[CI] add nilaway check

.custom-gcl.yaml

@@ -0,0 +1,7 @@
+version: v2.5.0
+name: golangci-lint-nilaway
+destination: ./bin
+plugins:
+  - module: "go.uber.org/nilaway"
+    import: "go.uber.org/nilaway/cmd/gclplugin"
+    version: "v0.0.0-20250821055425-361559d802f0"

.github/workflows/build-test.yml

@@ -73,7 +73,10 @@ jobs:
         run: make vet
 
       - name: lint
-        uses: golangci/golangci-lint-action@v8
+        run: make lint
+
+      - name: nilcheck
+        run: make nilcheck
 
       - name: Helm Lint
         run: make helm-lint

.golangci-nilaway.yml

@@ -0,0 +1,23 @@
+version: "2"
+run:
+  issues-exit-code: 1
+output:
+  formats:
+    text:
+      path: stdout
+linters:
+  default: none
+  enable:
+    - nilaway
+  settings:
+    custom:
+      nilaway:
+        type: "module"
+        description: Static analysis tool to detect potential nil panics in Go code.
+        settings:
+          include-pkgs: ""
+          exclude-file-docstrings: ignore_autogenerated
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+  new: false

Makefile

@@ -9,6 +9,9 @@ LOCALBIN                ?= $(CACHE_BIN)
 DEVBOX_BIN              ?= $(DEVBOX_PACKAGES_DIR)/bin
 HELM                    ?= $(LOCALBIN)/helm
 HELM_VERSION            ?= v3.16.3
+GOLANGCI_LINT           ?= $(LOCALBIN)/golangci-lint
+GOLANGCI_LINT_VERSION   ?= v2.5.0
+GOLANGCI_LINT_NILAWAY   ?= $(CACHE_BIN)/golangci-lint-nilaway
 
 #####################################################################
 # Dev Setup
@@ -31,7 +34,6 @@ LINODE_URL              ?= https://api.linode.com
 KUBECONFIG_PATH         ?= $(CURDIR)/test-cluster-kubeconfig.yaml
 SUBNET_KUBECONFIG_PATH	?= $(CURDIR)/subnet-testing-kubeconfig.yaml
 MGMT_KUBECONFIG_PATH    ?= $(CURDIR)/mgmt-cluster-kubeconfig.yaml
-GOLANGCI_LINT_VERSION   ?= v2.5.0
 
 # if the $DEVBOX_PACKAGES_DIR env variable exists that means we are within a devbox shell and can safely
 # use devbox's bin for our tools
@@ -65,8 +67,12 @@ vet: fmt
 	go vet ./...
 
 .PHONY: lint
-lint:
-	docker run --rm -w /workdir -v $(PWD):/workdir golangci/golangci-lint:$(GOLANGCI_LINT_VERSION) golangci-lint run -c .golangci.yml --fix
+lint: golangci-lint
+	$(GOLANGCI_LINT) run -c .golangci.yml --fix
+
+.PHONY: lint
+nilcheck: golangci-lint-nilaway ## Run nilaway against code.
+	$(GOLANGCI_LINT_NILAWAY) run -c .golangci-nilaway.yml
 
 .PHONY: gosec
 gosec: ## Run gosec against code.
@@ -273,3 +279,25 @@ helm-template: helm
 #Verify template works when region and apiToken are passed, and when it is passed as reference.
 	@$(HELM) template foo deploy/chart --set apiToken="apiToken",region="us-east" > /dev/null
 	@$(HELM) template foo deploy/chart --set secretRef.apiTokenRef="apiToken",secretRef.name="api",secretRef.regionRef="us-east" > /dev/null
+
+.PHONY: kubectl
+kubectl: $(KUBECTL) ## Download kubectl locally if necessary.
+$(KUBECTL): $(LOCALBIN)
+	curl -fsSL https://dl.k8s.io/release/$(KUBECTL_VERSION)/bin/$(OS)/$(ARCH_SHORT)/kubectl -o $(KUBECTL)
+	chmod +x $(KUBECTL)
+
+.PHONY: clusterctl
+clusterctl: $(CLUSTERCTL) ## Download clusterctl locally if necessary.
+$(CLUSTERCTL): $(LOCALBIN)
+	curl -fsSL https://github.com/kubernetes-sigs/cluster-api/releases/download/$(CLUSTERCTL_VERSION)/clusterctl-$(OS)-$(ARCH_SHORT) -o $(CLUSTERCTL)
+	chmod +x $(CLUSTERCTL)
+
+.phony: golangci-lint-nilaway
+golangci-lint-nilaway: $(GOLANGCI_LINT_NILAWAY)
+$(GOLANGCI_LINT_NILAWAY): $(GOLANGCI_LINT) # Build golangci-lint-nilaway from custom configuration.
+	$(GOLANGCI_LINT) custom
+
+.phony: golangci-lint
+golangci-lint: $(GOLANGCI_LINT)
+$(GOLANGCI_LINT): # Build golangci-lint from tools folder.
+	GOBIN=$(LOCALBIN)  go install  github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)

