Add gosimports linter

.golangci.yaml

@@ -19,7 +19,6 @@ linters:
     - gocritic
     - gocyclo
     - gofmt
-    - goimports
     - goprintffuncname
     - gosec
     - gosimple
@@ -46,6 +45,7 @@ linters:
 #    - godot
 #    - godox
 #    - goerr113
+#    - goimports   # we're using gosimports now instead to account for extra whitespaces (see https://github.com/golang/go/issues/20818)
 #    - golint      # deprecated
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives

Makefile

@@ -5,6 +5,7 @@ COVER_REPORT = $(RESULTSDIR)/cover.report
 COVER_TOTAL = $(RESULTSDIR)/cover.total
 LICENSES_REPORT = $(RESULTSDIR)/licenses.json
 LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout 5m --config .golangci.yaml
+GOIMPORTS_CMD = $(TEMPDIR)/gosimports -local github.com/anchore
 RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
 VERSION=$(shell git describe --dirty --always --tags)
@@ -93,6 +94,8 @@ bootstrap-tools: $(TEMPDIR)
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
+	# the only difference between goimports and gosimports is that gosimports removes extra whitespace between import blocks (see https://github.com/golang/go/issues/20818)
+	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/rinchsan/gosimports/cmd/gosimports@v0.1.5
 	.github/scripts/goreleaser-install.sh -b $(TEMPDIR)/ v1.4.1
 
 .PHONY: bootstrap-go
@@ -115,6 +118,7 @@ lint: ## Run gofmt + golangci lint checks
 
 	# run all golangci-lint rules
 	$(LINTCMD)
+	@[ -z "$(shell $(GOIMPORTS_CMD) -d .)" ] || (echo "goimports needs to be fixed" && false)
 
 	# go tooling does not play well with certain filename characters, ensure the common cases don't result in future "go get" failures
 	$(eval MALFORMED_FILENAMES := $(shell find . | grep -e ':'))
@@ -124,6 +128,7 @@ lint: ## Run gofmt + golangci lint checks
 lint-fix: ## Auto-format all source code + run golangci lint fixers
 	$(call title,Running lint fixers)
 	gofmt -w -s .
+	$(GOIMPORTS_CMD) -w .
 	$(LINTCMD) --fix
 	go mod tidy
 

cmd/cmd.go

@@ -6,17 +6,18 @@ import (
 	"os"
 	"sort"
 
+	"github.com/gookit/color"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/grype/grype"
 	"github.com/anchore/grype/internal/config"
 	"github.com/anchore/grype/internal/log"
 	"github.com/anchore/grype/internal/logger"
 	"github.com/anchore/grype/internal/version"
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/syft"
-	"github.com/gookit/color"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
 )
 
 var (

cmd/completion.go

@@ -8,7 +8,6 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/client"
-
 	"github.com/spf13/cobra"
 )
 

cmd/db_check.go

@@ -3,8 +3,9 @@ package cmd
 import (
 	"fmt"
 
-	"github.com/anchore/grype/grype/db"
 	"github.com/spf13/cobra"
+
+	"github.com/anchore/grype/grype/db"
 )
 
 var dbCheckCmd = &cobra.Command{

cmd/db_delete.go

@@ -3,8 +3,9 @@ package cmd
 import (
 	"fmt"
 
-	"github.com/anchore/grype/grype/db"
 	"github.com/spf13/cobra"
+
+	"github.com/anchore/grype/grype/db"
 )
 
 var dbDeleteCmd = &cobra.Command{

cmd/db_import.go

@@ -3,10 +3,10 @@ package cmd
 import (
 	"fmt"
 
-	"github.com/anchore/grype/internal"
+	"github.com/spf13/cobra"
 
 	"github.com/anchore/grype/grype/db"
-	"github.com/spf13/cobra"
+	"github.com/anchore/grype/internal"
 )
 
 var dbImportCmd = &cobra.Command{

cmd/db_list.go

@@ -5,8 +5,9 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/anchore/grype/grype/db"
 	"github.com/spf13/cobra"
+
+	"github.com/anchore/grype/grype/db"
 )
 
 var dbListOutputFormat string

cmd/db_status.go

@@ -3,9 +3,9 @@ package cmd
 import (
 	"fmt"
 
