golangci-lint: v2 upgrade

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

.golangci.yml

@@ -1,18 +1,15 @@
+version: "2"
 run:
-  timeout: 30m
   modules-download-mode: vendor
-
 linters:
+  default: none
   enable:
     - bodyclose
     - depguard
     - errname
     - forbidigo
     - gocritic
-    - gofmt
-    - goimports
     - gosec
-    - gosimple
     - govet
     - importas
     - ineffassign
@@ -23,105 +20,107 @@ linters:
     - revive
     - staticcheck
     - testifylint
-    - typecheck
     - unused
     - whitespace
-  disable-all: true
-
-linters-settings:
-  staticcheck:
-    checks:
-      - "all"
-  gocritic:
-    disabled-checks:
-      - "ifElseChain"
-      - "assignOp"
-      - "appendAssign"
-      - "singleCaseSwitch"
-  govet:
-    enable:
-      - nilness
-      - unusedwrite
-  # enable-all: true
-  # disable:
-  #   - fieldalignment
-  #   - shadow
-  depguard:
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: github.com/containerd/containerd/errdefs
+              desc: The containerd errdefs package was migrated to a separate module. Use github.com/containerd/errdefs instead.
+            - pkg: github.com/containerd/containerd/log
+              desc: The containerd log package was migrated to a separate module. Use github.com/containerd/log instead.
+            - pkg: github.com/containerd/containerd/pkg/userns
+              desc: Use github.com/moby/sys/userns instead.
+            - pkg: github.com/containerd/containerd/platforms
+              desc: The containerd platforms package was migrated to a separate module. Use github.com/containerd/platforms instead.
+            - pkg: github.com/containerd/nydus-snapshotter/pkg/errdefs
+              desc: You probably meant to use github.com/containerd/errdefs
+            - pkg: github.com/opencontainers/runc/libcontainer/userns
+              desc: Use github.com/moby/sys/userns instead.
+            - pkg: io/ioutil
+              desc: The io/ioutil package has been deprecated.
+    forbidigo:
+      forbid:
+        - pattern: ^context\.WithCancel(# use context\.WithCancelCause instead)?$
+        - pattern: ^context\.WithDeadline(# use context\.WithDeadline instead)?$
+        - pattern: ^context\.WithTimeout(# use context\.WithTimeoutCause instead)?$
+        - pattern: ^ctx\.Err(# use context\.Cause instead)?$
+        - pattern: ^fmt\.Errorf(# use errors\.Errorf instead)?$
+        - pattern: ^logrus\.(Trace|Debug|Info|Warn|Warning|Error|Fatal)(f|ln)?(# use bklog\.G or bklog\.L instead of logrus directly)?$
+        - pattern: ^platforms\.DefaultString(# use platforms\.Format(platforms\.DefaultSpec()) instead\. Be aware that DefaultSpec is for the local platform, so must be avoided when working cross-platform)?$
+    gocritic:
+      disabled-checks:
+        - ifElseChain
+        - assignOp
+        - appendAssign
+        - singleCaseSwitch
+    gosec:
+      excludes:
+        - G101
+        - G402
+        - G504
+        - G601
+        - G115
+      config:
+        G306: "0644"
+    govet:
+      enable:
+        - nilness
+        - unusedwrite
+    importas:
+      alias:
+        - pkg: github.com/containerd/errdefs
+          alias: cerrdefs
+        - pkg: github.com/opencontainers/image-spec/specs-go/v1
+          alias: ocispecs
+        - pkg: github.com/opencontainers/go-digest
+          alias: digest
+      no-unaliased: true
+    staticcheck:
+      checks:
+        - all
+    testifylint:
+      disable:
+        - empty
+        - bool-compare
+        - len
+        - negative-positive
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
     rules:
-      main:
-        deny:
-          - pkg: "github.com/containerd/containerd/errdefs"
-            desc: The containerd errdefs package was migrated to a separate module. Use github.com/containerd/errdefs instead.
-          - pkg: "github.com/containerd/containerd/log"
-            desc: The containerd log package was migrated to a separate module. Use github.com/containerd/log instead.
-          - pkg: "github.com/containerd/containerd/pkg/userns"
-            desc: Use github.com/moby/sys/userns instead.
-          - pkg: "github.com/containerd/containerd/platforms"
-            desc: The containerd platforms package was migrated to a separate module. Use github.com/containerd/platforms instead.
-          - pkg: "github.com/containerd/nydus-snapshotter/pkg/errdefs"
-            desc: You probably meant to use github.com/containerd/errdefs
-          - pkg: "github.com/opencontainers/runc/libcontainer/userns"
-            desc: Use github.com/moby/sys/userns instead.
-          - pkg: "io/ioutil"
-            desc: The io/ioutil package has been deprecated.
-  forbidigo:
-    forbid:
-      - '^context\.WithCancel(# use context\.WithCancelCause instead)?$'
-      - '^context\.WithDeadline(# use context\.WithDeadline instead)?$'
-      - '^context\.WithTimeout(# use context\.WithTimeoutCause instead)?$'
-      - '^ctx\.Err(# use context\.Cause instead)?$'
-      - '^fmt\.Errorf(# use errors\.Errorf instead)?$'
-      - '^logrus\.(Trace|Debug|Info|Warn|Warning|Error|Fatal)(f|ln)?(# use bklog\.G or bklog\.L instead of logrus directly)?$'
-      - '^platforms\.DefaultString(# use platforms\.Format(platforms\.DefaultSpec()) instead\. Be aware that DefaultSpec is for the local platform, so must be avoided when working cross-platform)?$'
-  importas:
-    alias:
-      # Enforce alias to prevent it accidentally being used instead of our
-      # own errdefs package (or vice-versa).
-      - pkg: "github.com/containerd/errdefs"
-        alias: "cerrdefs"
-      - pkg: "github.com/opencontainers/image-spec/specs-go/v1"
-        alias: "ocispecs"
-      - pkg: "github.com/opencontainers/go-digest"
-        alias: "digest"
-
-    # Do not allow unaliased imports of aliased packages.
-    no-unaliased: true
-  gosec:
-    excludes:
-      - G101  # Potential hardcoded credentials (false positives)
-      - G402  # TLS MinVersion too low
-      - G504  # Import blocklist: net/http/cgi
-      - G601  # Implicit memory aliasing in for loop (false positives)
-      - G115  # integer overflow conversion (TODO: verify these)
-    config:
-      G306: "0644"
-  testifylint:
-    disable:
-      # disable rules that reduce the test condition
-      - "empty"
-      - "bool-compare"
-      - "len"
-      - "negative-positive"
-
-issues:
-  exclude-files:
-    - ".*\\.pb\\.go$"
-  exclude-rules:
-    - linters:
-        - revive
-      text: "stutters"
-    - linters:
-        - revive
-      text: "empty-block"
-    - linters:
-        - revive
-      text: "superfluous-else"
-    - linters:
-        - revive
-      text: "unused-parameter"
-    - linters:
-        - revive
-      text: "redefines-builtin-id"
-    - linters:
-        - revive
-      text: "if-return"
+      - linters:
+          - revive
+        text: stutters
+      - linters:
+          - revive
+        text: empty-block
+      - linters:
+          - revive
+        text: superfluous-else
+      - linters:
+          - revive
+        text: unused-parameter
+      - linters:
+          - revive
+        text: redefines-builtin-id
+      - linters:
+          - revive
+        text: if-return
+    paths:
+      - .*\.pb\.go$
+      - examples
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - .*\.pb\.go$

api/services/control/control_bench_test.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1 //nolint:revive
+package moby_buildkit_v1 //nolint:revive,staticcheck
 
 import (
 	"testing"

cache/contenthash/checksum.go

@@ -774,11 +774,11 @@ func splitWildcards(p string) (d1, d2 string) {
 
 func containsWildcards(name string) bool {
 	for i := 0; i < len(name); i++ {
-		ch := name[i]
-		if ch == '\\' {
-			i++
-		} else if ch == '*' || ch == '?' || ch == '[' {
+		switch name[i] {
+		case '*', '?', '[':
 			return true
+		case '\\':
+			i++
 		}
 	}
 	return false
@@ -887,10 +887,7 @@ func (cc *cacheContext) checksum(ctx context.Context, root *iradix.Node[*CacheRe
 		iter.SeekLowerBound(append(slices.Clone(next), 0))
 		subk := next
 		ok := true
-		for {
-			if !ok || !bytes.HasPrefix(subk, next) {
-				break
-			}
+		for ok && bytes.HasPrefix(subk, next) {
 			h.Write(bytes.TrimPrefix(subk, k))
 
 			// We do not follow trailing links when checksumming a directory's

cache/contenthash/filehash.go

@@ -93,7 +93,7 @@ type statInfo struct {
 }
 
 func (s *statInfo) Name() string {
-	return filepath.Base(s.Stat.Path)
+	return filepath.Base(s.Path)
 }
 
 func (s *statInfo) Size() int64 {

cache/manager.go

@@ -1427,10 +1427,7 @@ func (cm *cacheManager) DiskUsage(ctx context.Context, opt client.DiskUsageInfo)
 	}
 	cm.mu.Unlock()
 
-	for {
-		if len(rescan) == 0 {
-			break
-		}
+	for len(rescan) != 0 {
 		for id := range rescan {
 			v := m[id]
 			if v.refs == 0 {

cache/manager_test.go

@@ -1464,7 +1464,7 @@ func getCompressor(w io.Writer, compressionType compression.Type, customized boo
 	case compression.Gzip:
 		if customized {
 			gz, _ := gzip.NewWriterLevel(w, gzip.NoCompression)
-			gz.Header.Comment = "hello"
+			gz.Comment = "hello"
 			gz.Close()
 		}
 		return gzip.NewWriter(w), nil

cache/metadata.go

@@ -406,11 +406,11 @@ func (md *cacheMetadata) getLastUsed() (int, *time.Time) {
 	if v == nil {
 		return usageCount, nil
 	}
-	var lastUsedTs int64
-	if err := v.Unmarshal(&lastUsedTs); err != nil || lastUsedTs == 0 {
+	var lastUsedTS int64
+	if err := v.Unmarshal(&lastUsedTS); err != nil || lastUsedTS == 0 {
 		return usageCount, nil
 	}
-	tm := time.Unix(lastUsedTs/1e9, lastUsedTs%1e9)
+	tm := time.Unix(lastUsedTS/1e9, lastUsedTS%1e9)
 	return usageCount, &tm
 }
 

cache/opts.go

@@ -30,7 +30,7 @@ func descHandlersOf(opts ...RefOption) DescHandlers {
 
 type DescHandlerKey digest.Digest
 
-type NeedsRemoteProviderError []digest.Digest //nolint:errname
+type NeedsRemoteProviderError []digest.Digest
 
 func (m NeedsRemoteProviderError) Error() string {
 	return fmt.Sprintf("missing descriptor handlers for lazy blobs %+v", []digest.Digest(m))

cache/refs.go

@@ -188,7 +188,7 @@ func (p parentRefs) release(ctx context.Context) (rerr error) {
 	return rerr
 }
 
