 	}
 
 	if r != '{' {
-		t.sc.UnreadRune()
+		e = t.sc.UnreadRune()
+		if e != nil {
+			return []interface{}{}, e
+		}
 		return []interface{}{}, ErrNotList
 	}
 
@@ -334,7 +323,10 @@ func (t *parser) valList() ([]interface{}, error) {
 		case last == '}':
 			// If this is followed by ',', consume it.
 			if r, _, e := t.sc.ReadRune(); e == nil && r != ',' {
-				t.sc.UnreadRune()
+				e = t.sc.UnreadRune()
+				if e != nil {
+					return []interface{}{}, e
+				}
 			}
 			v, e := t.runesToVal(rs)
 			list = append(list, v)
@@ -350,7 +342,7 @@ func (t *parser) valList() ([]interface{}, error) {
 }
 
 func runesUntil(in io.RuneReader, stop map[rune]bool) ([]rune, rune, error) {
-	v := []rune{}
+	var v []rune
 	for {
 		switch r, _, e := in.ReadRune(); {
 		case e != nil:

internal/uuid/uuid_test.go

@@ -9,7 +9,7 @@ import (
 )
 
 func TestUUID4(t *testing.T) {
-	uuid, err := New(bytes.NewReader(make([]byte, 16, 16)))
+	uuid, err := New(bytes.NewReader(make([]byte, 16)))
 	if err != nil {
 		t.Fatal(err)
 	}

internal/version/version.go

@@ -24,16 +24,12 @@ func Write(ctx context.Context, store storage.Store, txn storage.Transaction) er
 		return err
 	}
 
-	if err := store.Write(ctx, txn, storage.AddOp, versionPath, map[string]interface{}{
+	return store.Write(ctx, txn, storage.AddOp, versionPath, map[string]interface{}{
 		"version":         version.Version,
 		"build_commit":    version.Vcs,
 		"build_timestamp": version.Timestamp,
 		"build_hostname":  version.Hostname,
-	}); err != nil {
-		return err
-	}
-
-	return nil
+	})
 }
 
 // UserAgent defines the current OPA instances User-Agent default header value.

internal/wasm/encoding/reader.go

@@ -530,11 +530,7 @@ func readGlobal(r io.Reader, global *module.Global) error {
 		return fmt.Errorf("illegal mutability flag")
 	}
 
-	if err := readConstantExpr(r, &global.Init); err != nil {
-		return err
-	}
-
-	return nil
+	return readConstantExpr(r, &global.Init)
 }
 
 func readImport(r io.Reader, imp *module.Import) error {
@@ -651,11 +647,7 @@ func readElementSegment(r io.Reader, seg *module.ElementSegment) error {
 		return err
 	}
 
-	if err := readVarUint32Vector(r, &seg.Indices); err != nil {
-		return err
-	}
-
-	return nil
+	return readVarUint32Vector(r, &seg.Indices)
 }
 
 func readDataSegment(r io.Reader, seg *module.DataSegment) error {
@@ -668,11 +660,7 @@ func readDataSegment(r io.Reader, seg *module.DataSegment) error {
 		return err
 	}
 
-	if err := readByteVector(r, &seg.Init); err != nil {
-		return err
-	}
-
-	return nil
+	return readByteVector(r, &seg.Init)
 }
 
 func readRawCodeSegment(r io.Reader, seg *module.RawCodeSegment) error {

internal/wasm/encoding/writer.go

@@ -582,11 +582,7 @@ func writeGlobal(w io.Writer, global module.Global) error {
 		return err
 	}
 
-	if err := writeInstructions(w, global.Init.Instrs); err != nil {
-		return err
-	}
-
-	return nil
+	return writeInstructions(w, global.Init.Instrs)
 }
 
 func writeInstructions(w io.Writer, instrs []instruction.Instruction) error {

internal/wasm/sdk/internal/wasm/bindings.go

@@ -66,7 +66,6 @@ func opaPrintln(caller *wasmtime.Caller, args []wasmtime.Val) ([]wasmtime.Val, *
 type builtinDispatcher struct {
 	ctx      *topdown.BuiltinContext
 	builtins map[int32]topdown.BuiltinFunc
-	result   *ast.Term
 }
 
 func newBuiltinDispatcher() *builtinDispatcher {

internal/wasm/sdk/internal/wasm/vm.go

@@ -31,7 +31,6 @@ type VM struct {
 	instance             *wasmtime.Instance // Pointer to avoid unintented destruction (triggering finalizers within).
 	intHandle            *wasmtime.InterruptHandle
 	policy               []byte
-	data                 []byte
 	memory               *wasmtime.Memory
 	memoryMin            uint32
 	memoryMax            uint32
@@ -541,32 +540,6 @@ func (i *VM) toRegoJSON(ctx context.Context, v interface{}, free bool) (int32, e
 	return addr, nil
 }
 
-// fromRegoValue parses serialized opa values from the Wasm memory buffer into
-// Rego AST types.
-func (i *VM) fromRegoValue(ctx context.Context, addr int32, free bool) (*ast.Term, error) {
-	serialized, err := i.valueDump(ctx, addr)
-	if err != nil {
-		return nil, err
-	}
-
-	data := i.memory.UnsafeData()[serialized:]
-	n := bytes.IndexByte(data, 0)
-	if n < 0 {
-		n = 0
-	}
-
-	// Parse the result into ast types.
-	result, err := ast.ParseTerm(string(data[0:n]))
-
-	if free {
-		if err := i.free(ctx, serialized); err != nil {
-			return nil, err
-		}
-	}
-
-	return result, err
-}
-
 func (i *VM) getHeapState(ctx context.Context) (int32, error) {
 	return i.heapPtrGet(ctx)
 }

internal/wasm/sdk/opa/loader/file/loader.go

@@ -48,7 +48,7 @@ func New(opa *opa.OPA) *Loader {
 	return new(opa)
 }
 
-// new constucts a new file loader. This is for tests.
+// new constructs a new file loader. This is for tests.
 func new(pd policyData) *Loader {
 	return &Loader{
 		pd:       pd,

internal/wasm/sdk/opa/loader/http/loader.go

@@ -59,11 +59,11 @@ type policyData interface {
 // New constructs a new HTTP loader periodically downloading a bundle
 // over HTTP.
 func New(o *opa.OPA) *Loader {
-	return new(o)
+	return newLoader(o)
 }
 