cloud/linode/loadbalancers_test.go

@@ -609,7 +609,7 @@ func testCreateNodeBalancerWithInvalidFirewall(t *testing.T, client *linodego.Cl
 	}
 	expectedError := "strconv.Atoi: parsing \"qwerty\": invalid syntax"
 	err := testCreateNodeBalancer(t, client, f, annotations, nil)
-	if err.Error() != expectedError {
+	if err != nil && err.Error() != expectedError {
 		t.Fatalf("expected a %s error, got %v", expectedError, err)
 	}
 }
@@ -748,7 +748,9 @@ func testUpdateNodeBalancerWithVPCBackend(t *testing.T, client *linodego.Client,
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 
 	stubServiceUpdate(fakeClientset, svc)
 	svc.SetAnnotations(map[string]string{
@@ -834,7 +836,9 @@ func testCreateNodeBalancerWithVPCOnlySubnetFlag(t *testing.T, client *linodego.
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 
 	stubService(fakeClientset, svc)
 	svc.SetAnnotations(map[string]string{
@@ -927,7 +931,9 @@ func testCreateNodeBalancerWithVPCNoFlagOrAnnotation(t *testing.T, client *linod
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 
 	stubService(fakeClientset, svc)
 	svc.SetAnnotations(map[string]string{
@@ -1017,7 +1023,9 @@ func testCreateNodeBalancerWithVPCAnnotationOnly(t *testing.T, client *linodego.
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 
 	stubServiceUpdate(fakeClientset, svc)
 	svc.SetAnnotations(map[string]string{})
@@ -1101,7 +1109,9 @@ func testCreateNodeBalancerWithVPCOnlySubnetIDFlag(t *testing.T, client *linodeg
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 
 	stubService(fakeClientset, svc)
 
@@ -1247,7 +1257,9 @@ func testUpdateLoadBalancerAddNode(t *testing.T, client *linodego.Client, f *fak
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 
 	stubService(fakeClientset, svc)
 
@@ -1412,7 +1424,9 @@ func testUpdateLoadBalancerAddAnnotation(t *testing.T, client *linodego.Client,
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 
 	stubService(fakeClientset, svc)
 	svc.SetAnnotations(map[string]string{
@@ -1488,7 +1502,9 @@ func testUpdateLoadBalancerAddPortAnnotation(t *testing.T, client *linodego.Clie
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubServiceUpdate(fakeClientset, svc)
 
 	svc.SetAnnotations(map[string]string{
@@ -1601,7 +1617,9 @@ func testVeryLongServiceName(t *testing.T, client *linodego.Client, _ *fakeAPI)
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubServiceUpdate(fakeClientset, svc)
 
 	svc.SetAnnotations(map[string]string{
@@ -1669,7 +1687,9 @@ func testUpdateLoadBalancerAddTags(t *testing.T, client *linodego.Client, _ *fak
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubService(fakeClientset, svc)
 
 	testTags := "test,new,tags"
@@ -1756,7 +1776,9 @@ func testUpdateLoadBalancerAddTLSPort(t *testing.T, client *linodego.Client, _ *
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 
 	stubServiceUpdate(fakeClientset, svc)
 	svc.Spec.Ports = append(svc.Spec.Ports, extraPort)
@@ -1963,7 +1985,9 @@ func testUpdateLoadBalancerAddNewFirewall(t *testing.T, client *linodego.Client,
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubServiceUpdate(fakeClientset, svc)
 	fwClient := services.LinodeClient{Client: client}
 	fw, err := fwClient.CreateFirewall(t.Context(), linodego.FirewallCreateOptions{
@@ -1987,7 +2011,7 @@ func testUpdateLoadBalancerAddNewFirewall(t *testing.T, client *linodego.Client,
 	}()
 
 	svc.SetAnnotations(map[string]string{
-		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID),
+		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID), //nolint:nilaway // fw should not be nil if no err
 	})
 
 	err = lb.UpdateLoadBalancer(t.Context(), "linodelb", svc, nodes)
@@ -2063,7 +2087,9 @@ func testUpdateLoadBalancerAddNewFirewallACL(t *testing.T, client *linodego.Clie
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubService(fakeClientset, svc)
 
 	nb, err := lb.getNodeBalancerByStatus(t.Context(), svc)
@@ -2203,7 +2229,9 @@ func testUpdateLoadBalancerDeleteFirewallRemoveACL(t *testing.T, client *linodeg
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubService(fakeClientset, svc)
 