-func (p parentRefs) clone() parentRefs {
+func (p parentRefs) cloneParentRefs() parentRefs {
 	switch {
 	case p.layerParent != nil:
 		p.layerParent = p.layerParent.clone()
@@ -472,7 +472,7 @@ func (cr *cacheRecord) remove(ctx context.Context, removeSnapshot bool) (rerr er
 	if err := cr.cm.MetadataStore.Clear(cr.ID()); err != nil {
 		return errors.Wrapf(err, "failed to delete metadata of %s", cr.ID())
 	}
-	if err := cr.parentRefs.release(ctx); err != nil {
+	if err := cr.release(ctx); err != nil {
 		return errors.Wrapf(err, "failed to release parents of %s", cr.ID())
 	}
 	return nil
@@ -1479,7 +1479,7 @@ func (sr *mutableRef) commit() (_ *immutableRef, rerr error) {
 	rec := &cacheRecord{
 		mu:            sr.mu,
 		cm:            sr.cm,
-		parentRefs:    sr.parentRefs.clone(),
+		parentRefs:    sr.cloneParentRefs(),
 		equalMutable:  sr,
 		refs:          make(map[ref]struct{}),
 		cacheMetadata: md,

cache/remotecache/azblob/exporter.go

@@ -153,7 +153,7 @@ func (ce *exporter) uploadManifest(ctx context.Context, manifestKey string, read
 	blobClient := ce.containerClient.NewBlockBlobClient(manifestKey)
 
 	ctx, cnclFn := context.WithCancelCause(ctx)
-	ctx, _ = context.WithTimeoutCause(ctx, time.Minute*5, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, time.Minute*5, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer cnclFn(errors.WithStack(context.Canceled))
 
 	_, err := blobClient.Upload(ctx, reader, &blockblob.UploadOptions{})
@@ -171,7 +171,7 @@ func (ce *exporter) uploadBlobIfNotExists(ctx context.Context, blobKey string, r
 	blobClient := ce.containerClient.NewBlockBlobClient(blobKey)
 
 	uploadCtx, cnclFn := context.WithCancelCause(ctx)
-	uploadCtx, _ = context.WithTimeoutCause(uploadCtx, time.Minute*5, errors.WithStack(context.DeadlineExceeded))
+	uploadCtx, _ = context.WithTimeoutCause(uploadCtx, time.Minute*5, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer cnclFn(errors.WithStack(context.Canceled))
 
 	// Only upload if the blob doesn't exist

cache/remotecache/azblob/utils.go

@@ -138,7 +138,7 @@ func createContainerClient(ctx context.Context, config *Config) (*container.Clie
 	}
 
 	ctx, cnclFn := context.WithCancelCause(ctx)
-	ctx, _ = context.WithTimeoutCause(ctx, time.Second*60, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, time.Second*60, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer cnclFn(errors.WithStack(context.Canceled))
 
 	containerClient := client.ServiceClient().NewContainerClient(config.Container)
@@ -150,7 +150,7 @@ func createContainerClient(ctx context.Context, config *Config) (*container.Clie
 
 	if bloberror.HasCode(err, bloberror.ContainerNotFound) {
 		ctx, cnclFn := context.WithCancelCause(ctx)
-		ctx, _ = context.WithTimeoutCause(ctx, time.Minute*5, errors.WithStack(context.DeadlineExceeded))
+		ctx, _ = context.WithTimeoutCause(ctx, time.Minute*5, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 		defer cnclFn(errors.WithStack(context.Canceled))
 		_, err := containerClient.Create(ctx, &container.CreateOptions{})
 		if err != nil {
@@ -175,7 +175,7 @@ func blobKey(config *Config, digest digest.Digest) string {
 func blobExists(ctx context.Context, containerClient *container.Client, blobKey string) (bool, error) {
 	blobClient := containerClient.NewBlobClient(blobKey)
 	ctx, cnclFn := context.WithCancelCause(ctx)
-	ctx, _ = context.WithTimeoutCause(ctx, time.Second*60, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, time.Second*60, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer cnclFn(errors.WithStack(context.Canceled))
 	_, err := blobClient.GetProperties(ctx, &blob.GetPropertiesOptions{})
 	if err == nil {

cache/remotecache/local/local.go

@@ -106,7 +106,7 @@ func getContentStore(ctx context.Context, sm *session.Manager, g session.Group,
 		return nil, errors.New("local cache exporter/importer requires session")
 	}
 	timeoutCtx, cancel := context.WithCancelCause(ctx)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	caller, err := sm.Get(timeoutCtx, sessionID, false)

cache/remotecache/s3/s3.go

@@ -16,7 +16,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/containerd/containerd/v2/core/content"
 	"github.com/containerd/containerd/v2/pkg/labels"
@@ -546,7 +545,7 @@ func (s3Client *s3Client) touch(ctx context.Context, key string, size *int64) (e
 
 	var currentPartNumber int32 = 1
 	var currentPosition int64
-	var completedParts []types.CompletedPart
+	var completedParts []s3types.CompletedPart
 
 	for currentPosition < *size {
 		copyRange := buildCopySourceRange(currentPosition, *size)
@@ -564,7 +563,7 @@ func (s3Client *s3Client) touch(ctx context.Context, key string, size *int64) (e
 		}
 		partNumber := new(int32)
 		*partNumber = currentPartNumber
-		completedParts = append(completedParts, types.CompletedPart{
+		completedParts = append(completedParts, s3types.CompletedPart{
 			ETag:       uploadPartCopyResult.CopyPartResult.ETag,
 			PartNumber: partNumber,
 		})
@@ -577,7 +576,7 @@ func (s3Client *s3Client) touch(ctx context.Context, key string, size *int64) (e
 		Bucket:   &s3Client.bucket,
 		Key:      &key,
 		UploadId: output.UploadId,
-		MultipartUpload: &types.CompletedMultipartUpload{
+		MultipartUpload: &s3types.CompletedMultipartUpload{
 			Parts: completedParts,
 		},
 	}

cache/remotecache/v1/chains.go

@@ -226,10 +226,7 @@ func (c *item) LinkFrom(rec solver.CacheExporterRecord, index int, selector stri
 		return
 	}
 
-	for {
-		if index < len(c.links) {
-			break
-		}
+	for index >= len(c.links) {
 		c.links = append(c.links, map[link]struct{}{})
 	}
 

cache/remotecache/v1/chains_test.go

@@ -69,7 +69,7 @@ func TestSimpleMarshal(t *testing.T) {
 	cfg2, descPairs, err := cc.Marshal(context.TODO())
 	require.NoError(t, err)
 
-	require.EqualValues(t, cfg, cfg2)
+	require.Equal(t, cfg, cfg2)
 
 	// marshal roundtrip
 	dt, err := json.Marshal(cfg)
@@ -81,7 +81,7 @@ func TestSimpleMarshal(t *testing.T) {
 
 	cfg3, _, err := cc.Marshal(context.TODO())
 	require.NoError(t, err)
-	require.EqualValues(t, cfg, cfg3)
+	require.Equal(t, cfg, cfg3)
 
 	// add extra item
 	cc.Add(outputKey(dgst("bay"), 0))

client/build_test.go

@@ -1485,11 +1485,11 @@ func testClientGatewayExecError(t *testing.T, sb integration.Sandbox) {
 				require.Len(t, se.InputIDs, tt.NumMounts)
 				require.Len(t, se.MountIDs, tt.NumMounts)
 
-				op := se.Solve.Op
+				op := se.Op
 				require.NotNil(t, op)
 				require.NotNil(t, op.Op)
 
-				opExec, ok := se.Solve.Op.Op.(*pb.Op_Exec)
+				opExec, ok := se.Op.Op.(*pb.Op_Exec)
 				require.True(t, ok)
 
 				exec := opExec.Exec
@@ -1499,7 +1499,7 @@ func testClientGatewayExecError(t *testing.T, sb integration.Sandbox) {
 					mounts = append(mounts, client.Mount{
 						Selector:  mnt.Selector,
 						Dest:      mnt.Dest,
-						ResultID:  se.Solve.MountIDs[i],
+						ResultID:  se.MountIDs[i],
 						Readonly:  mnt.Readonly,
 						MountType: mnt.MountType,
 						CacheOpt:  mnt.CacheOpt,
@@ -1603,14 +1603,14 @@ func testClientGatewaySlowCacheExecError(t *testing.T, sb integration.Sandbox) {
 		var se *errdefs.SolveError
 		require.ErrorAs(t, solveErr, &se)
 
-		_, ok := se.Solve.Op.Op.(*pb.Op_Exec)
+		_, ok := se.Op.Op.(*pb.Op_Exec)
 		require.True(t, ok)
 
-		_, ok = se.Solve.Subject.(*errdefs.Solve_Cache)
+		_, ok = se.Subject.(*errdefs.Solve_Cache)
 		require.True(t, ok)
 		// Slow cache errors should only have exactly one input and no outputs.
-		require.Len(t, se.Solve.InputIDs, 1)
-		require.Len(t, se.Solve.MountIDs, 0)
+		require.Len(t, se.InputIDs, 1)
+		require.Len(t, se.MountIDs, 0)
 
 		st := llb.Image("busybox:latest")
 		def, err := st.Marshal(ctx)
@@ -1632,7 +1632,7 @@ func testClientGatewaySlowCacheExecError(t *testing.T, sb integration.Sandbox) {
 			}, {
 				Dest:      "/problem",
 				MountType: pb.MountType_BIND,
-				ResultID:  se.Solve.InputIDs[0],
+				ResultID:  se.InputIDs[0],
 			}},
 		})
 		require.NoError(t, err)
@@ -1735,15 +1735,15 @@ func testClientGatewayExecFileActionError(t *testing.T, sb integration.Sandbox)
 
 				var se *errdefs.SolveError
 				require.ErrorAs(t, err, &se)
-				require.Len(t, se.Solve.InputIDs, tt.NumInputs)
+				require.Len(t, se.InputIDs, tt.NumInputs)
 