-// new constucts a new HTTP loader. This is for tests.
-func new(pd policyData) *Loader {
+// newLoader constructs a new HTTP loader. This is for tests.
+func newLoader(pd policyData) *Loader {
 	return &Loader{
 		pd:             pd,
 		client:         http.DefaultClient,
@@ -157,7 +157,7 @@ func (l *Loader) download(ctx context.Context) error {
 			return err
 		} else if err != nil {
 			l.logError(err)
-		} else if err == nil {
+		} else {
 			break
 		}
 
@@ -252,6 +252,6 @@ func (l *Loader) get(ctx context.Context, tag string) (*bundle.Bundle, error) {
 // close closes the HTTP response gracefully, first draining it, to
 // avoid resource leaks.
 func (l *Loader) close(resp *http.Response) {
-	io.Copy(ioutil.Discard, resp.Body) // Ignore errors.
-	resp.Body.Close()
+	_, _ = io.Copy(ioutil.Discard, resp.Body) // Ignore errors.
+	_ = resp.Body.Close()
 }

internal/wasm/sdk/opa/loader/http/loader_test.go

@@ -23,7 +23,7 @@ func TestHTTPLoader(t *testing.T) {
 	// Start loader, without having the HTTP content in place.
 
 	var pd testPolicyData
-	loader, err := new(&pd).WithURL("http://localhost:0").WithInterval(10*time.Millisecond, 20*time.Millisecond).Init()
+	loader, err := newLoader(&pd).WithURL("http://localhost:0").WithInterval(10*time.Millisecond, 20*time.Millisecond).Init()
 	if err != nil {
 		t.Fatal(err.Error())
 	}
@@ -59,7 +59,7 @@ func TestHTTPLoader(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	loader, err = new(&pd).WithURL(ts.URL).WithInterval(10*time.Millisecond, 20*time.Millisecond).Init()
+	loader, err = newLoader(&pd).WithURL(ts.URL).WithInterval(10*time.Millisecond, 20*time.Millisecond).Init()
 	if err != nil {
 		t.Fatal(err.Error())
 	}

loader/errors.go

@@ -60,9 +60,3 @@ type mergeError string
 func (e mergeError) Error() string {
 	return string(e) + ": merge error"
 }
-
-type emptyModuleError string
-
-func (e emptyModuleError) Error() string {
-	return string(e) + ": empty policy"
-}

loader/loader.go

@@ -100,20 +100,12 @@ func NewFileLoader() FileLoader {
 	}
 }
 
-type descriptor struct {
-	result  *Result
-	path    string
-	relPath string
-	depth   int
-}
-
 type fileLoader struct {
-	metrics     metrics.Metrics
-	bvc         *bundle.VerificationConfig
-	skipVerify  bool
-	descriptors []*descriptor
-	files       map[string]bundle.FileInfo
-	opts        ast.ParserOptions
+	metrics    metrics.Metrics
+	bvc        *bundle.VerificationConfig
+	skipVerify bool
+	files      map[string]bundle.FileInfo
+	opts       ast.ParserOptions
 }
 
 // WithMetrics provides the metrics instance to use while loading
@@ -519,7 +511,7 @@ func newResult() *Result {
 }
 
 func all(paths []string, filter Filter, f func(*Result, string, int) error) (*Result, error) {
-	errors := Errors{}
+	errs := Errors{}
 	root := newResult()
 
 	for _, path := range paths {
@@ -535,11 +527,11 @@ func all(paths []string, filter Filter, f func(*Result, string, int) error) (*Re
 			}
 		}
 
-		allRec(path, filter, &errors, loaded, 0, f)
+		allRec(path, filter, &errs, loaded, 0, f)
 	}
 
-	if len(errors) > 0 {
-		return nil, errors
+	if len(errs) > 0 {
+		return nil, errs
 	}
 
 	return root, nil

loader/loader_test.go

@@ -168,10 +168,11 @@ func TestFilteredPaths(t *testing.T) {
 
 	test.WithTempFS(files, func(rootDir string) {
 
-		paths := []string{}
-		paths = append(paths, filepath.Join(rootDir, "a"))
-		paths = append(paths, filepath.Join(rootDir, "b"))
-		paths = append(paths, filepath.Join(rootDir, "foo"))
+		paths := []string{
+			filepath.Join(rootDir, "a"),
+			filepath.Join(rootDir, "b"),
+			filepath.Join(rootDir, "foo"),
+		}
 
 		result, err := FilteredPaths(paths, nil)
 		if err != nil {
@@ -221,7 +222,10 @@ func TestGetBundleDirectoryLoader(t *testing.T) {
 		}
 
 		err = bundle.Write(f, *b)
-		f.Close()
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+		err = f.Close()
 		if err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
@@ -236,7 +240,7 @@ func TestGetBundleDirectoryLoader(t *testing.T) {
 		}
 
