Blocking stdlib packages

[jawnsy]

Dear maintainer,

Thanks so much for your excellent linter! We have been using it via golangci-lint and it works great :smile:

gomodguard does not seem to be able to block io/ioutil in the same way that it can for other modules. Since that package is deprecated, it would be nice to be able to prevent its use.

I tried using a simple config:

blocked:
  modules:
    - io/ioutil:
        recommendations:
          - io
          - os
        reason: >-
          io/ioutil is deprecated as of Go 1.16. For more information, see
          https://golang.org/doc/go1.16#ioutil

However, this doesn't seem to work:

[coder@jawnsy-m m]$ head -n5 ./product/coder/pkg/avatar/generate_test.go
package avatar

import (
        "io/ioutil"
        "os"
[coder@jawnsy-m m]$ gomodguard ./product/coder/pkg/avatar/generate_test.go 
info: allowed modules, []
info: allowed module domains, []
info: blocked modules, [io/ioutil]
info: blocked modules with version constraints, []

Is it possible to block stdlib packages like ioutil using gomodguard?

[ryancurrah]

Hrm yeah stdlib is not part of this linter because they are not modules. It could be added in.

[abustany]

An alternative solution is to use depguard for stdlib dependencies (and keep modguard for modules listed in go.mod), here is a sample config for forbidding usage of the ioutil package:

linters-settings:
  depguard:
    list-type: blacklist
    include-go-root: true # to check stdlib packages as well
    packages-with-error-message:
      - io/ioutil: "io/ioutil was deprecated in Go 1.16: https://tip.golang.org/doc/go1.16#ioutil"

[ryancurrah]

Since this linter is for modules, not internal packages I am going to close this.