Add new linter: gci (#498)

.golangci.yml

@@ -4,6 +4,8 @@ run:
   deadline: 5m
 issues:
   new-from-rev: ""
+skip-files:
+  - cron/data/request.pb.go # autogenerated
 linters:
   disable-all: true
   enable:
@@ -16,6 +18,7 @@ linters:
     - errcheck
     - exhaustive
     - exportloopref
+    - gci
     - gochecknoinits
     - gocognit
     - goconst
@@ -71,6 +74,8 @@ linters-settings:
       - BUG
       - FIXME
       - HACK
+  gci:
+    local-prefixes: github.com/ossf/scorecard
   gocritic:
     enabled-checks:
       # Diagnostic

checker/check_runner.go

@@ -20,9 +20,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ossf/scorecard/stats"
 	opencensusstats "go.opencensus.io/stats"
 	"go.opencensus.io/tag"
+
+	"github.com/ossf/scorecard/stats"
 )
 
 const checkRetries = 3

checks/active.go

@@ -18,6 +18,7 @@ import (
 	"time"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/branch_protected.go

@@ -16,6 +16,7 @@ package checks
 
 import (
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/branch_protected_test.go

@@ -19,6 +19,7 @@ import (
 	"testing"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/ci_tests.go

@@ -19,6 +19,7 @@ import (
 	"strings"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/code_review.go

@@ -19,6 +19,7 @@ import (
 	"strings"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/contributors.go

@@ -18,6 +18,7 @@ import (
 	"strings"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/frozen_deps.go

@@ -21,8 +21,9 @@ import (
 	"strings"
 
 	"github.com/moby/buildkit/frontend/dockerfile/parser"
-	"github.com/ossf/scorecard/checker"
 	"gopkg.in/yaml.v2"
+
+	"github.com/ossf/scorecard/checker"
 )
 
 const frozenDepsStr = "Frozen-Deps"

checks/fuzzing.go

@@ -18,6 +18,7 @@ import (
 	"fmt"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/packaging.go

@@ -20,6 +20,7 @@ import (
 	"strings"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/pull_requests.go

@@ -18,6 +18,7 @@ import (
 	"strings"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/sast.go

@@ -18,6 +18,7 @@ import (
 	"errors"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/signed_releases.go

@@ -19,6 +19,7 @@ import (
 	"strings"
 
 	"github.com/google/go-github/v32/github"
+
 	"github.com/ossf/scorecard/checker"
 )
 

checks/signed_tags.go

@@ -17,8 +17,9 @@ package checks
 import (
 	"errors"
 
-	"github.com/ossf/scorecard/checker"
 	"github.com/shurcooL/githubv4"
+
+	"github.com/ossf/scorecard/checker"
 )
 
 const (

cmd/root.go

@@ -18,6 +18,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	goflag "flag"
 	"fmt"
 	"log"
 	"net/http"
@@ -26,17 +27,16 @@ import (
 	"strings"
 	"time"
 
-	goflag "flag"
-
 	"github.com/google/go-github/v32/github"
+	"github.com/shurcooL/githubv4"
+	"github.com/spf13/cobra"
+	"go.uber.org/zap"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 	"github.com/ossf/scorecard/pkg"
 	"github.com/ossf/scorecard/repos"
 	"github.com/ossf/scorecard/roundtripper"
-	"github.com/shurcooL/githubv4"
-	"github.com/spf13/cobra"
-	"go.uber.org/zap"
 )
 
 var (

cmd/serve.go

@@ -23,13 +23,14 @@ import (
 	"strings"
 
 	"github.com/google/go-github/v32/github"
+	"github.com/shurcooL/githubv4"
+	"github.com/spf13/cobra"
+	"go.uber.org/zap"
+
 	"github.com/ossf/scorecard/checks"
 	"github.com/ossf/scorecard/pkg"
 	"github.com/ossf/scorecard/repos"
 	"github.com/ossf/scorecard/roundtripper"
-	"github.com/shurcooL/githubv4"
-	"github.com/spf13/cobra"
-	"go.uber.org/zap"
 )
 