 		// check files
-		result := []string{}
+		var result []string
 		for {
 			f, err := bl.NextFile()
 			if err == io.EOF {
@@ -487,7 +491,10 @@ func TestAsBundleWithFile(t *testing.T) {
 		}
 
 		err = bundle.Write(f, *b)
-		f.Close()
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+		err = f.Close()
 		if err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
@@ -679,12 +686,12 @@ func TestSplitPrefix(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.input, func(t *testing.T) {
-			parts, path := SplitPrefix(tc.input)
+			parts, gotPath := SplitPrefix(tc.input)
 			if !reflect.DeepEqual(parts, tc.wantParts) {
 				t.Errorf("wanted parts %v but got %v", tc.wantParts, parts)
 			}
-			if path != tc.wantPath {
-				t.Errorf("wanted path %q but got %q", path, tc.wantPath)
+			if gotPath != tc.wantPath {
+				t.Errorf("wanted path %q but got %q", gotPath, tc.wantPath)
 			}
 		})
 	}
@@ -822,7 +829,10 @@ func TestSchemas(t *testing.T) {
 							key = ast.MustParseRef(k)
 						}
 						var schema interface{}
-						util.Unmarshal([]byte(v), &schema)
+						err = util.Unmarshal([]byte(v), &schema)
+						if err != nil {
+							t.Fatalf("Unexpected error: %v", err)
+						}
 						result := ss.Get(key)
 						if result == nil {
 							t.Fatalf("expected schema with key %v", key)

metrics/metrics.go

@@ -200,7 +200,7 @@ func (t *timer) Start() {
 func (t *timer) Stop() int64 {
 	t.mtx.Lock()
 	defer t.mtx.Unlock()
-	delta := time.Now().Sub(t.start).Nanoseconds()
+	delta := time.Since(t.start).Nanoseconds()
 	t.value += delta
 	return delta
 }

plugins/bundle/config_test.go

@@ -379,7 +379,7 @@ func TestConfigIsMultiBundle(t *testing.T) {
 			conf: Config{
 				Name: "bundle.tar.gz",
 				Bundles: map[string]*Source{
-					"bundle.tar.gz": &Source{},
+					"bundle.tar.gz": {},
 				},
 			},
 			expected: false,
@@ -388,7 +388,7 @@ func TestConfigIsMultiBundle(t *testing.T) {
 			conf: Config{
 				Name: "",
 				Bundles: map[string]*Source{
-					"bundle.tar.gz": &Source{},
+					"bundle.tar.gz": {},
 				},
 			},
 			expected: true,

plugins/bundle/plugin.go

@@ -40,7 +40,6 @@ type Plugin struct {
 	logger            logging.Logger
 	mtx               sync.Mutex
 	cfgMtx            sync.Mutex
-	legacyConfig      bool
 	ready             bool
 	bundlePersistPath string
 }
@@ -550,11 +549,7 @@ func saveCurrentBundleToDisk(path, filename string, b *bundle.Bundle) error {
 		}
 	}
 
-	if err := ioutil.WriteFile(filepath.Join(path, filename), buf.Bytes(), 0644); err != nil {
-		return err
-	}
-
-	return nil
+	return ioutil.WriteFile(filepath.Join(path, filename), buf.Bytes(), 0644)
 }
 
 func loadBundleFromDisk(path, name string, src *Source) (*bundle.Bundle, error) {

plugins/bundle/plugin_test.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+// nolint: goconst // string duplication is for test readability.
 package bundle
 
 import (
@@ -150,7 +151,7 @@ func TestPluginOneShotBundlePersistence(t *testing.T) {
 		Manifest: bundle.Manifest{Revision: "quickbrownfaux"},
 		Data:     util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}}`)).(map[string]interface{}),
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				URL:    "/foo/bar.rego",
 				Path:   "/foo/bar.rego",
 				Parsed: ast.MustParseModule(module),
@@ -245,7 +246,7 @@ func TestLoadAndActivateBundlesFromDisk(t *testing.T) {
 		Manifest: bundle.Manifest{Revision: "quickbrownfaux"},
 		Data:     util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}}`)).(map[string]interface{}),
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				URL:    "/foo/bar.rego",
 				Path:   "/foo/bar.rego",
 				Parsed: ast.MustParseModule(module),
@@ -674,7 +675,7 @@ func validateStatus(t *testing.T, actual Status, expected string, expectStatusEr
 	t.Helper()
 
 	if expectStatusErr && !isErrStatus(actual) {
-		t.Errorf("Expected status to be in an error state, but no error has occured.")
+		t.Errorf("Expected status to be in an error state, but no error has occurred.")
 	} else if !expectStatusErr && isErrStatus(actual) {
 		t.Errorf("Unexpected error status %s", actual)
 	}
@@ -1014,10 +1015,7 @@ func TestPluginActivateScopedBundle(t *testing.T) {
 		if err := manager.Store.UpsertPolicy(ctx, txn, "some/id2", []byte(`package a.a4`)); err != nil {
 			return err
 		}
-		if err := manager.Store.UpsertPolicy(ctx, txn, "some/id3", []byte(`package a.a6`)); err != nil {
-			return err
-		}
-		return nil
+		return manager.Store.UpsertPolicy(ctx, txn, "some/id3", []byte(`package a.a6`))
 	}); err != nil {
 		t.Fatal(err)
 	}
@@ -1035,7 +1033,7 @@ func TestPluginActivateScopedBundle(t *testing.T) {
 			},
 		},
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				Path:   "bundle/id1",
 				Parsed: ast.MustParseModule(module),
 				Raw:    []byte(module),
@@ -1072,7 +1070,7 @@ func TestPluginActivateScopedBundle(t *testing.T) {
 			},
 		},
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				Path:   "bundle/id2",
 				Parsed: ast.MustParseModule(module),
 				Raw:    []byte(module),
@@ -1140,7 +1138,7 @@ func TestPluginSetCompilerOnContext(t *testing.T) {
 		Manifest: bundle.Manifest{Revision: "quickbrownfaux"},
 		Data:     map[string]interface{}{},
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				Path:   "/test.rego",
 				Parsed: ast.MustParseModule(module),
 				Raw:    []byte(module),
@@ -1153,12 +1151,12 @@ func TestPluginSetCompilerOnContext(t *testing.T) {
 	events := []storage.TriggerEvent{}
 
 	if err := storage.Txn(ctx, manager.Store, storage.WriteParams, func(txn storage.Transaction) error {
-		manager.Store.Register(ctx, txn, storage.TriggerConfig{
+		_, err := manager.Store.Register(ctx, txn, storage.TriggerConfig{
 			OnCommit: func(ctx context.Context, txn storage.Transaction, event storage.TriggerEvent) {
 				events = append(events, event)
 			},
 		})
-		return nil
+		return err
 	}); err != nil {
 		t.Fatal(err)
 	}
@@ -1377,7 +1375,7 @@ func TestPluginReconfigure(t *testing.T) {
 		})
 	}
 	if len(stages) != updateCount {
-		t.Fatalf("Expected to have recieved %d updates, got %d", len(stages), updateCount)
+		t.Fatalf("Expected to have received %d updates, got %d", len(stages), updateCount)
 	}
 }
 