 				// There is one output for every action in the fileop that failed.
-				require.Len(t, se.Solve.MountIDs, tt.NumOutputs)
+				require.Len(t, se.MountIDs, tt.NumOutputs)
 
-				op, ok := se.Solve.Op.Op.(*pb.Op_File)
+				op, ok := se.Op.Op.(*pb.Op_File)
 				require.True(t, ok)
 
-				subject, ok := se.Solve.Subject.(*errdefs.Solve_File)
+				subject, ok := se.Subject.(*errdefs.Solve_File)
 				require.True(t, ok)
 
 				// Retrieve the action that failed from the sbuject.

client/client_test.go

@@ -3332,7 +3332,7 @@ func testUser(t *testing.T, sb integration.Sandbox) {
 	dt, err = os.ReadFile(filepath.Join(destDir, "root_supplementary"))
 	require.NoError(t, err)
 	require.True(t, strings.HasPrefix(string(dt), "root "))
-	require.True(t, strings.Contains(string(dt), "wheel"))
+	require.Contains(t, string(dt), "wheel")
 
 	dt2, err := os.ReadFile(filepath.Join(destDir, "default_supplementary"))
 	require.NoError(t, err)
@@ -5249,7 +5249,7 @@ func testStargzLazyRegistryCacheImportExport(t *testing.T, sb integration.Sandbo
 	require.NoError(t, err)
 
 	require.Equal(t, dgst, dgst2)
-	require.EqualValues(t, unique, unique2)
+	require.Equal(t, unique, unique2)
 
 	// clear all local state out
 	err = imageService.Delete(ctx, img.Name, images.SynchronousDelete())
@@ -5569,7 +5569,7 @@ func testStargzLazyPull(t *testing.T, sb integration.Sandbox) {
 	require.NoError(t, err)
 
 	require.Equal(t, dgst, dgst2)
-	require.EqualValues(t, unique, unique2)
+	require.Equal(t, unique, unique2)
 
 	// clear all local state out
 	err = imageService.Delete(ctx, img.Name, images.SynchronousDelete())
@@ -6423,7 +6423,7 @@ func testBasicInlineCacheImportExport(t *testing.T, sb integration.Sandbox) {
 	// dgst2uncompress != dgst, because the compression type is different
 	unique2uncompress, err := readFileInImage(sb.Context(), t, c, target+"@"+dgst2uncompress, "/unique")
 	require.NoError(t, err)
-	require.EqualValues(t, unique, unique2uncompress)
+	require.Equal(t, unique, unique2uncompress)
 
 	ensurePruneAll(t, c, sb)
 
@@ -6454,7 +6454,7 @@ func testBasicInlineCacheImportExport(t *testing.T, sb integration.Sandbox) {
 	// dgst3 != dgst, because inline cache is not exported for dgst3
 	unique3, err := readFileInImage(sb.Context(), t, c, target+"@"+dgst3, "/unique")
 	require.NoError(t, err)
-	require.EqualValues(t, unique, unique3)
+	require.Equal(t, unique, unique3)
 }
 
 func testRegistryEmptyCacheExport(t *testing.T, sb integration.Sandbox) {
@@ -7932,7 +7932,7 @@ func testMergeOpCache(t *testing.T, sb integration.Sandbox, mode string) {
 			},
 		}}
 	default:
-		require.Fail(t, "unknown cache mode: %s", mode)
+		require.Fail(t, fmt.Sprintf("unknown cache mode: %s", mode))
 	}
 
 	_, err = c.Solve(sb.Context(), def, SolveOpt{
@@ -8061,7 +8061,7 @@ func testMergeOpCache(t *testing.T, sb integration.Sandbox, mode string) {
 			_, err = contentStore.Info(ctx, layer.Digest)
 			require.NoError(t, err)
 		default:
-			require.Fail(t, "unexpected layer index %d", i)
+			require.Fail(t, fmt.Sprintf("unexpected layer index %d", i))
 		}
 	}
 

client/connhelper/dockercontainer/dockercontainer_test.go

@@ -25,7 +25,7 @@ func TestSpecFromURL(t *testing.T) {
 		got, err := SpecFromURL(u)
 		if expected != nil {
 			require.NoError(t, err)
-			require.EqualValues(t, expected, got, s)
+			require.Equal(t, expected, got, s)
 		} else {
 			require.Error(t, err, s)
 		}

client/connhelper/kubepod/kubepod_test.go

@@ -31,7 +31,7 @@ func TestSpecFromURL(t *testing.T) {
 		got, err := SpecFromURL(u)
 		if expected != nil {
 			require.NoError(t, err)
-			require.EqualValues(t, expected, got, s)
+			require.Equal(t, expected, got, s)
 		} else {
 			require.Error(t, err, s)
 		}

client/connhelper/nerdctlcontainer/nerdctlcontainer_test.go

@@ -22,7 +22,7 @@ func TestSpecFromURL(t *testing.T) {
 		got, err := SpecFromURL(u)
 		if expected != nil {
 			require.NoError(t, err)
-			require.EqualValues(t, expected, got, s)
+			require.Equal(t, expected, got, s)
 		} else {
 			require.Error(t, err, s)
 		}

client/connhelper/podmancontainer/podmancontainer_test.go

@@ -22,7 +22,7 @@ func TestSpecFromURL(t *testing.T) {
 		got, err := SpecFromURL(u)
 		if expected != nil {
 			require.NoError(t, err)
-			require.EqualValues(t, expected, got, s)
+			require.Equal(t, expected, got, s)
 		} else {
 			require.Error(t, err, s)
 		}

client/connhelper/ssh/ssh_test.go

@@ -31,7 +31,7 @@ func TestSpecFromURL(t *testing.T) {
 		got, err := SpecFromURL(u)
 		if expected != nil {
 			require.NoError(t, err)
-			require.EqualValues(t, expected, got, s)
+			require.Equal(t, expected, got, s)
 		} else {
 			require.Error(t, err, s)
 		}

client/llb/source.go

@@ -136,7 +136,7 @@ func Image(ref string, opts ...ImageOption) State {
 	} else if info.metaResolver != nil {
 		if _, ok := r.(reference.Digested); ok || !info.resolveDigest {
 			return NewState(src.Output()).Async(func(ctx context.Context, st State, c *Constraints) (State, error) {
-				p := info.Constraints.Platform
+				p := info.Platform
 				if p == nil {
 					p = c.Platform
 				}
@@ -153,7 +153,7 @@ func Image(ref string, opts ...ImageOption) State {
 			})
 		}
 		return Scratch().Async(func(ctx context.Context, _ State, c *Constraints) (State, error) {
-			p := info.Constraints.Platform
+			p := info.Platform
 			if p == nil {
 				p = c.Platform
 			}

cmd/buildctl/build/exportcache_test.go

@@ -44,7 +44,7 @@ func TestParseExportCache(t *testing.T) {
 	for _, tc := range testCases {
 		ex, err := ParseExportCache(tc.exportCaches)
 		if tc.expectedErr == "" {
-			require.EqualValues(t, tc.expected, ex)
+			require.Equal(t, tc.expected, ex)
 		} else {
 			require.Error(t, err)
 			require.Contains(t, err.Error(), tc.expectedErr)

cmd/buildctl/build/importcache_test.go

@@ -98,7 +98,7 @@ func TestParseImportCache(t *testing.T) {
 	for _, tc := range testCases {
 		im, err := ParseImportCache(tc.importCaches)
 		if tc.expectedErr == "" {
-			require.EqualValues(t, tc.expected, im)
+			require.Equal(t, tc.expected, im)
 		} else {
 			require.Error(t, err)
 			require.Contains(t, err.Error(), tc.expectedErr)

cmd/buildctl/build/registryauthtlscontext_test.go

@@ -100,7 +100,7 @@ func TestParseRegistryAuthTLSContext(t *testing.T) {
 	for _, tc := range testCases {
 		im, err := ParseRegistryAuthTLSContext(tc.registryAuthTLSContext)
 		if tc.expectedErr == "" {
-			require.EqualValues(t, tc.expected, im)
+			require.Equal(t, tc.expected, im)
 		} else {
 			require.Error(t, err)
 			require.Contains(t, err.Error(), tc.expectedErr)

cmd/buildctl/common/common.go

@@ -74,7 +74,7 @@ func ResolveClient(c *cli.Context) (*client.Client, error) {
 	timeout := time.Duration(c.GlobalInt("timeout"))
 	if timeout > 0 {
 		ctx2, cancel := context.WithCancelCause(ctx)
-		ctx2, _ = context.WithTimeoutCause(ctx2, timeout*time.Second, errors.WithStack(context.DeadlineExceeded))
+		ctx2, _ = context.WithTimeoutCause(ctx2, timeout*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 		ctx = ctx2
 		defer func() { cancel(errors.WithStack(context.Canceled)) }()
 	}

cmd/buildkitd/main.go

@@ -610,7 +610,7 @@ func applyMainFlags(c *cli.Context, cfg *config.Config) error {
 			}
 			cfg.GRPC.SecurityDescriptor = secDescriptor
 		} else {
-			gid, err := groupToGid(group)
+			gid, err := groupToGID(group)
 			if err != nil {
 				return err
 			}
@@ -646,7 +646,7 @@ func applyMainFlags(c *cli.Context, cfg *config.Config) error {
 }
 
