Is it possible to disable //nolint?

[GirZ0n]

Hi. We are developing an online educational platform for programmers and plan to use golangci-lint to check students' code. However, students can potentially use //nolint to suppress violations. Is there any way to avoid this?

[bombsimon]

There's no way to disable this. I would suggest looking in the source code rather than using golangci-lint for this purpose. Something like this:

grep -rE '// ?nolint' > /dev/null && echo 'Uses //nolint' || echo 'Does not use //nolint'

[mirecl]

@bombsimon, how would you feel if I create a PR to be able to disable //nolint via the config file (.golangci.yaml)?

[bombsimon]

I think that would make sense but I wouldn't merge such PR without confirming with @ldez first. Maybe it could be configurable in the nolintlint linter that already finds all nolint directives and check their format.

[ldez]

There are several problems related to an option to disable nolint (this list is not exhaustive):

• the exclude section doesn't allow you to target a specific piece of code, then in some cases, you will need to use a nolint directive, but it's not possible for a nolint directive to allow a nolint directive. And the capacities of the exclude section will never be the same as the nolint directives.
• the need to not allow all nolint directives is an edge case, and edge cases are enemies of simplicity: the increase of the complexity (of the maintenance or the usage) of adding a new option is not proportional to the number of added options.

So I think that adding an option to disable nolint directives is not really something interesting from the point of view of the project.

I'm interested to understand what drives you to want to forbid nolint directives.

[alexpts]

I need to scan everything, excluding nolint comments.

CI has a job for security checking. Job currently uses the gosec binary. He finds 10 vulnerabilities in the project.

I want to run gosec inspections via golangci-lint. I expect the results to be the same, but they are different. golangci-lint skips errors marked nolint comment.

For example issue detected only gosec binary:

G404 (CWE-338): Use of weak random number generator (math/rand instead of crypto/rand) (Confidence: MEDIUM, Severity: HIGH)
    11: 	b := make([]rune, n)
  > 12: 	r := rand.New(rand.NewSource(time.Now().UnixNano())) //nolint:gosec // random

The option to disable nolint could help in my case. It can be for a linter or global