@@ -1447,7 +1445,7 @@ func TestUpgradeLegacyBundleToMuiltiBundleSameBundle(t *testing.T) {
 	// Start with a "legacy" style config for a single bundle
 	plugin.config = Config{
 		Bundles: map[string]*Source{
-			bundleName: &Source{
+			bundleName: {
 				Service: "s1",
 			},
 		},
@@ -1466,7 +1464,7 @@ func TestUpgradeLegacyBundleToMuiltiBundleSameBundle(t *testing.T) {
 			},
 		},
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				Path:   "bundle/id1",
 				Parsed: ast.MustParseModule(module),
 				Raw:    []byte(module),
@@ -1490,7 +1488,7 @@ func TestUpgradeLegacyBundleToMuiltiBundleSameBundle(t *testing.T) {
 	// Update to the newer style config with the same bundle
 	multiBundleConf := &Config{
 		Bundles: map[string]*Source{
-			bundleName: &Source{
+			bundleName: {
 				Service: "s1",
 			},
 		},
@@ -1562,7 +1560,7 @@ func TestUpgradeLegacyBundleToMuiltiBundleNewBundles(t *testing.T) {
 	// Start with a "legacy" style config for a single bundle
 	plugin.config = Config{
 		Bundles: map[string]*Source{
-			bundleName: &Source{
+			bundleName: {
 				Config:  downloadConf,
 				Service: serviceName,
 			},
@@ -1582,7 +1580,7 @@ func TestUpgradeLegacyBundleToMuiltiBundleNewBundles(t *testing.T) {
 			},
 		},
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				Path:   "bundle/id1",
 				Parsed: ast.MustParseModule(module),
 				Raw:    []byte(module),
@@ -1606,7 +1604,7 @@ func TestUpgradeLegacyBundleToMuiltiBundleNewBundles(t *testing.T) {
 	// Update to the newer style config with a new bundle
 	multiBundleConf := &Config{
 		Bundles: map[string]*Source{
-			"b2": &Source{
+			"b2": {
 				Config:  downloadConf,
 				Service: serviceName,
 			},
@@ -1619,14 +1617,14 @@ func TestUpgradeLegacyBundleToMuiltiBundleNewBundles(t *testing.T) {
 
 	module = "package a.c\n\nbar=1"
 	b = bundle.Bundle{
-		Manifest: bundle.Manifest{Revision: fmt.Sprintf("b2-1"), Roots: &[]string{"a/b2", "a/c"}},
+		Manifest: bundle.Manifest{Revision: "b2-1", Roots: &[]string{"a/b2", "a/c"}},
 		Data: map[string]interface{}{
 			"a": map[string]interface{}{
 				"b2": "foo",
 			},
 		},
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				Path:   "id1",
 				Parsed: ast.MustParseModule(module),
 				Raw:    []byte(module),
@@ -1752,7 +1750,7 @@ func TestSaveBundleToDiskOverWrite(t *testing.T) {
 			},
 		},
 		Modules: []bundle.ModuleFile{
-			bundle.ModuleFile{
+			{
 				Path:   "bundle/id1",
 				Parsed: ast.MustParseModule(module),
 				Raw:    []byte(module),
@@ -1937,7 +1935,7 @@ func TestPluginUsingFileLoader(t *testing.T) {
 		url := "file://" + name
 
 		p := New(&Config{Bundles: map[string]*Source{
-			"test": &Source{
+			"test": {
 				SizeLimitBytes: 1e5,
 				Resource:       url,
 			},

plugins/discovery/discovery_test.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+// nolint: goconst // string duplication is for test readability.
 package discovery
 
 import (

plugins/logs/mask.go

@@ -20,6 +20,9 @@ type maskOP string
 const (
 	maskOPRemove maskOP = "remove"
 	maskOPUpsert maskOP = "upsert"
+
+	partInput  = "input"
+	partResult = "result"
 )
 
 var (
@@ -61,7 +64,7 @@ func newMaskRule(path string, opts ...maskRuleOption) (*maskRule, error) {
 
 	parts := strings.Split(path[1:], "/")
 
-	if parts[0] != "input" && parts[0] != "result" {
+	if parts[0] != partInput && parts[0] != partResult {
 		return nil, fmt.Errorf("mask prefix not allowed: %v", parts[0])
 	}
 
@@ -131,7 +134,7 @@ func (r maskRule) Mask(event *EventV1) error {
 	var maskObjPtr **interface{} // pointer to the event Input|Result pointer itself
 
 	switch p := r.escapedParts[0]; p {
-	case "input":
+	case partInput:
 		if event.Input == nil {
 			if r.failUndefinedPath {
 				return errMaskInvalidObject
@@ -141,7 +144,7 @@ func (r maskRule) Mask(event *EventV1) error {
 		maskObj = event.Input
 		maskObjPtr = &event.Input
 