 // Convert a string containing either a group name or a stringified gid into a numeric id)
-func groupToGid(group string) (int, error) {
+func groupToGID(group string) (int, error) {
 	if group == "" {
 		return os.Getgid(), nil
 	}

cmd/buildkitd/main_containerd_worker.go

@@ -94,22 +94,22 @@ func init() {
 		cli.StringFlag{
 			Name:  "containerd-worker-net",
 			Usage: "worker network type (auto, bridge, cni or host)",
-			Value: defaultConf.Workers.Containerd.NetworkConfig.Mode,
+			Value: defaultConf.Workers.Containerd.Mode,
 		},
 		cli.StringFlag{
 			Name:  "containerd-cni-config-path",
 			Usage: "path of cni config file",
-			Value: defaultConf.Workers.Containerd.NetworkConfig.CNIConfigPath,
+			Value: defaultConf.Workers.Containerd.CNIConfigPath,
 		},
 		cli.StringFlag{
 			Name:  "containerd-cni-binary-dir",
 			Usage: "path of cni binary files",
-			Value: defaultConf.Workers.Containerd.NetworkConfig.CNIBinaryPath,
+			Value: defaultConf.Workers.Containerd.CNIBinaryPath,
 		},
 		cli.IntFlag{
 			Name:  "containerd-cni-pool-size",
 			Usage: "size of cni network namespace pool",
-			Value: defaultConf.Workers.Containerd.NetworkConfig.CNIPoolSize,
+			Value: defaultConf.Workers.Containerd.CNIPoolSize,
 		},
 		cli.StringFlag{
 			Name:  "containerd-worker-snapshotter",
@@ -238,16 +238,16 @@ func applyContainerdFlags(c *cli.Context, cfg *config.Config) error {
 	}
 
 	if c.GlobalIsSet("containerd-worker-net") {
-		cfg.Workers.Containerd.NetworkConfig.Mode = c.GlobalString("containerd-worker-net")
+		cfg.Workers.Containerd.Mode = c.GlobalString("containerd-worker-net")
 	}
 	if c.GlobalIsSet("containerd-cni-config-path") {
-		cfg.Workers.Containerd.NetworkConfig.CNIConfigPath = c.GlobalString("containerd-cni-config-path")
+		cfg.Workers.Containerd.CNIConfigPath = c.GlobalString("containerd-cni-config-path")
 	}
 	if c.GlobalIsSet("containerd-cni-pool-size") {
-		cfg.Workers.Containerd.NetworkConfig.CNIPoolSize = c.GlobalInt("containerd-cni-pool-size")
+		cfg.Workers.Containerd.CNIPoolSize = c.GlobalInt("containerd-cni-pool-size")
 	}
 	if c.GlobalIsSet("containerd-cni-binary-dir") {
-		cfg.Workers.Containerd.NetworkConfig.CNIBinaryPath = c.GlobalString("containerd-cni-binary-dir")
+		cfg.Workers.Containerd.CNIBinaryPath = c.GlobalString("containerd-cni-binary-dir")
 	}
 	if c.GlobalIsSet("containerd-worker-snapshotter") {
 		cfg.Workers.Containerd.Snapshotter = c.GlobalString("containerd-worker-snapshotter")
@@ -275,8 +275,8 @@ func containerdWorkerInitializer(c *cli.Context, common workerInitializerOpt) ([
 
 	if cfg.Rootless {
 		bklog.L.Debugf("running in rootless mode")
-		if common.config.Workers.Containerd.NetworkConfig.Mode == "auto" {
-			common.config.Workers.Containerd.NetworkConfig.Mode = "host"
+		if common.config.Workers.Containerd.Mode == "auto" {
+			common.config.Workers.Containerd.Mode = "host"
 		}
 	}
 
@@ -288,7 +288,7 @@ func containerdWorkerInitializer(c *cli.Context, common workerInitializerOpt) ([
 	}
 
 	nc := netproviders.Opt{
-		Mode: common.config.Workers.Containerd.NetworkConfig.Mode,
+		Mode: common.config.Workers.Containerd.Mode,
 		CNI: cniprovider.Opt{
 			Root:         common.config.Root,
 			ConfigPath:   common.config.Workers.Containerd.CNIConfigPath,

cmd/buildkitd/main_oci_worker.go

@@ -91,22 +91,22 @@ func init() {
 		cli.StringFlag{
 			Name:  "oci-worker-net",
 			Usage: "worker network type (auto, bridge, cni or host)",
-			Value: defaultConf.Workers.OCI.NetworkConfig.Mode,
+			Value: defaultConf.Workers.OCI.Mode,
 		},
 		cli.StringFlag{
 			Name:  "oci-cni-config-path",
 			Usage: "path of cni config file",
-			Value: defaultConf.Workers.OCI.NetworkConfig.CNIConfigPath,
+			Value: defaultConf.Workers.OCI.CNIConfigPath,
 		},
 		cli.StringFlag{
 			Name:  "oci-cni-binary-dir",
 			Usage: "path of cni binary files",
-			Value: defaultConf.Workers.OCI.NetworkConfig.CNIBinaryPath,
+			Value: defaultConf.Workers.OCI.CNIBinaryPath,
 		},
 		cli.IntFlag{
 			Name:  "oci-cni-pool-size",
 			Usage: "size of cni network namespace pool",
-			Value: defaultConf.Workers.OCI.NetworkConfig.CNIPoolSize,
+			Value: defaultConf.Workers.OCI.CNIPoolSize,
 		},
 		cli.StringFlag{
 			Name:  "oci-worker-binary",
@@ -229,16 +229,16 @@ func applyOCIFlags(c *cli.Context, cfg *config.Config) error {
 	}
 
 	if c.GlobalIsSet("oci-worker-net") {
-		cfg.Workers.OCI.NetworkConfig.Mode = c.GlobalString("oci-worker-net")
+		cfg.Workers.OCI.Mode = c.GlobalString("oci-worker-net")
 	}
 	if c.GlobalIsSet("oci-cni-config-path") {
-		cfg.Workers.OCI.NetworkConfig.CNIConfigPath = c.GlobalString("oci-cni-worker-path")
+		cfg.Workers.OCI.CNIConfigPath = c.GlobalString("oci-cni-worker-path")
 	}
 	if c.GlobalIsSet("oci-cni-binary-dir") {
-		cfg.Workers.OCI.NetworkConfig.CNIBinaryPath = c.GlobalString("oci-cni-binary-dir")
+		cfg.Workers.OCI.CNIBinaryPath = c.GlobalString("oci-cni-binary-dir")
 	}
 	if c.GlobalIsSet("oci-cni-pool-size") {
-		cfg.Workers.OCI.NetworkConfig.CNIPoolSize = c.GlobalInt("oci-cni-pool-size")
+		cfg.Workers.OCI.CNIPoolSize = c.GlobalInt("oci-cni-pool-size")
 	}
 	if c.GlobalIsSet("oci-worker-binary") {
 		cfg.Workers.OCI.Binary = c.GlobalString("oci-worker-binary")
@@ -281,8 +281,8 @@ func ociWorkerInitializer(c *cli.Context, common workerInitializerOpt) ([]worker
 
 	if cfg.Rootless {
 		bklog.L.Debugf("running in rootless mode")
-		if common.config.Workers.OCI.NetworkConfig.Mode == "auto" {
-			common.config.Workers.OCI.NetworkConfig.Mode = "host"
+		if common.config.Workers.OCI.Mode == "auto" {
+			common.config.Workers.OCI.Mode = "host"
 		}
 	}
 
@@ -303,7 +303,7 @@ func ociWorkerInitializer(c *cli.Context, common workerInitializerOpt) ([]worker
 	}
 
 	nc := netproviders.Opt{
-		Mode: common.config.Workers.OCI.NetworkConfig.Mode,
+		Mode: common.config.Workers.OCI.Mode,
 		CNI: cniprovider.Opt{
 			Root:         common.config.Root,
 			ConfigPath:   common.config.Workers.OCI.CNIConfigPath,

control/gateway/gateway.go

@@ -60,7 +60,7 @@ func (gwf *GatewayForwarder) lookupForwarder(ctx context.Context) (gateway.LLBBr
 	}
 
 	ctx, cancel := context.WithCancelCause(ctx)
-	ctx, _ = context.WithTimeoutCause(ctx, 3*time.Second, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, 3*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	go func() {

docker-bake.hcl

@@ -170,6 +170,7 @@ target "lint" {
   args = {
     TARGETNAME = buildtags.name
     BUILDTAGS = buildtags.tags
+    GOLANGCI_FROM_SOURCE = "true"
   }
   platforms = ( buildtags.target == "golangci-lint" || buildtags.name == "gopls" ) && GOLANGCI_LINT_MULTIPLATFORM != null ? [
     "freebsd/amd64",

examples/build-using-dockerfile/main.go

@@ -127,9 +127,10 @@ func action(clicontext *cli.Context) error {
 
 func newSolveOpt(clicontext *cli.Context, w io.WriteCloser) (*client.SolveOpt, error) {
 	buildCtx := clicontext.Args().First()
-	if buildCtx == "" {
+	switch buildCtx {
+	case "":
 		return nil, errors.New("please specify build context (e.g. \".\" for the current directory)")
-	} else if buildCtx == "-" {
+	case "-":
 		return nil, errors.New("stdin not supported yet")
 	}
 

executor/containerdexecutor/executor.go

@@ -399,7 +399,7 @@ func (w *containerdExecutor) runProcess(ctx context.Context, p ctd.Process, resi
 			ctxDone = nil
 			var killCtx context.Context
 			killCtx, cancel = context.WithCancelCause(context.Background())
-			killCtx, _ = context.WithTimeoutCause(killCtx, 10*time.Second, errors.WithStack(context.DeadlineExceeded))
+			killCtx, _ = context.WithTimeoutCause(killCtx, 10*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 			killCtxDone = killCtx.Done()
 			p.Kill(killCtx, syscall.SIGKILL)
 			io.Cancel()

executor/runcexecutor/executor.go

@@ -546,7 +546,7 @@ func (k procKiller) Kill(ctx context.Context) (err error) {
 	// this timeout is generally a no-op, the Kill ctx should already have a
 	// shorter timeout but here as a fail-safe for future refactoring.
 	ctx, cancel := context.WithCancelCause(ctx)
-	ctx, _ = context.WithTimeoutCause(ctx, 10*time.Second, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, 10*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	if k.pidfile == "" {
@@ -634,13 +634,13 @@ func runcProcessHandle(ctx context.Context, killer procKiller) (*procHandle, con
 		for {
 			select {
 			case <-ctx.Done():
-				killCtx, timeout := context.WithCancelCause(context.Background())
-				killCtx, _ = context.WithTimeoutCause(killCtx, 7*time.Second, errors.WithStack(context.DeadlineExceeded))
+				killCtx, timeout := context.WithCancelCause(context.Background())                                         //nolint:govet
+				killCtx, _ = context.WithTimeoutCause(killCtx, 7*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 				if err := p.killer.Kill(killCtx); err != nil {
 					select {
 					case <-killCtx.Done():
 						cancel(errors.WithStack(context.Cause(ctx)))
-						return
+						return //nolint:govet
 					default:
 					}
 				}
@@ -693,7 +693,7 @@ func (p *procHandle) WaitForReady(ctx context.Context) error {
 // callback is non-nil it will be called after receiving the pid.
 func (p *procHandle) WaitForStart(ctx context.Context, startedCh <-chan int, started func()) error {
 	ctx, cancel := context.WithCancelCause(ctx)
-	ctx, _ = context.WithTimeoutCause(ctx, 10*time.Second, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, 10*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 	select {
 	case <-ctx.Done():

