golang/go: conventions kept by review, written down

golang/go has no lint config and no workflows; reviewers keep its conventions. Written down as rules, they found a copyright line with stray text after it, 3 shell scripts without a license header and 2 comments with zero-width spaces pasted in. This config was written to test alint; the Go project doesn't use alint.

What alint found

.alint.yml

- id: go-bsd-license-header-go
  # fixed here: also allows the older notices the tree keeps
  kind: file_header
  paths:
    include: ["**/*.go", "**/*.s"]
    exclude:
      - "**/testdata/**"
      - "**/vendor/**"
      - "**/_*/**"
      - "src/runtime/_mkmalloc/**"
      - "test/**"
  pattern: '(// Copyright [0-9]{4}([-,][0-9]{4})* The Go Authors\. All rights reserved\.\n// Use of this source code is governed by a BSD-style\n// license that can be found in the LICENSE file\.|// Code generated |// DO NOT EDIT|// Generated using cgo|// (Derived from )?Inferno|// (created|Created) by cgo|// Original source:|// Based on cmd/internal/obj|// Copyright \(c\) [0-9]{4} The Go Authors|// cmd/[0-9a-z]+/|Copyright © [0-9]{4}|// Copyright [0-9]{4} Google Inc\.| \* Derived from:)'
  lines: 8
  level: warning

- id: go-bsd-license-header-shell
  kind: file_header
  paths:
    include: ["src/*.bash", "src/*.rc", "lib/**/*.bash", "**/*.sh"]
    exclude: ["**/testdata/**", "**/vendor/**"]
  pattern: '(?m)^# Copyright [0-9]{4} The Go Authors\. All rights reserved\.\n# Use of this source code is governed by a BSD-style\n# license that can be found in the LICENSE file\.'
  lines: 8
  level: error

⚠︎ warning go-bsd-license-header-go

The first line of src/cmd/compile/internal/walk/builtin.go reads "All rights reserved.walk/bui", with stray text after the copyright. The rule also flags src/internal/runtime/sys/empty.s, a one-line file with no header.

✗ error go-bsd-license-header-shell

Three shell scripts have no license header, among them misc/ios/clangwrap.sh and src/runtime/race/mkcgo.sh.

.alint.yml

extends:
  - alint://bundled/go@v1

✗ error go-sources-no-zero-width

Two comments contain zero-width spaces (U+200B): one in src/cmd/compile/internal/ssa/prove.go and one in a vendored copy of x/tools. Both look pasted in by accident.

The config

Reviewers keep these conventions: the BSD header on every source file, the * -text line in .gitattributes, the std and cmd modules with no module at the root, and the file names under doc/next/. The config writes them down, checks the FIPS 140 snapshot zips against their checksums, and carries the most important edges of deps_test.go as import_gate rules. It extends oss-baseline, go and hygiene/no-tracked-artifacts.

.alint.yml

- id: go-runtime-no-fmt-or-os
  # fixed here: leaves out the code generators, programs of their own
  # (//go:build ignore) or a package only they import
  kind: import_gate
  language: go
  paths:
    include:
      - "src/runtime/*.go"
      - "src/internal/runtime/**/*.go"
    exclude:
      - "**/*_test.go"
      - "**/testdata/**"
      - "src/runtime/mk*.go"
      - "src/runtime/wincallback.go"
      - "src/internal/runtime/gc/scan/mkasm.go"
      - "src/internal/runtime/gc/internal/gen/**"
  forbid: '^(fmt|os|reflect|net(/.*)?)$'
  level: error

One of the high-stakes edges in deps_test.go: the runtime may not import fmt, os, reflect or net. The full dependency graph stays in the test.

.alint.yml

- id: go-fips140-zip-digests-match-sum
  kind: pair_hash
  algorithm: sha256
  source: "lib/fips140/*.zip"
  target: "lib/fips140/fips140.sum"
  format: contains
  level: error

The header of lib/fips140/fips140.sum says its checksums must never change. pair_hash checks that each snapshot zip's SHA-256 is in it.

.alint.yml

- id: go-no-toplevel-go-mod
  kind: file_absent
  paths: "go.mod"
  level: error

golang/go isn't a module: the standard library and the tools are the std and cmd modules under src/.

What stays outside alint

Go's own tools keep what needs Go's syntax tree:

the API freeze in cmd/api, which reads the syntax tree for every supported platform;
the compiler's own tests, go vet and gofmt;
the full dependency graph in deps_test.go. An alint rule sees one file's imports at a time, not the transitive closure.