-	"github.com/anchore/grype/grype/db"
-
 	"github.com/spf13/cobra"
+
+	"github.com/anchore/grype/grype/db"
 )
 
 var statusCmd = &cobra.Command{

cmd/db_update.go

@@ -3,8 +3,9 @@ package cmd
 import (
 	"fmt"
 
-	"github.com/anchore/grype/grype/db"
 	"github.com/spf13/cobra"
+
+	"github.com/anchore/grype/grype/db"
 )
 
 var dbUpdateCmd = &cobra.Command{

cmd/event_loop.go

@@ -5,10 +5,11 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/anchore/grype/internal/log"
-	"github.com/anchore/grype/internal/ui"
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/grype/internal/log"
+	"github.com/anchore/grype/internal/ui"
 )
 
 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and

cmd/event_loop_test.go

@@ -7,11 +7,12 @@ import (
 	"testing"
 	"time"
 
-	"github.com/anchore/grype/grype/event"
-	"github.com/anchore/grype/internal/ui"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/grype/grype/event"
+	"github.com/anchore/grype/internal/ui"
 )
 
 var _ ui.UI = (*uiMock)(nil)

cmd/root.go

@@ -5,8 +5,15 @@ import (
 	"os"
 	"sync"
 
+	"github.com/pkg/profile"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/spf13/viper"
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/grype/grype"
 	"github.com/anchore/grype/grype/db"
+	grypeDb "github.com/anchore/grype/grype/db/v3"
 	"github.com/anchore/grype/grype/event"
 	"github.com/anchore/grype/grype/grypeerr"
 	"github.com/anchore/grype/grype/match"
@@ -22,13 +29,6 @@ import (
 	"github.com/anchore/grype/internal/version"
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/syft/source"
-	"github.com/pkg/profile"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
-
-	grypeDb "github.com/anchore/grype/grype/db/v3"
 )
 
 var persistentOpts = config.CliOnlyOptions{}

cmd/version.go

@@ -5,10 +5,11 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/spf13/cobra"
+
 	"github.com/anchore/grype/grype/vulnerability"
 	"github.com/anchore/grype/internal"
 	"github.com/anchore/grype/internal/version"
-	"github.com/spf13/cobra"
 )
 
 var versionOutputFormat string

grype/cpe/cpe_test.go

@@ -3,9 +3,9 @@ package cpe
 import (
 	"testing"
 
-	"github.com/anchore/syft/syft/pkg"
-
 	"github.com/sergi/go-diff/diffmatchpatch"
+
+	"github.com/anchore/syft/syft/pkg"
 )
 
 func must(c pkg.CPE, e error) pkg.CPE {

grype/db/curator.go

@@ -9,17 +9,18 @@ import (
 	"path"
 	"strconv"
 
+	"github.com/hashicorp/go-cleanhttp"
+	"github.com/spf13/afero"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
 	grypeDB "github.com/anchore/grype/grype/db/v3"
 	"github.com/anchore/grype/grype/db/v3/reader"
 	"github.com/anchore/grype/grype/event"
 	"github.com/anchore/grype/grype/vulnerability"
 	"github.com/anchore/grype/internal/bus"
 	"github.com/anchore/grype/internal/file"
 	"github.com/anchore/grype/internal/log"
-	"github.com/hashicorp/go-cleanhttp"
-	"github.com/spf13/afero"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
 )
 
 const (

grype/db/curator_test.go

@@ -15,13 +15,14 @@ import (
 	"testing"
 	"time"
 
-	"github.com/anchore/grype/internal"
-	"github.com/anchore/grype/internal/file"
 	"github.com/gookit/color"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/wagoodman/go-progress"
+
+	"github.com/anchore/grype/internal"
+	"github.com/anchore/grype/internal/file"
 )
 
 type testGetter struct {

grype/db/listing_entry.go

@@ -9,8 +9,9 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/anchore/grype/internal/file"
 	"github.com/spf13/afero"
+
+	"github.com/anchore/grype/internal/file"
 )
 