executor/stubs.go

@@ -33,7 +33,7 @@ func MountStubsCleaner(ctx context.Context, dir string, mounts []Mount, recursiv
 
 		for {
 			_, err = os.Lstat(realPath)
-			if !(errors.Is(err, os.ErrNotExist) || errors.Is(err, syscall.ENOTDIR)) {
+			if !errors.Is(err, os.ErrNotExist) && !errors.Is(err, syscall.ENOTDIR) {
 				break
 			}
 			paths = append(paths, realPath)

exporter/local/export.go

@@ -80,7 +80,7 @@ func (e *localExporter) Config() *exporter.Config {
 
 func (e *localExporterInstance) Export(ctx context.Context, inp *exporter.Source, _ exptypes.InlineCache, sessionID string) (map[string]string, exporter.DescriptorReference, error) {
 	timeoutCtx, cancel := context.WithCancelCause(ctx)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	if e.opts.Epoch == nil {

exporter/oci/export.go

@@ -217,7 +217,7 @@ func (e *imageExporterInstance) Export(ctx context.Context, src *exporter.Source
 	}
 
 	timeoutCtx, cancel := context.WithCancelCause(ctx)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	caller, err := e.opt.SessionManager.Get(timeoutCtx, sessionID, false)

exporter/tar/export.go

@@ -164,7 +164,7 @@ func (e *localExporterInstance) Export(ctx context.Context, inp *exporter.Source
 	}
 
 	timeoutCtx, cancel := context.WithCancelCause(ctx)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	caller, err := e.opt.SessionManager.Get(timeoutCtx, sessionID, false)

frontend/dockerfile/dockerfile2llb/convert.go

@@ -1218,7 +1218,7 @@ func dispatchRun(d *dispatchState, c *instructions.RunCommand, proxy *llb.ProxyE
 	// Run command can potentially access any file. Mark the full filesystem as used.
 	d.paths["/"] = struct{}{}
 
-	var args []string = c.CmdLine
+	var args = c.CmdLine
 	if len(c.Files) > 0 {
 		if len(args) != 1 || !c.PrependShell {
 			return errors.Errorf("parsing produced an invalid run command: %v", args)
@@ -1704,7 +1704,7 @@ func dispatchOnbuild(d *dispatchState, c *instructions.OnbuildCommand) error {
 func dispatchCmd(d *dispatchState, c *instructions.CmdCommand, lint *linter.Linter) error {
 	validateUsedOnce(c, &d.cmd, lint)
 
-	var args []string = c.CmdLine
+	var args = c.CmdLine
 	if c.PrependShell {
 		if len(d.image.Config.Shell) == 0 {
 			msg := linter.RuleJSONArgsRecommended.Format(c.Name())
@@ -1720,7 +1720,7 @@ func dispatchCmd(d *dispatchState, c *instructions.CmdCommand, lint *linter.Lint
 func dispatchEntrypoint(d *dispatchState, c *instructions.EntrypointCommand, lint *linter.Linter) error {
 	validateUsedOnce(c, &d.entrypoint, lint)
 
-	var args []string = c.CmdLine
+	var args = c.CmdLine
 	if c.PrependShell {
 		if len(d.image.Config.Shell) == 0 {
 			msg := linter.RuleJSONArgsRecommended.Format(c.Name())

frontend/dockerfile/dockerfile_runnetwork_test.go

@@ -147,7 +147,7 @@ RUN --network=host nc 127.0.0.1 %s | grep foo
 			require.NoError(t, err)
 		}
 	default:
-		require.Fail(t, "unexpected network.host mode %q", hostAllowed)
+		require.Fail(t, fmt.Sprintf("unexpected network.host mode %q", hostAllowed))
 	}
 }
 
@@ -198,6 +198,6 @@ RUN --network=none ! nc -z 127.0.0.1 %s
 			require.NoError(t, err)
 		}
 	default:
-		require.Fail(t, "unexpected network.host mode %q", hostAllowed)
+		require.Fail(t, fmt.Sprintf("unexpected network.host mode %q", hostAllowed))
 	}
 }

frontend/dockerfile/dockerfile_test.go

@@ -3628,7 +3628,7 @@ COPY . .
 	)
 
 	ctx, cancel := context.WithCancelCause(sb.Context())
-	ctx, _ = context.WithTimeoutCause(ctx, 15*time.Second, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, 15*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	c, err := client.New(ctx, sb.Address())
@@ -7162,9 +7162,10 @@ COPY --from=base --chmod=0644 /out /out
 				}
 				visited[vtx.Name] = struct{}{}
 				t.Logf("step: %q", vtx.Name)
-				if vtx.Name == `[base 3/3] RUN echo "base" > base` {
+				switch vtx.Name {
+				case `[base 3/3] RUN echo "base" > base`:
 					hasRun = true
-				} else if vtx.Name == `[stage-1 1/1] COPY --from=base --chmod=0644 /out /out` {
+				case `[stage-1 1/1] COPY --from=base --chmod=0644 /out /out`:
 					hasCopy = true
 				}
 			}
@@ -9647,8 +9648,8 @@ EOF
 	info, err := testutil.ReadImages(ctx, provider, desc)
 	require.NoError(t, err)
 	require.Len(t, info.Images, 2)
-	require.Equal(t, info.Images[0].Img.Platform.OSVersion, p1.OSVersion)
-	require.Equal(t, info.Images[1].Img.Platform.OSVersion, p2.OSVersion)
+	require.Equal(t, info.Images[0].Img.OSVersion, p1.OSVersion)
+	require.Equal(t, info.Images[1].Img.OSVersion, p2.OSVersion)
 
 	dt, err := os.ReadFile(filepath.Join(destDir, strings.Replace(p1Str, "/", "_", 1), "osversion"))
 	require.NoError(t, err)
@@ -9785,7 +9786,7 @@ EOF
 	info, err := testutil.ReadImages(ctx, provider, desc)
 	require.NoError(t, err)
 	require.Len(t, info.Images, 1)
-	require.Equal(t, info.Images[0].Img.Platform.OSVersion, p1.OSVersion)
+	require.Equal(t, info.Images[0].Img.OSVersion, p1.OSVersion)
 
 	dockerfile = fmt.Appendf(nil, `
 FROM %s
@@ -9828,7 +9829,7 @@ EOF
 	info, err = testutil.ReadImages(ctx, provider, desc)
 	require.NoError(t, err)
 	require.Len(t, info.Images, 1)
-	require.Equal(t, info.Images[0].Img.Platform.OSVersion, p1.OSVersion)
+	require.Equal(t, info.Images[0].Img.OSVersion, p1.OSVersion)
 }
 
 func testTargetMistype(t *testing.T, sb integration.Sandbox) {

frontend/dockerfile/linter/linter.go

@@ -55,7 +55,7 @@ func (lc *Linter) Run(rule LinterRuleI, location []parser.Range, txt ...string)
 	rulename := rule.RuleName()
 	if rule.IsExperimental() {
 		_, experimentalOk := lc.ExperimentalRules[rulename]
-		if !(lc.ExperimentalAll || experimentalOk) {
+		if !lc.ExperimentalAll && !experimentalOk {
 			return
 		}
 	} else {

frontend/gateway/container/container.go

@@ -21,10 +21,8 @@ import (
 	"github.com/moby/buildkit/session"
 	"github.com/moby/buildkit/snapshot"
 	"github.com/moby/buildkit/solver/llbsolver/mounts"
-	"github.com/moby/buildkit/solver/pb"
 	opspb "github.com/moby/buildkit/solver/pb"
 	"github.com/moby/buildkit/util/stack"
-	utilsystem "github.com/moby/buildkit/util/system"
 	"github.com/moby/buildkit/worker"
 	"github.com/pkg/errors"
 	"golang.org/x/sync/errgroup"
@@ -80,9 +78,9 @@ func NewContainer(ctx context.Context, cm cache.Manager, exec executor.Executor,
 		mnts = append(mnts, m.Mount)
 		if m.WorkerRef != nil {
 			refs = append(refs, m.WorkerRef)
-			m.Mount.Input = int64(len(refs) - 1)
+			m.Input = int64(len(refs) - 1)
 		} else {
-			m.Mount.Input = int64(opspb.Empty)
+			m.Input = int64(opspb.Empty)
 		}
 	}
 
@@ -328,7 +326,7 @@ func (gwCtr *gatewayContainer) Start(ctx context.Context, req client.StartReques
 	if procInfo.Meta.Cwd == "" {
 		procInfo.Meta.Cwd = "/"
 	}
-	procInfo.Meta.Env = addDefaultEnvvar(procInfo.Meta.Env, "PATH", utilsystem.DefaultPathEnv(gwCtr.platform.OS))
+	procInfo.Meta.Env = addDefaultEnvvar(procInfo.Meta.Env, "PATH", system.DefaultPathEnv(gwCtr.platform.OS))
 	if req.Tty {
 		procInfo.Meta.Env = addDefaultEnvvar(procInfo.Meta.Env, "TERM", "xterm")
 	}
@@ -378,7 +376,7 @@ func (gwCtr *gatewayContainer) Start(ctx context.Context, req client.StartReques
 	return gwProc, nil
 }
 