-	case "result":
+	case partResult:
 		if event.Result == nil {
 			if r.failUndefinedPath {
 				return errMaskInvalidObject
@@ -329,7 +332,7 @@ func (rs maskRuleSet) Mask(event *EventV1) {
 		// result must be deep copied if there are any mask rules
 		// targeting it, to avoid modifying the result sent
 		// to the consumer
-		if mRule.escapedParts[0] == "result" && event.Result != nil && !rs.resultCopied {
+		if mRule.escapedParts[0] == partResult && event.Result != nil && !rs.resultCopied {
 			resultCopy := deepcopy.DeepCopy(*event.Result)
 			event.Result = &resultCopy
 			rs.resultCopied = true

plugins/logs/mask_test.go

@@ -159,7 +159,7 @@ func TestNewMaskRule(t *testing.T) {
 		t.Run(tc.note, func(t *testing.T) {
 			result, err := newMaskRule(tc.input.Path, withOP(tc.input.OP), withValue(tc.input.Value))
 			if tc.input.failUndefinedPath {
-				withFailUndefinedPath()(result)
+				_ = withFailUndefinedPath()(result)
 			}
 
 			if tc.expErr != nil {
@@ -259,7 +259,7 @@ func TestMaskRuleMask(t *testing.T) {
 			exp:   `{}`,
 		},
 		{
-			note: "upsert undefined input: fail unkown object path on",
+			note: "upsert undefined input: fail unknown object path on",
 			ptr: &maskRule{
 				OP:                maskOPUpsert,
 				Path:              "/input/foo",
@@ -279,7 +279,7 @@ func TestMaskRuleMask(t *testing.T) {
 			exp:   `{}`,
 		},
 		{
-			note: "erase undefined result: fail unkown object path on",
+			note: "erase undefined result: fail unknown object path on",
 			ptr: &maskRule{
 				OP:                maskOPRemove,
 				Path:              "/result/foo",
@@ -299,7 +299,7 @@ func TestMaskRuleMask(t *testing.T) {
 			exp:   `{}`,
 		},
 		{
-			note: "upsert undefined result: fail unkown object path on",
+			note: "upsert undefined result: fail unknown object path on",
 			ptr: &maskRule{
 				OP:                maskOPUpsert,
 				Path:              "/result/foo",
@@ -319,7 +319,7 @@ func TestMaskRuleMask(t *testing.T) {
 			exp:   `{"input": {"bar": 1}}`,
 		},
 		{
-			note: "erase undefined node: fail unkown object path on",
+			note: "erase undefined node: fail unknown object path on",
 			ptr: &maskRule{
 				OP:                maskOPRemove,
 				Path:              "/input/foo",
@@ -339,7 +339,7 @@ func TestMaskRuleMask(t *testing.T) {
 			exp:   `{"input": {"bar": 1, "foo": null}, "masked": ["/input/foo"]}`,
 		},
 		{
-			note: "upsert undefined node with nil value: fail unkown object path on",
+			note: "upsert undefined node with nil value: fail unknown object path on",
 			ptr: &maskRule{
 				OP:                maskOPUpsert,
 				Path:              "/input/foo",
@@ -548,7 +548,7 @@ func TestMaskRuleMask(t *testing.T) {
 
 			ptr, err := newMaskRule(tc.ptr.Path, withOP(tc.ptr.OP), withValue(tc.ptr.Value))
 			if tc.ptr.failUndefinedPath {
-				withFailUndefinedPath()(ptr)
+				_ = withFailUndefinedPath()(ptr)
 			}
 
 			if err != nil {
@@ -636,7 +636,7 @@ func TestMaskRuleSetMask(t *testing.T) {
 		{
 			note: "erase input",
 			rules: []*maskRule{
-				&maskRule{
+				{
 					OP:   maskOPRemove,
 					Path: "/input",
 				},
@@ -647,7 +647,7 @@ func TestMaskRuleSetMask(t *testing.T) {
 		{
 			note: "erase result",
 			rules: []*maskRule{
-				&maskRule{
+				{
 					OP:   maskOPRemove,
 					Path: "/result",
 				},
@@ -658,11 +658,11 @@ func TestMaskRuleSetMask(t *testing.T) {
 		{
 			note: "erase input and result nested",
 			rules: []*maskRule{
-				&maskRule{
+				{
 					OP:   maskOPRemove,
 					Path: "/input/a/b",
 				},
-				&maskRule{
+				{
 					OP:   maskOPRemove,
 					Path: "/result/c/d",
 				},
@@ -673,7 +673,7 @@ func TestMaskRuleSetMask(t *testing.T) {
 		{
 			note: "expected rule error",
 			rules: []*maskRule{
-				&maskRule{
+				{
 					OP:                maskOPRemove,
 					Path:              "/result",
 					failUndefinedPath: true,

plugins/logs/plugin.go

@@ -432,7 +432,7 @@ func (p *Plugin) Stop(ctx context.Context) {
 
 	done := make(chan struct{})
 	p.stop <- done
-	_ = <-done
+	<-done
 	p.manager.UpdatePluginStatus(Name, &plugins.Status{State: plugins.StateNotReady})
 }
 
@@ -536,7 +536,7 @@ func (p *Plugin) Reconfigure(_ context.Context, config interface{}) {
 	defer p.maskMutex.Unlock()
 	p.mask = nil
 