 	nb, err := lb.getNodeBalancerByStatus(t.Context(), svc)
@@ -2302,7 +2330,9 @@ func testUpdateLoadBalancerUpdateFirewallRemoveACLaddID(t *testing.T, client *li
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubService(fakeClientset, svc)
 
 	nb, err := lb.getNodeBalancerByStatus(t.Context(), svc)
@@ -2350,7 +2380,7 @@ func testUpdateLoadBalancerUpdateFirewallRemoveACLaddID(t *testing.T, client *li
 	}()
 
 	svc.SetAnnotations(map[string]string{
-		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID),
+		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID), //nolint:nilaway // fw should not be nil if no err
 	})
 
 	err = lb.UpdateLoadBalancer(t.Context(), "linodelb", svc, nodes)
@@ -2448,7 +2478,7 @@ func testUpdateLoadBalancerUpdateFirewallRemoveIDaddACL(t *testing.T, client *li
 	}()
 
 	svc.SetAnnotations(map[string]string{
-		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID),
+		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID), //nolint:nilaway // fw should not be nil if no err
 	})
 
 	defer func() {
@@ -2460,7 +2490,9 @@ func testUpdateLoadBalancerUpdateFirewallRemoveIDaddACL(t *testing.T, client *li
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubServiceUpdate(fakeClientset, svc)
 
 	nb, err := lb.getNodeBalancerByStatus(t.Context(), svc)
@@ -2581,7 +2613,9 @@ func testUpdateLoadBalancerUpdateFirewallACL(t *testing.T, client *linodego.Clie
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubService(fakeClientset, svc)
 
 	nb, err := lb.getNodeBalancerByStatus(t.Context(), svc)
@@ -2823,14 +2857,16 @@ func testUpdateLoadBalancerUpdateFirewall(t *testing.T, client *linodego.Client,
 	}()
 
 	svc.SetAnnotations(map[string]string{
-		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID),
+		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID), //nolint:nilaway // fw should not be nil if no err
 	})
 
 	lbStatus, err := lb.EnsureLoadBalancer(t.Context(), "linodelb", svc, nodes)
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubService(fakeClientset, svc)
 
 	nb, err := lb.getNodeBalancerByStatus(t.Context(), svc)
@@ -2956,15 +2992,17 @@ func testUpdateLoadBalancerDeleteFirewallRemoveID(t *testing.T, client *linodego
 	}()
 
 	svc.SetAnnotations(map[string]string{
-		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID),
+		annotations.AnnLinodeCloudFirewallID: strconv.Itoa(fw.ID), //nolint:nilaway // fw should not be nil if no err
 	})
 
 	stubService(fakeClientset, svc)
 	lbStatus, err := lb.EnsureLoadBalancer(t.Context(), "linodelb", svc, nodes)
 	if err != nil {
 		t.Errorf("EnsureLoadBalancer returned an error: %s", err)
 	}
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubServiceUpdate(fakeClientset, svc)
 
 	nb, err := lb.getNodeBalancerByStatus(t.Context(), svc)
@@ -3077,6 +3115,12 @@ func testUpdateLoadBalancerAddReservedIP(t *testing.T, client *linodego.Client,
 	}
 
 	status, _, err := lb.GetLoadBalancer(t.Context(), clusterName, svc)
+	if err != nil {
+		t.Fatalf("failed to get loadbalancer status: %s", err)
+	}
+	if status == nil {
+		t.Fatalf("no loadbalancer status returned")
+	}
 	if status.Ingress[0].IP != initialIP {
 		t.Fatalf("IP should not have changed in service status: %s", err)
 	}
@@ -4334,6 +4378,9 @@ func testEnsureExistingLoadBalancer(t *testing.T, client *linodego.Client, _ *fa
 	if err != nil {
 		t.Fatalf("failed to create nodebalancer: %s", err)
 	}
+	if getLBStatus == nil {
+		t.Fatalf("failed to get nodebalancer")
+	}
 	if !exists {
 		t.Fatal("Node balancer not found")
 	}
@@ -4981,7 +5028,9 @@ func testGetLoadBalancer(t *testing.T, client *linodego.Client, _ *fakeAPI) {
 	defer func() { _ = lb.EnsureLoadBalancerDeleted(t.Context(), "linodelb", svc) }()
 
 	lbStatus := makeLoadBalancerStatus(svc, nb)
-	svc.Status.LoadBalancer = *lbStatus
+	if lbStatus != nil {
+		svc.Status.LoadBalancer = *lbStatus
+	}
 	stubService(fakeClientset, svc)
 	stubService(fakeClientset, svc2)