-func (gwCtr *gatewayContainer) loadSecretEnv(ctx context.Context, secretEnv []*pb.SecretEnv) ([]string, error) {
+func (gwCtr *gatewayContainer) loadSecretEnv(ctx context.Context, secretEnv []*opspb.SecretEnv) ([]string, error) {
 	out := make([]string, 0, len(secretEnv))
 	for _, sopt := range secretEnv {
 		id := sopt.ID
@@ -394,7 +392,7 @@ func (gwCtr *gatewayContainer) loadSecretEnv(ctx context.Context, secretEnv []*p
 			}
 			return nil
 		})
-		if err != nil && !(errors.Is(err, secrets.ErrNotFound) && sopt.Optional) {
+		if err != nil && (!errors.Is(err, secrets.ErrNotFound) || !sopt.Optional) {
 			return nil, err
 		}
 		out = append(out, fmt.Sprintf("%s=%s", sopt.Name, string(dt)))

frontend/gateway/forwarder/forward.go

@@ -59,15 +59,7 @@ type BridgeClient struct {
 }
 
 func (c *BridgeClient) Solve(ctx context.Context, req client.SolveRequest) (*client.Result, error) {
-	res, err := c.FrontendLLBBridge.Solve(ctx, frontend.SolveRequest{
-		Evaluate:       req.Evaluate,
-		Definition:     req.Definition,
-		Frontend:       req.Frontend,
-		FrontendOpt:    req.FrontendOpt,
-		FrontendInputs: req.FrontendInputs,
-		CacheImports:   req.CacheImports,
-		SourcePolicies: req.SourcePolicies,
-	}, c.sid)
+	res, err := c.FrontendLLBBridge.Solve(ctx, frontend.SolveRequest(req), c.sid)
 	if err != nil {
 		return nil, c.wrapSolveError(err)
 	}

frontend/gateway/grpcclient/client.go

@@ -44,7 +44,7 @@ type GrpcClient interface {
 
 func New(ctx context.Context, opts map[string]string, session, product string, c pb.LLBBridgeClient, w []client.WorkerInfo) (GrpcClient, error) {
 	pingCtx, pingCancel := context.WithCancelCause(ctx)
-	pingCtx, _ = context.WithTimeoutCause(pingCtx, 15*time.Second, errors.WithStack(context.DeadlineExceeded))
+	pingCtx, _ = context.WithTimeoutCause(pingCtx, 15*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer pingCancel(errors.WithStack(context.Canceled))
 	resp, err := c.Ping(pingCtx, &pb.PingRequest{})
 	if err != nil {

frontend/gateway/pb/caps.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:revive
+package moby_buildkit_v1_frontend //nolint:revive,staticcheck
 
 import "github.com/moby/buildkit/util/apicaps"
 

frontend/gateway/pb/exit.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:revive
+package moby_buildkit_v1_frontend //nolint:revive,staticcheck
 
 import (
 	"fmt"

hack/dockerfiles/lint.Dockerfile

@@ -4,7 +4,7 @@ ARG GO_VERSION=1.23
 ARG ALPINE_VERSION=3.21
 ARG XX_VERSION=1.6.1
 ARG PROTOLINT_VERSION=0.50.5
-ARG GOLANGCI_LINT_VERSION=v1.61.0
+ARG GOLANGCI_LINT_VERSION=v2.1.5
 ARG GOLANGCI_FROM_SOURCE=false
 # v0.31 requires go1.24
 ARG GOPLS_VERSION=v0.30.0

session/filesync/diffcopy.go

@@ -32,7 +32,7 @@ type bufferedWriteCloser struct {
 }
 
 func (bwc *bufferedWriteCloser) Close() error {
-	if err := bwc.Writer.Flush(); err != nil {
+	if err := bwc.Flush(); err != nil {
 		return errors.WithStack(err)
 	}
 	return bwc.Closer.Close()
@@ -59,10 +59,10 @@ func (wc *streamWriterCloser) Write(dt []byte) (int, error) {
 		return n1 + n2, nil
 	}
 
-	if err := wc.ClientStream.SendMsg(&BytesMessage{Data: dt}); err != nil {
+	if err := wc.SendMsg(&BytesMessage{Data: dt}); err != nil {
 		// SendMsg return EOF on remote errors
 		if errors.Is(err, io.EOF) {
-			if err := errors.WithStack(wc.ClientStream.RecvMsg(struct{}{})); err != nil {
+			if err := errors.WithStack(wc.RecvMsg(struct{}{})); err != nil {
 				return 0, err
 			}
 		}
@@ -72,12 +72,12 @@ func (wc *streamWriterCloser) Write(dt []byte) (int, error) {
 }
 
 func (wc *streamWriterCloser) Close() error {
-	if err := wc.ClientStream.CloseSend(); err != nil {
+	if err := wc.CloseSend(); err != nil {
 		return errors.WithStack(err)
 	}
 	// block until receiver is done
 	var bm BytesMessage
-	if err := wc.ClientStream.RecvMsg(&bm); err != io.EOF {
+	if err := wc.RecvMsg(&bm); err != io.EOF {
 		return errors.WithStack(err)
 	}
 	return nil

session/group.go

@@ -73,7 +73,7 @@ func (sm *Manager) Any(ctx context.Context, g Group, f func(context.Context, str
 		}
 
 		timeoutCtx, cancel := context.WithCancelCause(ctx)
-		timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+		timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 		defer func() { cancel(errors.WithStack(context.Canceled)) }()
 		c, err := sm.Get(timeoutCtx, id, false)
 		if err != nil {

session/grpc.go

@@ -94,7 +94,7 @@ func monitorHealth(ctx context.Context, cc *grpc.ClientConn, cancelConn func(err
 			timeout := time.Duration(math.Max(float64(defaultHealthcheckDuration), float64(lastHealthcheckDuration)*1.5))
 
 			ctx, cancel := context.WithCancelCause(ctx)
-			ctx, _ = context.WithTimeoutCause(ctx, timeout, errors.WithStack(context.DeadlineExceeded))
+			ctx, _ = context.WithTimeoutCause(ctx, timeout, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 			_, err := healthClient.Check(ctx, &grpc_health_v1.HealthCheckRequest{})
 			cancel(errors.WithStack(context.Canceled))
 

snapshot/localmounter_darwin.go

@@ -2,11 +2,11 @@ package snapshot
 
 import (
 	"os"
+	"slices"
 
 	"github.com/containerd/containerd/v2/core/mount"
 	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
-	"slices"
 )
 
 func (lm *localMounter) Mount() (string, error) {

snapshot/snapshotter_test.go

@@ -353,10 +353,10 @@ func TestHardlinks(t *testing.T) {
 			)
 			stat1 = statPath(ctx, t, sn, childSnap.Name, "1")
 			require.EqualValues(t, 1, stat1.Nlink)
-			require.NotEqualValues(t, stat1Ino, stat1.Ino)
+			require.NotEqual(t, stat1Ino, stat1.Ino)
 			stat2 = statPath(ctx, t, sn, childSnap.Name, "2")
 			require.EqualValues(t, 1, stat2.Nlink)
-			require.NotEqualValues(t, stat2Ino, stat2.Ino)
+			require.NotEqual(t, stat2Ino, stat2.Ino)
 
 			// verify the original files and the files inthe merge are unchanged
 			requireContents(ctx, t, sn, base1Snap.Name,

solver/debug.go

@@ -154,19 +154,20 @@ func debugSchedulerPreUnparkSlow(e *edge, inc []pipeSender, updates, allPipes []
 	}
 
 	for i, up := range updates {
-		if up == e.cacheMapReq {
+		switch up {
+		case e.cacheMapReq:
 			log.
 				WithField("update_index", i).
 				WithField("update_pointer", up).
 				WithField("update_complete", up.Status().Completed).
 				Debug("> update cacheMapReq")
-		} else if up == e.execReq {
+		case e.execReq:
 			log.
 				WithField("update_index", i).
 				WithField("update_pointer", up).
 				WithField("update_complete", up.Status().Completed).
 				Debug("> update execReq")
-		} else {
+		default:
 			st, ok := up.Status().Value.(*edgeState)
 			if ok {
 				index := -1

solver/edge.go

@@ -658,7 +658,7 @@ func (e *edge) processDepReq(dep *dep) (depChanged bool) {
 		newKeys := state.keys[len(dep.keys):]
 		if e.cacheMap != nil {
 			e.probeCache(dep, withSelector(newKeys, e.cacheMap.Deps[dep.index].Selector))
-			dep.edgeState.keys = state.keys
+			dep.keys = state.keys
 			if e.allDepsHaveKeys(false) {
 				e.keysDidChange = true
 			}

solver/errdefs/fronetendcap.go

@@ -17,7 +17,7 @@ type UnsupportedFrontendCapError struct {
 }
 
 func (e *UnsupportedFrontendCapError) Error() string {
-	msg := fmt.Sprintf("unsupported frontend capability %s", e.FrontendCap.Name)
+	msg := fmt.Sprintf("unsupported frontend capability %s", e.Name)
 	if e.error != nil {
 		msg += ": " + e.error.Error()
 	}

solver/errdefs/frontend.go

@@ -24,7 +24,7 @@ func (e *FrontendError) Error() string {
 	if e.error != nil {
 		return e.error.Error()
 	}
-	return fmt.Sprintf("frontend %s failed", e.Frontend.Name)
+	return fmt.Sprintf("frontend %s failed", e.Name)
 }
 
 func (e *FrontendError) Unwrap() error {
@@ -44,7 +44,7 @@ func Frontends(err error) []*Frontend {
 	var es *FrontendError
 	if errors.As(err, &es) {
 		out = Frontends(es.Unwrap())
-		out = append(out, es.Frontend.CloneVT())
+		out = append(out, es.CloneVT())
 	}
 	return out
 }

solver/errdefs/solve.go

@@ -14,7 +14,7 @@ func init() {
 	typeurl.Register((*Solve)(nil), "github.com/moby/buildkit", "errdefs.Solve+json")
 }
 
-//nolint:revive
+//nolint:revive,staticcheck
 type IsSolve_Subject isSolve_Subject
 
 // SolveError will be returned when an error is encountered during a solve that

solver/errdefs/source.go

@@ -35,7 +35,7 @@ func Sources(err error) []*Source {
 	var es *ErrorSource
 	if errors.As(err, &es) {
 		out = Sources(es.Unwrap())
-		out = append(out, es.Source.CloneVT())
+		out = append(out, es.CloneVT())
 	}
 	return out
 }
@@ -69,10 +69,7 @@ func (s *Source) Print(w io.Writer) error {
 	var p int
 
 	prepadStart := start
-	for {
-		if p >= pad {
-			break
-		}
+	for p < pad {
 		if start > 1 {
 			start--
 			p++

solver/errdefs/subrequest.go

@@ -17,7 +17,7 @@ type UnsupportedSubrequestError struct {
 }
 
 func (e *UnsupportedSubrequestError) Error() string {
-	msg := fmt.Sprintf("unsupported request %s", e.Subrequest.Name)
+	msg := fmt.Sprintf("unsupported request %s", e.Name)
 	if e.error != nil {
 		msg += ": " + e.error.Error()
 	}

solver/index.go

@@ -97,7 +97,7 @@ func (ei *edgeIndex) LoadOrStore(k *CacheKey, e *edge) *edge {
 		}
 	}
 
