A better way to install and run golangci-lint in a single command

[ysmood]

Currently, the major way to install golangci-lint requires extra dependencies like sh, curl, tar, etc. It's not cross-platform and not user friendly to maintain.

Since any user use this tool will have golang installed, why not just use golang to do the automation job? So that there will be zero dependencies and assumptions for users' environment.

Here's my demo solution project: https://github.com/ysmood/golangci-lint The demo project has zero dependencies and fast to download, build, and run.

How about we fork the project to a namespace like golangci/golangci-linter and document it here

So that we don't have to maintain Brew or MacPorts binary anymore.

[boring-cyborg[bot]]

Hey, thank you for opening your first Issue ! 🙂 If you would like to contribute we have a guide for contributors.

[sfllaw]

This reminds me of go get golang.org/dl/go1.xx.x, which is how you can install multiple versions of Go: https://golang.org/doc/manage-install

[ysmood]

This reminds me of go get golang.org/dl/go1.xx.x, which is how you can install multiple versions of Go: https://golang.org/doc/manage-install

Yes, I borrowed some ideas from it.

[pellared]

What about installing golangci-lint using the new go install syntax like this:

go install github.com/golangci/golangci-lint/cmd/[email protected]

This way is (I believe) truly cross-platform and can be used e.g. like this: https://github.com/pellared/goyek-demo/blob/e51b9211be1155cbf1cca40d8f1eb392e6dda592/build/build.go#L41-L46

It does not have some of the disadvantages that go get has. Also installing via go get may be removed in Go 1.17: https://github.com/golang/go/issues/43684

References

From: https://golang.org/ref/mod

Since Go 1.16, go install is the recommended command for building and installing programs. When used with a version suffix (like @latest or @v1.4.6), go install builds packages in module-aware mode, ignoring the go.mod file in the current directory or any parent directory, if there is one.

More:

• https://golang.org/ref/mod#go-install
• https://github.com/golang/go/issues/40276

[ysmood]

@pellared The problem is to build the golangci-lint might consume a lot of network bandwidth and CPU, and it has its own Makefile which is outside the Go ecosystem, which means if you don't use their Makefile, they can't guarantee it will work properly.

I tested with bare docker container, it will be significantly slower to use go install vs downloading the binary directly:

With go install

$ docker run --rm -it golang bash
$ time go install github.com/golangci/golangci-lint/cmd/[email protected]
real    0m46.282s

With my solution

$ docker run --rm -it golang bash
$ time go install github.com/ysmood/golangci-lint@latest
real    0m7.769s
$ time golangci-lint
real    0m1.330s

As you can see the go install is 5 times slower. If I use a faster machine, the difference can be 10 times.

[pellared]

@ysmood It is cool. Personally, I would add an option to add a checksum validation for additional integrity checking. Supply chain attacks are becoming more and more frequent.

[ysmood]

@pellared Good idea, please feel free to make a PR. Currently, this project is just a proof of concept, welcomes all kinds of ideas.

[photoszzt]

The current recommended approach is also documenting the tool used in a file called tools.go. https://github.com/go-modules-by-example/index/blob/master/010_tools/README.md

[ysmood]

@photoszzt I think it has the same issue because internally go install uses a similar build process as go get: