Linter Reporting Issues on External Module Files

[ryancurrah]

Welcome

• Yes, I'm using a binary release within 2 latest releases. Only such installations are supported.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've read the typecheck section of the FAQ.
• Yes, I've tried with the standalone linter if available (e.g., gocritic, go vet, etc.).
• I agree to follow this project's Code of Conduct

How did you install golangci-lint?

Brew

Description of the problem

We're experiencing an issue where golangci-lint reports findings from external module files (located in the Go module cache), causing integration with SonarQube to fail. Specifically, the staticcheck linter is reporting issues in files not belonging to our repository, such as:

../go/pkg/mod/github.com/itchyny/gojq@v0.12.14/query.go

This leads to errors in SonarQube since the referenced file paths do not exist in the repository.

While we'll raise an issue directly with staticcheck, it seems like a good idea for golangci-lint itself to safeguard against linters reporting issues in files outside the repository.

Version of golangci-lint

❯ golangci-lint --version
golangci-lint has version 2.1.2 built with go1.24.2 from 00a561d on 2025-04-15T13:16:26Z

Configuration

golangci-lint run --verbose --timeout 30m --output.checkstyle.path=golangci-checkstyle.xml --output.text.path=stdout  ./...

version: "2"
run:
  modules-download-mode: readonly

linters:
  enable:
    - staticcheck

Go environment

$ go version && go env
# paste output here

Verbose output of running

~/staticcheck-repro
❯ golangci-lint cache clean
~/staticcheck-repro                                                                                                                                                                                  
❯ golangci-lint run -v
INFO golangci-lint has version 2.1.2 built with go1.24.2 from 00a561d on 2025-04-15T13:16:26Z
INFO [config_reader] Config search paths: [./ /Users/rcurrah/staticcheck-repro /Users/rcurrah /Users /]
INFO [config_reader] Used config file .golangci.yml
INFO maxprocs: Leaving GOMAXPROCS=14: CPU quota undefined
INFO [goenv] Read go env for 11.152584ms: map[string]string{"GOCACHE":"/Users/rcurrah/Library/Caches/go-build", "GOROOT":"/Users/rcurrah/.go/current"}
INFO [lintersdb] Active 5 linters: [errcheck govet ineffassign staticcheck unused]
INFO [loader] Go packages loading at mode 8767 (compiled_files|exports_file|imports|deps|files|name|types_sizes) took 237.147875ms
INFO [runner/filename_unadjuster] Pre-built 0 adjustments in 136.417µs
INFO [linters_context/goanalysis] analyzers took 898.344168ms with top 10 stages: buildir: 622.697337ms, ctrlflow: 37.093372ms, SA5012: 36.582161ms, fact_deprecated: 35.113296ms, printf: 35.059955ms, fact_purity: 34.720544ms, nilness: 33.435045ms, typedness: 31.178ms, inspect: 27.291206ms, tokenfileanalyzer: 1.743328ms
INFO [runner] Issues before processing: 3, after processing: 2
INFO [runner] Processors filtering stat (in/out): path_shortener: 2/2, path_prettifier: 2/2, path_absoluter: 3/3, max_same_issues: 2/2, sort_results: 2/2, max_per_file_from_linter: 2/2, invalid_issue: 3/3, path_relativity: 3/3, exclusion_paths: 3/3, generated_file_filter: 3/3, uniq_by_line: 3/2, severity-rules: 2/2, filename_unadjuster: 3/3, diff: 3/3, fixer: 3/3, max_from_linter: 2/2, cgo: 3/3, exclusion_rules: 3/3, nolint_filter: 3/3, source_code: 2/2
INFO [runner] processing took 602.582µs with stages: nolint_filter: 490.792µs, generated_file_filter: 51.584µs, source_code: 42.417µs, cgo: 7.792µs, path_relativity: 2.499µs, uniq_by_line: 1.584µs, invalid_issue: 1.041µs, max_same_issues: 1µs, sort_results: 1µs, path_shortener: 666ns, max_from_linter: 375ns, path_absoluter: 292ns, max_per_file_from_linter: 291ns, exclusion_rules: 291ns, filename_unadjuster: 250ns, fixer: 208ns, path_prettifier: 167ns, diff: 125ns, exclusion_paths: 125ns, severity-rules: 83ns
INFO [runner] linters took 501.213459ms with stages: goanalysis_metalinter: 500.571584ms
../go/pkg/mod/github.com/itchyny/gojq@v0.12.14/query.go:24:17: SA4023(related information): (*github.com/itchyny/gojq.Query).Run never returns a nil interface value (staticcheck)
func (e *Query) Run(v any) Iter {
                ^
main.go:16:31: SA4023: this comparison is always true (staticcheck)
	if iter := query.Run(input); iter != nil {
	                             ^
2 issues:
* staticcheck: 2
INFO File cache stats: 2 entries of total size 19.7KiB
INFO Memory: 9 samples, avg is 147.2MB, max is 261.2MB
INFO Execution took 749.978291ms

A minimal reproducible example or link to a public repository

See repository for repro.

git clone https://github.com/ryancurrah/staticcheck-repro
cd staticcheck-repro
golangci-lint run -v

Validation

• Yes, I've included all information above (version, config, etc.).

Supporter

• I am a sponsor/backer through GitHub or OpenCollective

[ldez]

This is expected because this is what staticcheck do:

$ docker run --rm -it golang:1.24-alpine sh
/go # apk add -q git curl
/go # cd ~
~ # git clone -q https://github.com/ryancurrah/staticcheck-repro
~ # cd staticcheck-repro/
~/staticcheck-repro # go mod tidy
go: downloading github.com/itchyny/gojq v0.12.14
go: downloading github.com/itchyny/timefmt-go v0.1.5
~/staticcheck-repro # curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.1.1
golangci/golangci-lint info checking GitHub for tag 'v2.1.1'
golangci/golangci-lint info found version: 2.1.1 for v2.1.1/linux/amd64
golangci/golangci-lint info installed /go/bin/golangci-lint
~/staticcheck-repro # golangci-lint run
../../go/pkg/mod/github.com/itchyny/gojq@v0.12.14/query.go:24:17: SA4023(related information): (*github.com/itchyny/gojq.Query).Run never returns a nil interface value (staticcheck)
func (e *Query) Run(v any) Iter {
                ^
main.go:16:31: SA4023: this comparison is always true (staticcheck)
        if iter := query.Run(input); iter != nil {
                                     ^
2 issues:
* staticcheck: 2
~/staticcheck-repro # go install honnef.co/go/tools/cmd/staticcheck@v0.6.1
go: downloading honnef.co/go/tools v0.6.1
go: downloading golang.org/x/tools v0.30.0
go: downloading github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c
go: downloading golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678
go: downloading golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa
go: downloading golang.org/x/sync v0.11.0
go: downloading golang.org/x/mod v0.23.0
~/staticcheck-repro # staticcheck ./...
main.go:16:31: this comparison is always true (SA4023)
        main.go:16:13: the lhs of the comparison is the 1st return value of this function call
        /go/pkg/mod/github.com/itchyny/gojq@v0.12.14/query.go:24:1: (*github.com/itchyny/gojq.Query).Run never returns a nil interface value
~/staticcheck-repro # 

[ryancurrah]

If a linter is reporting issues on files the are not apart of the repository thats an issue with that linter, but golangi-lint should not report lint issues on files that do not exist in the repository. That's not a good experience and as in our case silently prevented us from reporting issues on a repository.

[ldez]

🤔 This is "related information", I need to check but either golangci-lint should ignore all "related information" or it should be reported in the same position as the diagnostic.

[ldez]

I created a PR #5746

[ryancurrah]

Thanks for the fix, very much appreciated. Should also open a issue with staticcheck?

[ldez]

No, this is not a staticcheck bug, it's a pure golangci-lint bug.

Inside golangci-lint, we convert "related information" into issues; staticcheck doesn't do that.
The way that staticcheck displays "related information" is right.