-	if old != nil && !(!isIgnoreCache(old) && isIgnoreCache(e)) {
+	if old != nil && (isIgnoreCache(old) || !isIgnoreCache(e)) {
 		ei.enforceLinked(oldID, k)
 		return old
 	}
@@ -190,7 +190,7 @@ func (ei *edgeIndex) getAllMatches(k *CacheKey) []string {
 		if i == 0 {
 			for _, d := range dd {
 				ll := CacheInfoLink{Input: Index(i), Digest: k.Digest(), Output: k.Output(), Selector: d.Selector}
-				for _, ckID := range d.CacheKey.CacheKey.indexIDs {
+				for _, ckID := range d.CacheKey.indexIDs {
 					item, ok := ei.items[ckID]
 					if ok {
 						for l := range item.links[ll] {
@@ -210,7 +210,7 @@ func (ei *edgeIndex) getAllMatches(k *CacheKey) []string {
 			found := false
 			for _, d := range dd {
 				ll := CacheInfoLink{Input: Index(i), Digest: k.Digest(), Output: k.Output(), Selector: d.Selector}
-				for _, ckID := range d.CacheKey.CacheKey.indexIDs {
+				for _, ckID := range d.CacheKey.indexIDs {
 					if item, ok := ei.items[ckID]; ok {
 						if l, ok := item.links[ll]; ok {
 							if _, ok := l[m]; ok {

solver/jobs.go

@@ -625,7 +625,7 @@ func (jl *Solver) NewJob(id string) (*Job, error) {
 
 func (jl *Solver) Get(id string) (*Job, error) {
 	ctx, cancel := context.WithCancelCause(context.Background())
-	ctx, _ = context.WithTimeoutCause(ctx, 6*time.Second, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, 6*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	go func() {

solver/jobs_test.go

@@ -80,9 +80,10 @@ func testParallelism(t *testing.T, sb integration.Sandbox) {
 	elapsed := time.Since(timeStart)
 
 	maxParallelism := sb.Value("max-parallelism")
-	if maxParallelism == maxParallelismSingle {
+	switch maxParallelism {
+	case maxParallelismSingle:
 		require.Greater(t, elapsed, 10*time.Second, "parallelism not restricted")
-	} else if maxParallelism == maxParallelismUnlimited {
+	case maxParallelismUnlimited:
 		require.Less(t, elapsed, 10*time.Second, "parallelism hindered")
 	}
 }

solver/llbsolver/cdidevices/manager.go

@@ -271,7 +271,7 @@ func deviceAnnotations(dev *cdi.Device) map[string]string {
 	// spec annotations
 	maps.Copy(out, dev.GetSpec().Annotations)
 	// device annotations
-	maps.Copy(out, dev.Device.Annotations)
+	maps.Copy(out, dev.Annotations)
 	return out
 }
 

solver/llbsolver/mounts/mount.go

@@ -500,7 +500,7 @@ func (r *cacheRefShare) release(ctx context.Context) error {
 	if r.main != nil {
 		delete(r.main.shares, r.key)
 	}
-	return r.MutableRef.Release(ctx)
+	return r.Release(ctx)
 }
 
 var (

solver/llbsolver/ops/exec.go

@@ -563,7 +563,7 @@ func (e *ExecOp) loadSecretEnv(ctx context.Context, g session.Group) ([]string,
 			}
 			return nil
 		})
-		if err != nil && !(errors.Is(err, secrets.ErrNotFound) && sopt.Optional) {
+		if err != nil && (!errors.Is(err, secrets.ErrNotFound) || !sopt.Optional) {
 			return nil, err
 		}
 		out = append(out, fmt.Sprintf("%s=%s", sopt.Name, string(dt)))

solver/llbsolver/provenance.go

@@ -168,12 +168,12 @@ func (b *provenanceBridge) Solve(ctx context.Context, req frontend.SolveRequest,
 		b.builds = append(b.builds, resultWithBridge{res: res, bridge: b})
 		b.mu.Unlock()
 	} else if req.Frontend != "" {
-		f, ok := b.llbBridge.frontends[req.Frontend]
+		f, ok := b.frontends[req.Frontend]
 		if !ok {
 			return nil, errors.Errorf("invalid frontend: %s", req.Frontend)
 		}
 		wb := &provenanceBridge{llbBridge: b.llbBridge, req: &req}
-		res, err = f.Solve(ctx, wb, b.llbBridge, req.FrontendOpt, req.FrontendInputs, sid, b.llbBridge.sm)
+		res, err = f.Solve(ctx, wb, b.llbBridge, req.FrontendOpt, req.FrontendInputs, sid, b.sm)
 		if err != nil {
 			fe := errdefs.Frontend{
 				Name:   req.Frontend,

solver/llbsolver/solver.go

@@ -207,7 +207,7 @@ func (s *Solver) recordBuildHistory(ctx context.Context, id string, req frontend
 		}
 
 		ctx, cancel := context.WithCancelCause(ctx)
-		ctx, _ = context.WithTimeoutCause(ctx, 300*time.Second, errors.WithStack(context.DeadlineExceeded))
+		ctx, _ = context.WithTimeoutCause(ctx, 300*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 		defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 		var mu sync.Mutex
@@ -676,7 +676,7 @@ func (s *Solver) Solve(ctx context.Context, id string, sessionID string, req fro
 
 func (s *Solver) getSessionExporters(ctx context.Context, sessionID string, id int, inp *exporter.Source) ([]exporter.ExporterInstance, error) {
 	timeoutCtx, cancel := context.WithCancelCause(ctx)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	caller, err := s.sm.Get(timeoutCtx, sessionID, false)
@@ -753,7 +753,7 @@ func runCacheExporters(ctx context.Context, exporters []RemoteCacheExporter, j *
 		i, exp := i, exp
 		eg.Go(func() (err error) {
 			id := fmt.Sprint(j.SessionID, "-cache-", i)
-			err = inBuilderContext(ctx, j, exp.Exporter.Name(), id, func(ctx context.Context, _ session.Group) error {
+			err = inBuilderContext(ctx, j, exp.Name(), id, func(ctx context.Context, _ session.Group) error {
 				prepareDone := progress.OneOff(ctx, "preparing build cache for export")
 				if err := result.EachRef(cached, inp, func(res solver.CachedResult, ref cache.ImmutableRef) error {
 					ctx = withDescHandlerCacheOpts(ctx, ref)

solver/result.go

@@ -48,7 +48,7 @@ type splitResult struct {
 
 func (r *splitResult) Release(ctx context.Context) error {
 	if atomic.AddInt64(&r.released, 1) > 1 {
-		err := errors.Errorf("releasing already released reference %+v", r.Result.ID())
+		err := errors.Errorf("releasing already released reference %+v", r.ID())
 		bklog.G(ctx).Error(err)
 		return err
 	}

solver/testutil/cachestorage_testsuite.go

@@ -44,7 +44,7 @@ func testResults(t *testing.T, st solver.CacheKeyStorage) {
 
 	// Windows time.Now() resolution can be quite coarse, so frequently
 	// time.Now() will be the same between two nearby calls.
-	if time.Now() == timeNow {
+	if time.Now().Equal(timeNow) {
 		time.Sleep(time.Duration(100) * time.Millisecond)
 	}
 	require.NotEqual(t, timeNow, time.Now(), "time has stopped")
@@ -211,7 +211,7 @@ func testResultReleaseSingleLevel(t *testing.T, st solver.CacheKeyStorage) {
 	require.Equal(t, 0, len(m))
 
 	st.Walk(func(id string) error {
-		require.False(t, true, fmt.Sprintf("id %s should have been released", id))
+		require.Fail(t, fmt.Sprintf("id %s should have been released", id))
 		return nil
 	})
 }
@@ -339,7 +339,7 @@ func testResultReleaseMultiLevel(t *testing.T, st solver.CacheKeyStorage) {
 	require.False(t, st.Exists("foo"))
 
 	st.Walk(func(id string) error {
-		require.False(t, true, fmt.Sprintf("id %s should have been released", id))
+		require.Fail(t, fmt.Sprintf("id %s should have been released", id))
 		return nil
 	})
 }

source/containerimage/ocilayout.go

@@ -125,7 +125,7 @@ func (r *ociLayoutResolver) info(ctx context.Context, ref reference.Spec) (conte
 func (r *ociLayoutResolver) withCaller(ctx context.Context, f func(context.Context, session.Caller) error) error {
 	if r.store.SessionID != "" {
 		timeoutCtx, cancel := context.WithCancelCause(ctx)
-		timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+		timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 		defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 		caller, err := r.sm.Get(timeoutCtx, r.store.SessionID, false)

source/containerimage/pull.go

@@ -88,11 +88,11 @@ func (p *puller) CacheKey(ctx context.Context, g session.Group, index int) (cach
 	switch p.ResolverType {
 	case ResolverTypeRegistry:
 		resolver := resolver.DefaultPool.GetResolver(p.RegistryHosts, p.Ref, "pull", p.SessionManager, g).WithImageStore(p.ImageStore, p.Mode)
-		p.Puller.Resolver = resolver
+		p.Resolver = resolver
 		getResolver = func(g session.Group) remotes.Resolver { return resolver.WithSession(g) }
 	case ResolverTypeOCILayout:
 		resolver := getOCILayoutResolver(p.store, p.SessionManager, g)
-		p.Puller.Resolver = resolver
+		p.Resolver = resolver
 		// OCILayout has no need for session
 		getResolver = func(g session.Group) remotes.Resolver { return resolver }
 	default:
@@ -203,11 +203,11 @@ func (p *puller) Snapshot(ctx context.Context, g session.Group) (ir cache.Immuta
 	switch p.ResolverType {
 	case ResolverTypeRegistry:
 		resolver := resolver.DefaultPool.GetResolver(p.RegistryHosts, p.Ref, "pull", p.SessionManager, g).WithImageStore(p.ImageStore, p.Mode)
-		p.Puller.Resolver = resolver
+		p.Resolver = resolver
 		getResolver = func(g session.Group) remotes.Resolver { return resolver.WithSession(g) }
 	case ResolverTypeOCILayout:
 		resolver := getOCILayoutResolver(p.store, p.SessionManager, g)
-		p.Puller.Resolver = resolver
+		p.Resolver = resolver
 		// OCILayout has no need for session
 		getResolver = func(g session.Group) remotes.Resolver { return resolver }
 	default:

source/git/source_test.go

@@ -673,7 +673,7 @@ func TestCredentialRedaction(t *testing.T) {
 
 	_, _, _, _, err = g.CacheKey(ctx, nil, 0)
 	require.Error(t, err)
-	require.False(t, strings.Contains(err.Error(), "keepthissecret"))
+	require.NotContains(t, err.Error(), "keepthissecret")
 }
 
 func TestSubdir(t *testing.T) {

source/local/source.go

@@ -164,7 +164,7 @@ func (ls *localSourceHandler) Snapshot(ctx context.Context, g session.Group) (ca
 	}
 
 	timeoutCtx, cancel := context.WithCancelCause(ctx)
-	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+	timeoutCtx, _ = context.WithTimeoutCause(timeoutCtx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 
 	caller, err := ls.sm.Get(timeoutCtx, sessionID, false)

sourcepolicy/pb/json.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_sourcepolicy //nolint:revive
+package moby_buildkit_v1_sourcepolicy //nolint:revive,staticcheck
 
 import (
 	"github.com/moby/buildkit/util/gogo/proto"

sourcepolicy/pb/json_test.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_sourcepolicy //nolint:revive
+package moby_buildkit_v1_sourcepolicy //nolint:revive,staticcheck
 
 import (
 	"encoding/json"

util/contentutil/copy.go

@@ -27,7 +27,7 @@ type localFetcher struct {
 }
 
 func (f *localFetcher) Fetch(ctx context.Context, desc ocispecs.Descriptor) (io.ReadCloser, error) {
-	r, err := f.Provider.ReaderAt(ctx, desc)
+	r, err := f.ReaderAt(ctx, desc)
 	if err != nil {
 		return nil, err
 	}

util/contentutil/fetcher.go

@@ -54,7 +54,7 @@ func (r *readerAt) ReadAt(b []byte, off int64) (int, error) {
 
 	var totalN int
 	for len(b) > 0 {
-		n, err := r.Reader.Read(b)
+		n, err := r.Read(b)
 		if err == io.EOF && n == len(b) {
 			err = nil
 		}

util/entitlements/security/security_linux.go

@@ -120,7 +120,7 @@ func getFreeLoopID() (int, error) {
 	}
 	defer fd.Close()
 
-	const _LOOP_CTL_GET_FREE = 0x4C82 //nolint:revive
+	const _LOOP_CTL_GET_FREE = 0x4C82 //nolint:revive,staticcheck
 	r1, _, uerr := unix.Syscall(unix.SYS_IOCTL, fd.Fd(), _LOOP_CTL_GET_FREE, 0)
 	if uerr == 0 {
 		return int(r1), nil

util/imageutil/config_test.go

@@ -193,7 +193,7 @@ type raReader struct {
 }
 
 func (r *raReader) Read(p []byte) (int, error) {
-	n, err := r.ReaderAt.ReadAt(p, int64(r.pos))
+	n, err := r.ReadAt(p, int64(r.pos))
 	r.pos += n
 	return n, err
 }

util/network/cniprovider/cni.go

@@ -282,10 +282,10 @@ func (c *cniProvider) newNS(ctx context.Context, hostname string) (*cniNS, error
 
 	var cniRes *cni.Result
 	if ctx.Value(contextKeyDetachedNetNS) == nil {
-		cniRes, err = c.CNI.Setup(context.TODO(), id, nativeID, nsOpts...)
+		cniRes, err = c.Setup(context.TODO(), id, nativeID, nsOpts...)
 	} else {
 		// Parallel Setup cannot be used, apparently due to the goroutine issue with setns
-		cniRes, err = c.CNI.SetupSerially(context.TODO(), id, nativeID, nsOpts...)
+		cniRes, err = c.SetupSerially(context.TODO(), id, nativeID, nsOpts...)
 	}
 	if err != nil {
 		deleteNetNS(nativeID)

util/progress/progressui/colors.go

@@ -40,7 +40,7 @@ func setUserDefinedTermColors(colorsEnv string) {
 	for _, field := range fields {
 		k, v, ok := strings.Cut(field, "=")
 		if !ok || strings.Contains(v, "=") {
-			err := errors.New("A valid entry must have exactly two fields")
+			err := errors.New("valid entry must have exactly two fields")
 			bklog.L.WithError(err).Warnf("Could not parse BUILDKIT_COLORS component: %s", field)
 			continue
 		}
@@ -52,7 +52,7 @@ func setUserDefinedTermColors(colorsEnv string) {
 				parseKeys(k, c)
 			}
 		} else {
-			err := errors.New("Colors must be a name from the pre-defined list or a valid 3-part RGB value")
+			err := errors.New("colors must be a name from the pre-defined list or a valid 3-part RGB value")
 			bklog.L.WithError(err).Warnf("Unknown color value found in BUILDKIT_COLORS: %s=%s", k, v)
 		}
 	}
@@ -63,7 +63,7 @@ func readBuildkitColorsEnv(colorsEnv string) []string {
 	csvReader.Comma = ':'
 	fields, err := csvReader.Fields(colorsEnv, nil)
 	if err != nil {
-		bklog.L.WithError(err).Warnf("Could not parse BUILDKIT_COLORS. Falling back to defaults.")
+		bklog.L.WithError(err).Warnf("could not parse BUILDKIT_COLORS. Falling back to defaults.")
 		return nil
 	}
 	return fields
@@ -76,7 +76,7 @@ func readRGB(v string) aec.ANSI {
 		return nil
 	}
 	if len(fields) != 3 {
-		err = errors.New("A valid RGB color must have three fields")
+		err = errors.New("valid RGB color must have three fields")
 		bklog.L.WithError(err).Warnf("Could not parse value %s as valid RGB color. Ignoring.", v)
 		return nil
 	}

util/progress/progressui/display.go

@@ -588,10 +588,8 @@ func (t *trace) triggerVertexEvent(v *client.Vertex) {
 		old = *v
 	}
 
-	changed := false
-	if v.Digest != old.Digest {
-		changed = true
-	}
+	changed := v.Digest != old.Digest
+
 	if v.Name != old.Name {
 		changed = true
 	}
@@ -674,7 +672,7 @@ func (t *trace) update(s *client.SolveStatus, termWidth int) {
 			t.vertexes = append(t.vertexes, t.byDigest[v.Digest])
 		}
 		// allow a duplicate initial vertex that shouldn't reset state
-		if !(prev != nil && prev.isStarted() && v.Started == nil) {
+		if prev == nil || !prev.isStarted() || v.Started != nil {
 			t.byDigest[v.Digest].Vertex = v
 		}
 		if v.Started != nil {

util/resolver/authorizer.go

@@ -153,7 +153,8 @@ func (a *dockerAuthorizer) AddResponses(ctx context.Context, responses []*http.R
 	handler := a.handlers.get(ctx, host, a.sm, a.session)
 
 	for _, c := range auth.ParseAuthHeader(last.Header) {
-		if c.Scheme == auth.BearerAuth {
+		switch c.Scheme {
+		case auth.BearerAuth:
 			var oldScopes []string
 			if err := invalidAuthorization(c, responses); err != nil {
 				a.handlers.delete(handler)
@@ -200,7 +201,7 @@ func (a *dockerAuthorizer) AddResponses(ctx context.Context, responses []*http.R
 			a.handlers.set(host, sessionID, newAuthHandler(host, a.client, c.Scheme, pubKey, common))
 
 			return nil
-		} else if c.Scheme == auth.BasicAuth {
+		case auth.BasicAuth:
 			sessionID, username, secret, err := a.getCredentials(host)
 			if err != nil {
 				return err

util/staticfs/merge.go

@@ -69,10 +69,7 @@ func (mfs *MergeFS) Walk(ctx context.Context, target string, fn fs.WalkDirFunc)
 		next2, ok2 := <-ch2
 		key2 := next2.key()
 
-		for {
-			if !ok1 && !ok2 {
-				break
-			}
+		for ok1 || ok2 {
 			if !ok2 || ok1 && key1 < key2 {
 				if err := fn(next1.path, next1.entry, next1.err); err != nil {
 					return err

util/testutil/integration/registry.go

@@ -68,7 +68,7 @@ http:
 	deferF.Append(stop)
 
 	ctx, cancel := context.WithCancelCause(context.Background())
-	ctx, _ = context.WithTimeoutCause(ctx, 5*time.Second, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, 5*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 	url, err = detectPort(ctx, rc)
 	if err != nil {

util/throttle/throttle_test.go

@@ -29,9 +29,7 @@ func TestThrottle(t *testing.T) {
 		require.Less(t, retries, 10)
 		time.Sleep(60 * time.Millisecond)
 		v := atomic.LoadInt64(&i)
-		if v > 1 {
-			require.Fail(t, "invalid value %d", v)
-		}
+		require.LessOrEqual(t, v, int64(1))
 		if v == 1 {
 			break
 		}

util/tracing/otlptracegrpc/client.go

@@ -72,7 +72,7 @@ func (c *client) UploadTraces(ctx context.Context, protoSpans []*tracepb.Resourc
 	ctx, cancel := c.connection.ContextWithStop(ctx)
 	defer func() { cancel(errors.WithStack(context.Canceled)) }()
 	ctx, tCancel := context.WithCancelCause(ctx)
-	ctx, _ = context.WithTimeoutCause(ctx, 30*time.Second, errors.WithStack(context.DeadlineExceeded))
+	ctx, _ = context.WithTimeoutCause(ctx, 30*time.Second, errors.WithStack(context.DeadlineExceeded)) //nolint:govet
 	defer tCancel(errors.WithStack(context.Canceled))
 
 	ctx = c.connection.ContextWithMetadata(ctx)

worker/runc/runc_test.go

@@ -207,7 +207,7 @@ func TestRuncWorkerNoProcessSandbox(t *testing.T) {
 	stdout := bytes.NewBuffer(nil)
 	stderr := bytes.NewBuffer(nil)
 	_, err = w.WorkerOpt.Executor.Run(ctx, "", execMount(root, false), nil, executor.ProcessInfo{Meta: meta, Stdout: &nopCloser{stdout}, Stderr: &nopCloser{stderr}}, nil)
-	require.NoError(t, err, fmt.Sprintf("stdout=%q, stderr=%q", stdout.String(), stderr.String()))
+	require.NoError(t, err, "stdout=%q, stderr=%q", stdout.String(), stderr.String())
 	require.Equal(t, string(selfCmdline), stdout.String())
 }