Enforce no subprocess policy (prometheus#2926)

Add depguard to golangci-lint to enforce the no-os/exec policy. Signed-off-by: Ben Kochie <superq@gmail.com>
gitperr · Apr 30, 2024 · 1698bab · 1698bab
1 parent 554a546
commit 1698bab
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/.golangci.yml b/.golangci.yml
@@ -1,5 +1,6 @@
 linters:
   enable:
+    - depguard
     - misspell
     - revive
   disable:
@@ -19,6 +20,14 @@ issues:
         - errcheck
 
 linters-settings:
+  depguard:
+    rules:
+      no_exec_policy:
+        files:
+          - "!$test"
+        deny:
+          - pkg: "os/exec"
+            desc: "Using os/exec to run sub processes it not allowed by policy"
   errcheck:
     exclude-functions:
       # Used in HTTP handlers, any error is handled by the server itself.