 // ListingEntry represents basic metadata about a database archive such as what is in the archive (built/version)

grype/db/listing_test.go

@@ -5,9 +5,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/anchore/go-version"
 	"github.com/go-test/deep"
 	"github.com/spf13/afero"
+
+	"github.com/anchore/go-version"
 )
 
 func mustUrl(u *url.URL, err error) *url.URL {

grype/db/metadata.go

@@ -7,9 +7,10 @@ import (
 	"path"
 	"time"
 
+	"github.com/spf13/afero"
+
 	"github.com/anchore/grype/internal/file"
 	"github.com/anchore/grype/internal/log"
-	"github.com/spf13/afero"
 )
 
 const MetadataFileName = "metadata.json"

grype/db/v1/reader/reader.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 
 	"github.com/alicebob/sqlittle"
+
 	v1 "github.com/anchore/grype/grype/db/v1"
 	"github.com/anchore/grype/grype/db/v1/model"
 )

grype/db/v1/writer/writer.go

@@ -4,14 +4,13 @@ import (
 	"fmt"
 	"sort"
 
-	v1 "github.com/anchore/grype/grype/db/v1"
-	"github.com/anchore/grype/grype/db/v1/model"
-	"github.com/anchore/grype/internal"
 	"github.com/go-test/deep"
 	"github.com/jinzhu/gorm"
+	_ "github.com/jinzhu/gorm/dialects/sqlite" // provide the sqlite dialect to gorm via import
 
-	// provide the sqlite dialect to gorm via import
-	_ "github.com/jinzhu/gorm/dialects/sqlite"
+	v1 "github.com/anchore/grype/grype/db/v1"
+	"github.com/anchore/grype/grype/db/v1/model"
+	"github.com/anchore/grype/internal"
 )
 
 // Writer holds an instance of the database connection

grype/db/v1/writer/writer_test.go

@@ -6,10 +6,11 @@ import (
 	"testing"
 	"time"
 
+	"github.com/go-test/deep"
+
 	v1 "github.com/anchore/grype/grype/db/v1"
 	"github.com/anchore/grype/grype/db/v1/model"
 	"github.com/anchore/grype/grype/db/v1/reader"
-	"github.com/go-test/deep"
 )
 
 func assertIDReader(t *testing.T, reader v1.IDReader, expected v1.ID) {

grype/db/v2/reader/reader.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 
 	"github.com/alicebob/sqlittle"
+
 	v2 "github.com/anchore/grype/grype/db/v2"
 	"github.com/anchore/grype/grype/db/v2/model"
 )

grype/db/v2/writer/writer.go

@@ -4,14 +4,13 @@ import (
 	"fmt"
 	"sort"
 
-	v2 "github.com/anchore/grype/grype/db/v2"
-	"github.com/anchore/grype/grype/db/v2/model"
-	"github.com/anchore/grype/internal"
 	"github.com/go-test/deep"
 	"github.com/jinzhu/gorm"
+	_ "github.com/jinzhu/gorm/dialects/sqlite" // provide the sqlite dialect to gorm via import
 
-	// provide the sqlite dialect to gorm via import
-	_ "github.com/jinzhu/gorm/dialects/sqlite"
+	v2 "github.com/anchore/grype/grype/db/v2"
+	"github.com/anchore/grype/grype/db/v2/model"
+	"github.com/anchore/grype/internal"
 )
 
 // Writer holds an instance of the database connection

grype/db/v2/writer/writer_test.go

@@ -6,10 +6,11 @@ import (
 	"testing"
 	"time"
 
+	"github.com/go-test/deep"
+
 	v2 "github.com/anchore/grype/grype/db/v2"
 	"github.com/anchore/grype/grype/db/v2/model"
 	"github.com/anchore/grype/grype/db/v2/reader"
-	"github.com/go-test/deep"
 )
 
 func assertIDReader(t *testing.T, reader v2.IDReader, expected v2.ID) {