-	_ = <-done
+	<-done
 }
 
 // compilerUpdated is called when a compiler trigger on the plugin manager

plugins/logs/plugin_benchmark_test.go

@@ -148,7 +148,9 @@ func BenchmarkMaskingNop(b *testing.B) {
 	}
 
 	cfg := &Config{Service: "svc"}
-	cfg.validateAndInjectDefaults([]string{"svc"}, nil)
+	if err := cfg.validateAndInjectDefaults([]string{"svc"}, nil); err != nil {
+		b.Fatal(err)
+	}
 	plugin := New(cfg, manager)
 
 	b.ResetTimer()
@@ -186,7 +188,9 @@ func BenchmarkMaskingRuleCountsNop(b *testing.B) {
 	}
 
 	cfg := &Config{Service: "svc"}
-	cfg.validateAndInjectDefaults([]string{"svc"}, nil)
+	if err := cfg.validateAndInjectDefaults([]string{"svc"}, nil); err != nil {
+		b.Fatal(err)
+	}
 	plugin := New(cfg, manager)
 
 	for _, ruleCount := range numRules {
@@ -216,16 +220,13 @@ func BenchmarkMaskingErase(b *testing.B) {
 	store := inmem.New()
 
 	err := storage.Txn(ctx, store, storage.WriteParams, func(txn storage.Transaction) error {
-		if err := store.UpsertPolicy(ctx, txn, "test.rego", []byte(`
+		return store.UpsertPolicy(ctx, txn, "test.rego", []byte(`
 			package system.log
 
 			mask["/input"] {
 				input.input.request.kind.kind == "Pod"
 			}
-		`)); err != nil {
-			return err
-		}
-		return nil
+		`))
 	})
 	if err != nil {
 		b.Fatal(err)
@@ -239,7 +240,9 @@ func BenchmarkMaskingErase(b *testing.B) {
 	}
 
 	cfg := &Config{Service: "svc"}
-	cfg.validateAndInjectDefaults([]string{"svc"}, nil)
+	if err := cfg.validateAndInjectDefaults([]string{"svc"}, nil); err != nil {
+		b.Fatal(err)
+	}
 	plugin := New(cfg, manager)
 
 	b.ResetTimer()

plugins/logs/plugin_test.go

@@ -476,7 +476,7 @@ func TestPluginRequeBufferPreserved(t *testing.T) {
 		t.Fatal("Expected error")
 	}
 
-	_ = <-fixture.server.ch
+	<-fixture.server.ch
 
 	if fixture.plugin.buffer.Len() < bufLen {
 		t.Fatal("Expected buffer to be preserved")
@@ -709,7 +709,7 @@ func TestPluginRateLimitRequeue(t *testing.T) {
 		t.Fatal("Expected error")
 	}
 
-	_ = <-fixture.server.ch
+	<-fixture.server.ch
 
 	if fixture.plugin.buffer.Len() < bufLen {
 		t.Fatal("Expected buffer to be preserved")
@@ -1742,8 +1742,8 @@ func compareLogEvent(t *testing.T, actual []byte, exp EventV1) {
 
 func testStatus() *bundle.Status {
 
-	tDownload, _ := time.Parse("2018-01-01T00:00:00.0000000Z", time.RFC3339Nano)
-	tActivate, _ := time.Parse("2018-01-01T00:00:01.0000000Z", time.RFC3339Nano)
+	tDownload, _ := time.Parse(time.RFC3339Nano, "2018-01-01T00:00:00.0000000Z")
+	tActivate, _ := time.Parse(time.RFC3339Nano, "2018-01-01T00:00:01.0000000Z")
 
 	status := bundle.Status{
 		Name:                     "example/authz",

plugins/plugins_test.go

@@ -47,7 +47,10 @@ func TestManagerCacheTriggers(t *testing.T) {
 		t.Fatal("Listeners should not be called yet")
 	}
 
-	m.Reconfigure(m.Config)
+	err = m.Reconfigure(m.Config)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
 
 	if l1Called == false || l2Called == false {
 		t.Fatal("Listeners should hav been called")
@@ -85,9 +88,10 @@ func TestManagerPluginStatusListener(t *testing.T) {
 	}
 
 	// Push an update to a plugin, ensure current status is reflected and listeners were called
-	m.UpdatePluginStatus("p1", &Status{State: StateOK, Message: "foo"})
+	const message = "foo"
+	m.UpdatePluginStatus("p1", &Status{State: StateOK, Message: message})
 	currentStatus = m.PluginStatus()
-	if len(currentStatus) != 1 || currentStatus["p1"].State != StateOK || currentStatus["p1"].Message != "foo" {
+	if len(currentStatus) != 1 || currentStatus["p1"].State != StateOK || currentStatus["p1"].Message != message {
 		t.Fatalf("Expected 1 statuses in current plugin status map with state OK and message 'foo', got: %+v", currentStatus)
 	}
 	if !reflect.DeepEqual(currentStatus, l1Status) || !reflect.DeepEqual(l1Status, l2Status) {
@@ -103,7 +107,7 @@ func TestManagerPluginStatusListener(t *testing.T) {
 	// Send another update, ensure the status is ok and the remaining listener is still called
 	m.UpdatePluginStatus("p2", &Status{State: StateErr})
 	currentStatus = m.PluginStatus()
-	if len(currentStatus) != 2 || currentStatus["p1"].State != StateOK || currentStatus["p1"].Message != "foo" || currentStatus["p2"].State != StateErr {
+	if len(currentStatus) != 2 || currentStatus["p1"].State != StateOK || currentStatus["p1"].Message != message || currentStatus["p2"].State != StateErr {
 		t.Fatalf("Unexpected current plugin status, got: %+v", currentStatus)
 	}
 	if !reflect.DeepEqual(currentStatus, l2Status) {
@@ -119,7 +123,7 @@ func TestManagerPluginStatusListener(t *testing.T) {
 	// Ensure updates can still be sent with no listeners
 	m.UpdatePluginStatus("p2", &Status{State: StateOK})
 	currentStatus = m.PluginStatus()
-	if len(currentStatus) != 2 || currentStatus["p1"].State != StateOK || currentStatus["p1"].Message != "foo" || currentStatus["p2"].State != StateOK {
+	if len(currentStatus) != 2 || currentStatus["p1"].State != StateOK || currentStatus["p1"].Message != message || currentStatus["p2"].State != StateOK {
 		t.Fatalf("Unexpected current plugin status, got: %+v", currentStatus)
 	}
 }
@@ -264,8 +268,8 @@ func (m *mockForInitStartOrdering) Start(ctx context.Context) error {
 	return fmt.Errorf("expected manager to be initialized")
 }
 
