Fix build in CI

saschagrunert · k8s-ci-robot · commit bcff570021ce · 2025-08-18T02:17:09.000-07:00
Signed-off-by: Sascha Grunert &lt;sgrunert@redhat.com&gt;
diff --git a/.golangci.yml b/.golangci.yml
@@ -5,6 +5,7 @@ run:
 linters:
   default: none
   enable:
+    - arangolint
     - asasalint
     - asciicheck
     - bidichk
@@ -59,7 +60,6 @@ linters:
     - nilnesserr
     - nilnil
     - nlreturn
-    - noctx
     - nolintlint
     - nosprintfhostport
     - paralleltest
@@ -89,10 +89,11 @@ linters:
     - usetesting
     - wastedassign
     - whitespace
-    - wsl
+    - wsl_v5
     - zerologlint
     # - cyclop
     # - depguard
+    # - embeddedstructfieldcheck
     # - err113
     # - exhaustruct
     # - forbidigo
@@ -105,6 +106,8 @@ linters:
     # - ireturn
     # - maintidx
     # - mnd
+    # - noctx
+    # - noinlineerr
     # - nonamedreturns
     # - testpackage
     # - varnamelen
@@ -136,6 +139,10 @@ linters:
       rules:
         - name: unused-parameter
           disabled: true
+    wsl_v5:
+      allow-first-in-block: true
+      allow-whole-block: false
+      branch-max-lines: 2
   exclusions:
     generated: lax
     presets:
diff --git a/Makefile b/Makefile
@@ -14,7 +14,7 @@
 
 GO ?= go
 
-GOLANGCI_LINT_VERSION = v2.1.6
+GOLANGCI_LINT_VERSION = v2.4.0
 REPO_INFRA_VERSION = v0.2.5
 KUSTOMIZE_VERSION = 5.5.0
 OPERATOR_SDK_VERSION ?= v1.37.0
diff --git a/dependencies.yaml b/dependencies.yaml
@@ -1,6 +1,6 @@
 dependencies:
   - name: golangci-lint
-    version: 2.1.6
+    version: 2.4.0
     refPaths:
     - path: Makefile
       match: GOLANGCI_LINT_VERSION
@@ -115,6 +115,12 @@ dependencies:
     - path: hack/install-libbpf.sh
       match: VERSION
 
+  - name: libelf
+    version: 0.193
+    refPaths:
+    - path: hack/install-libelf.sh
+      match: VERSION
+
   - name: debian-vmlinux
     version: trixie
     refPaths:
@@ -174,11 +180,6 @@ dependencies:
       match: llvmPackages_\d+.clang-unwrapped
     - path: nix/derivation-bpf.nix
       match: llvm_\d+
-
-  # TODO: update to the latest clang of debian 12 packages are available.
-  - name: clang-debian-12
-    version: 16
-    refPaths:
     - path: hack/pull-security-profiles-operator-verify
       match: CLANG_VERSION
 
diff --git a/hack/install-libelf.sh b/hack/install-libelf.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Copyright 2025 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+# TODO: remove this script once the debian image (via golang:1.25 or higher) ships
+# the fixed libelf version.
+#
+apt-get install -y \
+    bzip2 \
+    m4 \
+    zlib1g-dev
+
+VERSION=0.193
+curl -sSfL --retry 5 --retry-delay 3 \
+    "https://sourceware.org/elfutils/ftp/$VERSION/elfutils-$VERSION.tar.bz2" -o- |
+    tar xfj -
+
+DIR="elfutils-$VERSION"
+trap 'rm -rf -- "$DIR"' EXIT
+
+pushd "$DIR"
+./configure --prefix=/usr
+make install -j8
+popd
diff --git a/hack/install-packages b/hack/install-packages
@@ -5,8 +5,8 @@ set -euo pipefail
 apt-get update
 apt-get install -y \
     libapparmor-dev \
-    libelf-dev \
     libseccomp-dev \
     libzstd-dev
 
+./hack/install-libelf.sh
 ./hack/install-libbpf.sh
diff --git a/hack/pull-security-profiles-operator-verify b/hack/pull-security-profiles-operator-verify
@@ -3,8 +3,8 @@ set -euo pipefail
 