 //nolint:gochecknoinits

cron/bq/transfer.go

@@ -20,6 +20,7 @@ import (
 	"log"
 
 	"cloud.google.com/go/bigquery"
+
 	"github.com/ossf/scorecard/cron/config"
 )
 

cron/config/config.go

@@ -15,7 +15,9 @@
 package config
 
 import (
-	_ "embed" // Used to embed config.yaml
+
+	// Used to embed config.yaml.
+	_ "embed"
 	"errors"
 	"fmt"
 	"os"

cron/controller/main.go

@@ -20,10 +20,11 @@ import (
 	"strconv"
 	"time"
 
+	"google.golang.org/protobuf/types/known/timestamppb"
+
 	"github.com/ossf/scorecard/cron/config"
 	"github.com/ossf/scorecard/cron/data"
 	"github.com/ossf/scorecard/cron/pubsub"
-	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 func PublishToRepoRequestTopic(ctx context.Context, iter data.Iterator, datetime time.Time) (int32, error) {

cron/data/blob.go

@@ -19,9 +19,12 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/ossf/scorecard/cron/config"
 	"gocloud.dev/blob"
-	_ "gocloud.dev/blob/gcsblob" // Needed to link in GCP drivers.
+
+	// Needed to link in GCP drivers.
+	_ "gocloud.dev/blob/gcsblob"
+
+	"github.com/ossf/scorecard/cron/config"
 )
 
 const (

cron/data/iterator.go

@@ -22,6 +22,7 @@ import (
 	"io"
 
 	"github.com/jszwec/csvutil"
+
 	"github.com/ossf/scorecard/repos"
 )
 

cron/main.go

@@ -28,6 +28,10 @@ import (
 	"contrib.go.opencensus.io/exporter/stackdriver"
 	"github.com/google/go-github/v32/github"
 	"github.com/jszwec/csvutil"
+	"github.com/shurcooL/githubv4"
+	"go.opencensus.io/stats/view"
+	"go.uber.org/zap"
+
 	"github.com/ossf/scorecard/checks"
 	"github.com/ossf/scorecard/cron/bq"
 	"github.com/ossf/scorecard/cron/monitoring"
@@ -35,9 +39,6 @@ import (
 	"github.com/ossf/scorecard/repos"
 	"github.com/ossf/scorecard/roundtripper"
 	"github.com/ossf/scorecard/stats"
-	"github.com/shurcooL/githubv4"
-	"go.opencensus.io/stats/view"
-	"go.uber.org/zap"
 )
 
 type Repository struct {

cron/monitoring/exporter.go

@@ -18,6 +18,7 @@ import (
 	"fmt"
 
 	"contrib.go.opencensus.io/exporter/stackdriver"
+
 	"github.com/ossf/scorecard/cron/config"
 )
 

cron/pubsub/publisher.go

@@ -22,10 +22,13 @@ import (
 	"sync"
 	"sync/atomic"
 
-	"github.com/ossf/scorecard/cron/data"
 	"gocloud.dev/pubsub"
-	_ "gocloud.dev/pubsub/gcppubsub" // Needed to link in GCP drivers.
+
+	// Needed to link in GCP drivers.
+	_ "gocloud.dev/pubsub/gcppubsub"
 	"google.golang.org/protobuf/encoding/protojson"
+
+	"github.com/ossf/scorecard/cron/data"
 )
 
 var errorPublish = errors.New("total errors when publishing")

cron/pubsub/publisher_test.go

@@ -19,8 +19,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/ossf/scorecard/cron/data"
 	"gocloud.dev/pubsub"
+
+	"github.com/ossf/scorecard/cron/data"
 )
 
 type mockSucceedTopic struct{}

cron/pubsub/subscriber.go

@@ -19,10 +19,13 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/ossf/scorecard/cron/data"
 	"gocloud.dev/pubsub"
-	_ "gocloud.dev/pubsub/gcppubsub" // Needed to link in GCP drivers.
+
+	// Needed to link in GCP drivers.
+	_ "gocloud.dev/pubsub/gcppubsub"
 	"google.golang.org/protobuf/encoding/protojson"
+
+	"github.com/ossf/scorecard/cron/data"
 )
 