-func (m *mockForInitStartOrdering) Stop(ctx context.Context)                            { return }
-func (m *mockForInitStartOrdering) Reconfigure(ctx context.Context, config interface{}) { return }
+func (*mockForInitStartOrdering) Stop(context.Context)                     {}
+func (*mockForInitStartOrdering) Reconfigure(context.Context, interface{}) {}
 
 func TestPluginManagerAuthPlugin(t *testing.T) {
 	m, err := New([]byte(`{"plugins": {"someplugin": {}}}`), "test", inmem.New())
@@ -317,14 +321,16 @@ func TestPluginManagerConsoleLogger(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	mgr.ConsoleLogger().WithFields(map[string]interface{}{"foo": "bar"}).Info("Some message")
+	const fieldKey = "foo"
+	const fieldValue = "bar"
+	mgr.ConsoleLogger().WithFields(map[string]interface{}{fieldKey: fieldValue}).Info("Some message")
 
 	entries := consoleLogger.Entries()
 
 	exp := []test.LogEntry{
 		{
 			Level:   logging.Info,
-			Fields:  map[string]interface{}{"foo": "bar"},
+			Fields:  map[string]interface{}{fieldKey: fieldValue},
 			Message: "Some message",
 		},
 	}

plugins/rest/aws_test.go

@@ -52,15 +52,15 @@ func TestEnvironmentCredentialService(t *testing.T) {
 	cs := &awsEnvironmentCredentialService{}
 
 	// wrong path: some required environment is missing
-	envCreds, err := cs.credentials()
+	_, err := cs.credentials()
 	assertErr("no AWS_ACCESS_KEY_ID set in environment", err, t)
 
 	os.Setenv("AWS_ACCESS_KEY_ID", "MYAWSACCESSKEYGOESHERE")
-	envCreds, err = cs.credentials()
+	_, err = cs.credentials()
 	assertErr("no AWS_SECRET_ACCESS_KEY set in environment", err, t)
 
 	os.Setenv("AWS_SECRET_ACCESS_KEY", "MYAWSSECRETACCESSKEYGOESHERE")
-	envCreds, err = cs.credentials()
+	_, err = cs.credentials()
 	assertErr("no AWS_REGION set in environment", err, t)
 
 	os.Setenv("AWS_REGION", "us-east-1")
@@ -87,7 +87,7 @@ func TestEnvironmentCredentialService(t *testing.T) {
 		os.Setenv(testCase.tokenEnv, testCase.tokenValue)
 		expectedCreds.SessionToken = testCase.tokenValue
 
-		envCreds, err = cs.credentials()
+		envCreds, err := cs.credentials()
 		if err != nil {
 			t.Error("unexpected error: " + err.Error())
 		}
@@ -200,6 +200,10 @@ func TestMetadataCredentialService(t *testing.T) {
 	}
 	var creds awsCredentials
 	creds, err = cs.credentials()
+	if err != nil {
+		// Cannot proceed with test if unable to fetch credentials.
+		t.Fatal(err)
+	}
 
 	assertEq(creds.AccessKey, ts.payload.AccessKeyID, t)
 	assertEq(creds.SecretKey, ts.payload.SecretAccessKey, t)
@@ -209,6 +213,10 @@ func TestMetadataCredentialService(t *testing.T) {
 	// happy path: verify credentials are cached based on expiry
 	ts.payload.AccessKeyID = "ICHANGEDTHISBUTWEWONTSEEIT"
 	creds, err = cs.credentials()
+	if err != nil {
+		// Cannot proceed with test if unable to fetch credentials.
+		t.Fatal(err)
+	}
 
 	assertEq(creds.AccessKey, "MYAWSACCESSKEYGOESHERE", t) // the original value
 	assertEq(creds.SecretKey, ts.payload.SecretAccessKey, t)
@@ -232,6 +240,10 @@ func TestMetadataCredentialService(t *testing.T) {
 		Expiration:      time.Now().UTC().Add(time.Minute * 2)} // short time
 
 	creds, err = cs.credentials()
+	if err != nil {
+		// Cannot proceed with test if unable to fetch credentials.
+		t.Fatal(err)
+	}
 
 	assertEq(creds.AccessKey, ts.payload.AccessKeyID, t)
 	assertEq(creds.SecretKey, ts.payload.SecretAccessKey, t)
@@ -241,6 +253,10 @@ func TestMetadataCredentialService(t *testing.T) {
 	// second time through, with changes
 	ts.payload.AccessKeyID = "ICHANGEDTHISANDWEWILLSEEIT"
 	creds, err = cs.credentials()
+	if err != nil {
+		// Cannot proceed with test if unable to fetch credentials.
+		t.Fatal(err)
+	}
 
 	assertEq(creds.AccessKey, ts.payload.AccessKeyID, t) // the new value
 	assertEq(creds.SecretKey, ts.payload.SecretAccessKey, t)
@@ -248,15 +264,6 @@ func TestMetadataCredentialService(t *testing.T) {
 	assertEq(creds.SessionToken, ts.payload.Token, t)
 }
 
-type testCredentialService struct{}
-
-func (cs *testCredentialService) credentials() (awsCredentials, error) {
-	return awsCredentials{AccessKey: "MYAWSACCESSKEYGOESHERE",
-		SecretKey:    "MYAWSSECRETACCESSKEYGOESHERE",
-		RegionName:   "us-east-1",
-		SessionToken: "MYAWSSECURITYTOKENGOESHERE"}, nil
-}
-
 func TestV4Signing(t *testing.T) {
 	ts := ec2CredTestServer{}
 	ts.start()
@@ -501,11 +508,8 @@ func TestV4SigningWithMultiValueHeaders(t *testing.T) {
 