 ./hack/install-packages
 
-CLANG_VERSION=16
-apt-get install -y software-properties-common
+CLANG_VERSION=18
+apt-get install -y lsb-release
 curl -sSfL --retry 5 --retry-delay 3 https://apt.llvm.org/llvm.sh | bash -s -- $CLANG_VERSION all
 ln -sf /usr/bin/clang-format-$CLANG_VERSION /usr/bin/clang-format
 
diff --git a/internal/pkg/bimap/bimap.go b/internal/pkg/bimap/bimap.go
@@ -76,6 +76,7 @@ func (m *BiMap[K, V]) ExistsBackwards(v V) bool {
 func (m *BiMap[K, V]) Get(k K) (V, bool) {
 	m.l.RLock()
 	defer m.l.RUnlock()
+
 	v, ok := m.forward[k]
 
 	return v, ok
@@ -85,6 +86,7 @@ func (m *BiMap[K, V]) Get(k K) (V, bool) {
 func (m *BiMap[K, V]) GetBackwards(v V) (K, bool) {
 	m.l.RLock()
 	defer m.l.RUnlock()
+
 	k, ok := m.backward[v]
 
 	return k, ok
@@ -99,6 +101,7 @@ func (m *BiMap[K, V]) Delete(k K) {
 
 	m.l.Lock()
 	defer m.l.Unlock()
+
 	delete(m.forward, k)
 	delete(m.backward, v)
 }
@@ -112,6 +115,7 @@ func (m *BiMap[K, V]) DeleteBackwards(v V) {
 
 	m.l.Lock()
 	defer m.l.Unlock()
+
 	delete(m.forward, k)
 	delete(m.backward, v)
 }
diff --git a/internal/pkg/cli/runner/runner_test.go b/internal/pkg/cli/runner/runner_test.go
@@ -300,6 +300,7 @@ func TestStartEnricher(t *testing.T) {
 			sut.impl = mock
 
 			go sut.startEnricher()
+
 			assert(mock, lineChan)
 		})
 	}
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
@@ -613,6 +613,7 @@ func (b *BpfRecorder) loadPrograms(programNames []string) error {
 func (b *BpfRecorder) StartRecording() (err error) {
 	b.attachUnattachMutex.Lock()
 	defer b.attachUnattachMutex.Unlock()
+
 	b.logger.Info("Start BPF recording...")
 
 	if b.module == nil {
@@ -650,6 +651,7 @@ func (b *BpfRecorder) StartRecording() (err error) {
 func (b *BpfRecorder) StopRecording() error {
 	b.attachUnattachMutex.Lock()
 	defer b.attachUnattachMutex.Unlock()
+
 	b.logger.Info("Stop BPF recording: Detaching all programs...")
 
 	if err := b.UpdateValue(b.isRecordingBpfMap, 0, []byte{1}); err != nil {
@@ -868,6 +870,7 @@ func (b *BpfRecorder) handleExitEvent(exitEvent *bpfEvent) {
 
 		return
 	}
+
 	select {
 	case <-done:
 		// already closed
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder_apparmor.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder_apparmor.go
@@ -142,8 +142,10 @@ func (b *AppArmorRecorder) StartRecording(r *BpfRecorder) error {
 func (b *AppArmorRecorder) StopRecording(r *BpfRecorder) error {
 	b.lockRecordedSocketsUse.Lock()
 	defer b.lockRecordedSocketsUse.Unlock()
+
 	b.lockRecordedCapabilities.Lock()
 	defer b.lockRecordedCapabilities.Unlock()
+
 	b.lockRecordedFiles.Lock()
 	defer b.lockRecordedFiles.Unlock()
 
@@ -239,8 +241,10 @@ func (b *AppArmorRecorder) handleCapabilityEvent(capEvent *bpfEvent) {
 func (b *AppArmorRecorder) clearMntns(event *bpfEvent) {
 	b.lockRecordedFiles.Lock()
 	defer b.lockRecordedFiles.Unlock()
+
 	b.lockRecordedCapabilities.Lock()
 	defer b.lockRecordedCapabilities.Unlock()
+
 	b.lockRecordedSocketsUse.Lock()
 	defer b.lockRecordedSocketsUse.Unlock()
 