 var ErrorInParse = errors.New("error during protojson.Unmarshal")

cron/pubsub/subscriber_test.go

@@ -19,10 +19,11 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/ossf/scorecard/cron/data"
 	"gocloud.dev/pubsub"
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/proto"
+
+	"github.com/ossf/scorecard/cron/data"
 )
 
 type mockReceiver struct {

cron/worker/main.go

@@ -24,6 +24,9 @@ import (
 	"sync"
 
 	"github.com/google/go-github/v32/github"
+	"github.com/shurcooL/githubv4"
+	"go.uber.org/zap"
+
 	"github.com/ossf/scorecard/checks"
 	"github.com/ossf/scorecard/cron/config"
 	"github.com/ossf/scorecard/cron/data"
@@ -31,8 +34,6 @@ import (
 	"github.com/ossf/scorecard/pkg"
 	"github.com/ossf/scorecard/repos"
 	"github.com/ossf/scorecard/roundtripper"
-	"github.com/shurcooL/githubv4"
-	"go.uber.org/zap"
 )
 
 func processRequest(ctx context.Context,

e2e/active_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/blob_test.go

@@ -20,6 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/roundtripper"
 )
 

e2e/branchprotection_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/ci_tests_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/cii_best_practices_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/code_review_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/contributors_test.go

@@ -20,6 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/e2e_suite_test.go

@@ -24,9 +24,10 @@ import (
 	"github.com/google/go-github/v32/github"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
-	"github.com/ossf/scorecard/roundtripper"
 	"github.com/shurcooL/githubv4"
 	"go.uber.org/zap"
+
+	"github.com/ossf/scorecard/roundtripper"
 )
 
 var (

e2e/frozen_deps_test.go

@@ -20,6 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/fuzzing_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/packaging_test.go

@@ -20,6 +20,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/pull_requests_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/sast_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/security_policy_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

e2e/signedreleases_test.go

@@ -19,6 +19,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/checks"
 )

gitcache/e2e/e2e_bucketcache_test.go

@@ -18,6 +18,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/gitcache/pkg"
 )
 

gitcache/e2e/e2e_http_test.go

@@ -21,6 +21,7 @@ import (
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
+
 	"github.com/ossf/scorecard/gitcache/pkg"
 )
 

gitcache/main.go

@@ -21,8 +21,9 @@ import (
 	"net/http"
 	"os"
 
-	"github.com/ossf/scorecard/gitcache/pkg"
 	"go.uber.org/zap"
+
+	"github.com/ossf/scorecard/gitcache/pkg"
 )
 
 type cache struct {

pkg/scorecard.go

@@ -21,9 +21,10 @@ import (
 	"time"
 
 	"github.com/google/go-github/v32/github"
+	"github.com/shurcooL/githubv4"
+
 	"github.com/ossf/scorecard/checker"
 	"github.com/ossf/scorecard/repos"
-	"github.com/shurcooL/githubv4"
 )
 
 func runEnabledChecks(ctx context.Context,

roundtripper/census.go

@@ -18,10 +18,11 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/ossf/scorecard/stats"
 	"go.opencensus.io/plugin/ochttp"
 	opencensusstats "go.opencensus.io/stats"
 	"go.opencensus.io/tag"
+
+	"github.com/ossf/scorecard/stats"
 )
 
 func MakeCensusTransport(innerTransport http.RoundTripper) http.RoundTripper {

roundtripper/rate_limit.go

@@ -20,11 +20,12 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/ossf/scorecard/stats"
 	"github.com/pkg/errors"
 	opencensusstats "go.opencensus.io/stats"
 	"go.opencensus.io/tag"
 	"go.uber.org/zap"
+
+	"github.com/ossf/scorecard/stats"
 )
 
 func MakeRateLimitedTransport(innerTransport http.RoundTripper, logger *zap.SugaredLogger) http.RoundTripper {