 // simulate EC2 metadata service
 type ec2CredTestServer struct {
-	t         *testing.T
-	server    *httptest.Server
-	expPath   string
-	expMethod string
-	payload   metadataPayload // must set before use
+	server  *httptest.Server
+	payload metadataPayload // must set before use
 }
 
 func (t *ec2CredTestServer) handle(w http.ResponseWriter, r *http.Request) {
@@ -522,17 +526,17 @@ func (t *ec2CredTestServer) handle(w http.ResponseWriter, r *http.Request) {
 	case goodTokenPath:
 		// a valid token
 		w.WriteHeader(200)
-		w.Write([]byte(tokenValue))
+		_, _ = w.Write([]byte(tokenValue))
 	case badTokenPath:
 		// an invalid token
 		w.WriteHeader(200)
-		w.Write([]byte("THIS_IS_A_BAD_TOKEN"))
+		_, _ = w.Write([]byte("THIS_IS_A_BAD_TOKEN"))
 	case goodPath:
 		// validate token...
 		if r.Header.Get("X-aws-ec2-metadata-token") == tokenValue {
 			// a metadata response that's well-formed
 			w.WriteHeader(200)
-			w.Write(jsonBytes)
+			_, _ = w.Write(jsonBytes)
 		} else {
 			// an unauthorized response
 			w.WriteHeader(401)
@@ -540,7 +544,7 @@ func (t *ec2CredTestServer) handle(w http.ResponseWriter, r *http.Request) {
 	case badPath:
 		// a metadata response that's not well-formed
 		w.WriteHeader(200)
-		w.Write([]byte("This isn't a JSON payload"))
+		_, _ = w.Write([]byte("This isn't a JSON payload"))
 	default:
 		// something else that we won't be able to find
 		w.WriteHeader(404)
@@ -573,18 +577,44 @@ func TestWebIdentityCredentialService(t *testing.T) {
 		t.Errorf("Error while creating token file: %s", err)
 		return
 	}
-	defer os.Remove(goodTokenFile.Name())
-	goodTokenFile.WriteString("good-token")
-	goodTokenFile.Close()
+	t.Cleanup(func() {
+		err := os.Remove(goodTokenFile.Name())
+		if err != nil {
+			t.Fatalf("unable to remove goodTokenFile %q: %v", goodTokenFile.Name(), err)
+		}
+	})
+	_, err = goodTokenFile.WriteString("good-token")
+	if err != nil {
+		t.Errorf("Error while creating token file: %s", err)
+		return
+	}
+	err = goodTokenFile.Close()
+	if err != nil {
+		t.Errorf("Error while creating token file: %s", err)
+		return
+	}
 
 	badTokenFile, err := ioutil.TempFile(os.TempDir(), "opa-aws-test-")
 	if err != nil {
 		t.Errorf("Error while creating token file: %s", err)
 		return
 	}
-	defer os.Remove(badTokenFile.Name())
-	badTokenFile.WriteString("bad-token")
-	badTokenFile.Close()
+	t.Cleanup(func() {
+		err := os.Remove(badTokenFile.Name())
+		if err != nil {
+			t.Fatalf("unable to remove badTokenFile %q: %v", badTokenFile.Name(), err)
+		}
+	})
+	_, err = badTokenFile.WriteString("bad-token")
+	if err != nil {
+		t.Errorf("Error while creating token file: %s", err)
+		return
+	}
+	err = badTokenFile.Close()
+	if err != nil {
+		t.Errorf("Error while creating token file: %s", err)
+		return
+	}
 
 	// wrong path: no AWS_ROLE_ARN set
 	err = cs.populateFromEnv()
@@ -680,7 +710,7 @@ func (t *stsTestServer) handle(w http.ResponseWriter, r *http.Request) {
 
 	if r.URL.Query().Get("RoleArn") == "BrokenRole" {
 		w.WriteHeader(200)
-		w.Write([]byte("{}"))
+		_, _ = w.Write([]byte("{}"))
 		return
 	}
 
@@ -715,7 +745,7 @@ func (t *stsTestServer) handle(w http.ResponseWriter, r *http.Request) {
 	</ResponseMetadata>
   </AssumeRoleWithWebIdentityResponse>`
 
-	w.Write([]byte(fmt.Sprintf(xmlResponse, sessionName, time.Now().Add(time.Hour).Format(time.RFC3339), t.accessKey)))
+	_, _ = w.Write([]byte(fmt.Sprintf(xmlResponse, sessionName, time.Now().Add(time.Hour).Format(time.RFC3339), t.accessKey)))
 }
 
 func (t *stsTestServer) start() {

plugins/rest/gcp_test.go

@@ -14,9 +14,7 @@ import (
 func TestGCPMetadataAuthPlugin(t *testing.T) {
 	idToken := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.Et9HFtf9R3GEMA0IICOfFMVXY7kkTX1wr4qCyhIf58U"
 
-	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		return
-	}))
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
 	defer s.Close()
 
 	ts := httptest.NewServer(http.Handler(&gcpMetadataHandler{idToken}))

plugins/rest/rest.go

@@ -23,6 +23,9 @@ import (
 
 const (
 	defaultResponseHeaderTimeoutSeconds = int64(10)
+
+	grantTypeClientCredentials = "client_credentials"
+	grantTypeJwtBearer         = "jwt_bearer"
 )
 
 // An HTTPAuthPlugin represents a mechanism to construct and configure HTTP authentication for a REST service
@@ -37,7 +40,7 @@ type Config struct {
 	Name                         string            `json:"name"`
 	URL                          string            `json:"url"`
 	Headers                      map[string]string `json:"headers"`
-	AllowInsureTLS               bool              `json:"allow_insecure_tls,omitempty"`
+	AllowInsecureTLS             bool              `json:"allow_insecure_tls,omitempty"`
 	ResponseHeaderTimeoutSeconds *int64            `json:"response_header_timeout_seconds,omitempty"`
 	Credentials                  struct {
 		Bearer      *bearerAuthPlugin                  `json:"bearer,omitempty"`