@@ -254,8 +258,10 @@ func (b *AppArmorRecorder) clearMntns(event *bpfEvent) {
 func (b *AppArmorRecorder) GetKnownMntns() []mntnsID {
 	b.lockRecordedFiles.Lock()
 	defer b.lockRecordedFiles.Unlock()
+
 	b.lockRecordedCapabilities.Lock()
 	defer b.lockRecordedCapabilities.Unlock()
+
 	b.lockRecordedSocketsUse.Lock()
 	defer b.lockRecordedSocketsUse.Unlock()
 
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go
@@ -872,6 +872,7 @@ func TestProcessEvents(t *testing.T) {
 	sut.impl = mock
 
 	var buf bytes.Buffer
+
 	err := binary.Write(&buf, binary.LittleEndian, bpfEvent{
 		Pid:   42,
 		Mntns: 0x1010,
@@ -881,6 +882,7 @@ func TestProcessEvents(t *testing.T) {
 
 	ch := make(chan []byte, 1)
 	ch <- buf.Bytes()
+
 	close(ch)
 
 	go sut.processEvents(ch)
diff --git a/internal/pkg/daemon/enricher/auditsource/audit.go b/internal/pkg/daemon/enricher/auditsource/audit.go
@@ -61,6 +61,7 @@ func (a *AuditdSource) StartTail() (log chan *types.AuditLine, err error) {
 	}
 
 	log = make(chan *types.AuditLine, 32)
+
 	go func() {
 		for l := range a.file.Lines {
 			line := l.Text
diff --git a/internal/pkg/daemon/enricher/auditsource/bpf.go b/internal/pkg/daemon/enricher/auditsource/bpf.go
@@ -92,6 +92,7 @@ func (b *BpfSource) StartTail() (chan *types.AuditLine, error) {
 	buf.Poll(300)
 
 	log := make(chan *types.AuditLine)
+
 	go func() {
 		for val := range events {
 			if len(val) < 14 {
diff --git a/internal/pkg/daemon/enricher/enricher.go b/internal/pkg/daemon/enricher/enricher.go
@@ -148,6 +148,7 @@ func (e *Enricher) Run() error {
 	}
 
 	e.logger.Info(fmt.Sprintf("Setting up caches with expiry of %v", defaultCacheTimeout))
+
 	go e.containerIDCache.Start()
 	go e.infoCache.Start()
 	go e.auditLineCache.Start()
diff --git a/internal/pkg/daemon/enricher/jsonenricher.go b/internal/pkg/daemon/enricher/jsonenricher.go
@@ -190,6 +190,7 @@ func (e *JsonEnricher) Run(ctx context.Context, runErr chan<- error) {
 	if nodeName == "" {
 		err := fmt.Errorf("%s environment variable not set", config.NodeNameEnvKey)
 		e.logger.Error(err, "unable to run enricher")
+
 		runErr <- err
 
 		return
@@ -501,6 +502,7 @@ func (e *JsonEnricher) dispatchSeccompLine(
 
 	auditLogOutputMutex.Lock()
 	defer auditLogOutputMutex.Unlock()
+
 	e.PrintJsonOutput(e.logWriter, string(auditJson))
 }
 
diff --git a/internal/pkg/daemon/profilerecorder/profilerecorder.go b/internal/pkg/daemon/profilerecorder/profilerecorder.go
@@ -363,6 +363,7 @@ func (r *RecorderReconciler) startBpfRecorder(ctx context.Context) error {
 
 	ctx, cancel = context.WithTimeout(ctx, reconcileTimeout)
 	defer cancel()
+
 	r.log.Info("Starting BPF recorder on node")
 
 	return r.StartBpfRecorder(ctx, recorderClient)
@@ -377,6 +378,7 @@ func (r *RecorderReconciler) stopBpfRecorder(ctx context.Context) error {
 
 	ctx, cancel2 := context.WithTimeout(ctx, reconcileTimeout)
 	defer cancel2()
+
 	r.log.Info("Stopping BPF recorder on node")
 
 	return r.StopBpfRecorder(ctx, recorderClient)
diff --git a/internal/pkg/daemon/seccompprofile/seccompprofile.go b/internal/pkg/daemon/seccompprofile/seccompprofile.go
@@ -503,7 +503,6 @@ func (r *Reconciler) reconcileSeccompProfile(
 
 	// The object is not being deleted
 	exists, existErr := nodeStatus.Exists(ctx)
-
 	if existErr != nil {
 		return reconcile.Result{}, fmt.Errorf("checking if node status exists: %w", existErr)
 	}
diff --git a/internal/pkg/daemon/selinuxprofile/common_controller.go b/internal/pkg/daemon/selinuxprofile/common_controller.go
@@ -179,7 +179,6 @@ func (r *ReconcileSelinux) Reconcile(ctx context.Context, request reconcile.Requ
 	if instance.GetDeletionTimestamp().IsZero() {
 		// The object is not being deleted
 		exists, existErr := nodeStatus.Exists(ctx)
-
 		if existErr != nil {
 			return reconcile.Result{}, fmt.Errorf("checking if node status exists: %w", existErr)
 		}
diff --git a/internal/pkg/manager/spod/spod_controller.go b/internal/pkg/manager/spod/spod_controller.go
@@ -461,7 +461,6 @@ func (r *ReconcileSPOd) handleUpdate(
 		foundProfile := &seccompprofileapi.SeccompProfile{}
 
 		var err error
-
 		if err = r.client.Get(ctx, pKey, foundProfile); err == nil {
 			updatedProfile := foundProfile.DeepCopy()
 			updatedProfile.Spec = *profile.Spec.DeepCopy()
diff --git a/internal/pkg/util/retries.go b/internal/pkg/util/retries.go
@@ -56,7 +56,6 @@ func RetryEx(backoff *wait.Backoff, fn func() error, retryCondition func(error)
 
 		return false, fmt.Errorf("retry function: %w", err)
 	})
-
 	if waitErr != nil {
 		return fmt.Errorf("wait on retry: %w", waitErr)
 	}
diff --git a/internal/pkg/version/version.go b/internal/pkg/version/version.go
@@ -57,6 +57,7 @@ func Get() (*Info, error) {
 	}
 
 	const unknown = "unknown"
+
 	gitCommit := unknown
 	gitTreeState := "clean"
 	gitCommitDate := unknown
@@ -119,6 +120,7 @@ func (i *Info) String() string {
 	b := strings.Builder{}
 
 	const padding = 2
+
 	w := tabwriter.NewWriter(&b, 0, 0, padding, ' ', 0)
 
 	v := reflect.ValueOf(*i)
@@ -138,6 +140,7 @@ func (i *Info) String() string {
 			// Only expecting []string here; ignore other slices.
 			if s, ok := value.Interface().([]string); ok {
 				const sep = "\n  "
+
 				valueString = sep + strings.Join(s, sep)
 			}
 
diff --git a/test/spoc/e2e_spoc_test.go b/test/spoc/e2e_spoc_test.go
@@ -270,6 +270,7 @@ func recordAppArmorTest(t *testing.T) {
 		require.NoError(t, err)
 
 		var stdout bytes.Buffer
+
 		cmd.Stdout = &stdout
 
 		// Start recorder and wait for it to set itself up.
diff --git a/test/suite_test.go b/test/suite_test.go
diff --git a/test/tc_allowed_syscalls_test.go b/test/tc_allowed_syscalls_test.go
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
diff --git a/test/tc_bpf_recorder_test.go b/test/tc_bpf_recorder_test.go
diff --git a/test/tc_delete_profiles_test.go b/test/tc_delete_profiles_test.go
diff --git a/test/tc_json_enricher_test.go b/test/tc_json_enricher_test.go
diff --git a/test/tc_log_enricher_test.go b/test/tc_log_enricher_test.go
diff --git a/test/tc_metrics_test.go b/test/tc_metrics_test.go
diff --git a/test/tc_profilerecordings_test.go b/test/tc_profilerecordings_test.go
diff --git a/test/tc_seccomp_profilebindings_test.go b/test/tc_seccomp_profilebindings_test.go

Original file line number	Diff line number	Diff line change
`@@ -300,6 +300,7 @@ func TestStartEnricher(t *testing.T) {`
`300`	`300`	`sut.impl = mock`
`301`	`301`
`302`	`302`	`go sut.startEnricher()`
	`303`	`+`
`303`	`304`	`assert(mock, lineChan)`
`304`	`305`	`})`
`305`	`306`	`}`