Add gosimports (#1205)

.github/workflows/update-bootstrap-tools.yml

@@ -26,6 +26,7 @@ jobs:
           BOUNCER_LATEST_VERSION=$(go list -m -json github.com/wagoodman/go-bouncer@latest 2>/dev/null | jq -r '.Version')
           CHRONICLE_LATEST_VERSION=$(go list -m -json github.com/anchore/chronicle@latest 2>/dev/null | jq -r '.Version')
           GORELEASER_LATEST_VERSION=$(go list -m -json github.com/goreleaser/goreleaser@latest 2>/dev/null | jq -r '.Version')
+          GOSIMPORTS_LATEST_VERSION=$(go list -m -json github.com/rinchsan/gosimports@latest 2>/dev/null | jq -r '.Version')
           YAJSV_LATEST_VERSION=$(go list -m -json github.com/neilpa/yajsv@latest 2>/dev/null | jq -r '.Version')
           COSIGN_LATEST_VERSION=$(go list -m -json github.com/sigstore/cosign@latest 2>/dev/null | jq -r '.Version')
           
@@ -34,6 +35,7 @@ jobs:
           sed -r -i -e 's/^(BOUNCER_VERSION = ).*/\1'${BOUNCER_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(CHRONICLE_VERSION = ).*/\1'${CHRONICLE_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(GORELEASER_VERSION = ).*/\1'${GORELEASER_LATEST_VERSION}'/' Makefile
+          sed -r -i -e 's/^(GOSIMPORTS_VERSION = ).*/\1'${GOSIMPORTS_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(YAJSV_VERSION = ).*/\1'${YAJSV_LATEST_VERSION}'/' Makefile
           sed -r -i -e 's/^(COSIGN_VERSION = ).*/\1'${COSIGN_LATEST_VERSION}'/' Makefile
           
@@ -46,6 +48,7 @@ jobs:
           echo "::set-output name=BOUNCER::$BOUNCER_LATEST_VERSION"
           echo "::set-output name=CHRONICLE::$CHRONICLE_LATEST_VERSION"
           echo "::set-output name=GORELEASER::$GORELEASER_LATEST_VERSION"
+          echo "::set-output name=GOSIMPORTS::$GOSIMPORTS_LATEST_VERSION"
           echo "::set-output name=YAJSV::$YAJSV_LATEST_VERSION"
           echo "::set-output name=COSIGN::$COSIGN_LATEST_VERSION"
         id: latest-versions
@@ -69,6 +72,7 @@ jobs:
             - [bouncer ${{ steps.latest-versions.outputs.BOUNCER }}](https://github.com/wagoodman/go-bouncer/releases/tag/${{ steps.latest-versions.outputs.BOUNCER }})
             - [chronicle ${{ steps.latest-versions.outputs.CHRONICLE }}](https://github.com/anchore/chronicle/releases/tag/${{ steps.latest-versions.outputs.CHRONICLE }})
             - [goreleaser ${{ steps.latest-versions.outputs.GORELEASER }}](https://github.com/goreleaser/goreleaser/releases/tag/${{ steps.latest-versions.outputs.GORELEASER }})
+            - [gosimports ${{ steps.latest-versions.outputs.GOSIMPORTS }}](https://github.com/rinchsan/gosimports/releases/tag/${{ steps.latest-versions.outputs.GOSIMPORTS }})
             - [yajsv ${{ steps.latest-versions.outputs.YAJSV }}](https://github.com/neilpa/yajsv/releases/tag/${{ steps.latest-versions.outputs.YAJSV }})
             - [cosign ${{ steps.latest-versions.outputs.COSIGN }}](https://github.com/sigstore/cosign/releases/tag/${{ steps.latest-versions.outputs.COSIGN }})  
             This is an auto-generated pull request to update all of the bootstrap tools to the latest versions.

.golangci.yaml

@@ -22,7 +22,6 @@ linters:
     - gocritic
     - gocyclo
     - gofmt
-    - goimports
     - goprintffuncname
     - gosec
     - gosimple
@@ -49,6 +48,7 @@ linters:
 #    - godot
 #    - godox
 #    - goerr113
+#    - goimports   # we're using gosimports now instead to account for extra whitespaces (see https://github.com/golang/go/issues/20818)
 #    - golint      # deprecated
 #    - gomnd       # this is too aggressive
 #    - interfacer  # this is a good idea, but is no longer supported and is prone to false positives

Makefile

@@ -4,6 +4,7 @@ RESULTSDIR = test/results
 COVER_REPORT = $(RESULTSDIR)/unit-coverage-details.txt
 COVER_TOTAL = $(RESULTSDIR)/unit-coverage-summary.txt
 LINTCMD = $(TEMPDIR)/golangci-lint run --tests=false --timeout=4m --config .golangci.yaml
+GOIMPORTS_CMD = $(TEMPDIR)/gosimports -local github.com/anchore
 RELEASE_CMD=$(TEMPDIR)/goreleaser release --rm-dist
 SNAPSHOT_CMD=$(RELEASE_CMD) --skip-publish --snapshot
 VERSION=$(shell git describe --dirty --always --tags)
@@ -12,6 +13,7 @@ COMPARE_DIR = ./test/compare
 GOLANGCILINT_VERSION = v1.49.0
 BOUNCER_VERSION = v0.4.0
 CHRONICLE_VERSION = v0.4.1
+GOSIMPORTS_VERSION = v0.3.1
 GORELEASER_VERSION = v1.11.2
 YAJSV_VERSION = v1.4.0
 COSIGN_VERSION = v1.11.1
@@ -116,6 +118,8 @@ bootstrap-tools: $(TEMPDIR)
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ $(BOUNCER_VERSION)
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ $(CHRONICLE_VERSION)
 	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ $(GORELEASER_VERSION)
+	# the only difference between goimports and gosimports is that gosimports removes extra whitespace between import blocks (see https://github.com/golang/go/issues/20818)
+	GOBIN="$(realpath $(TEMPDIR))" go install github.com/rinchsan/gosimports/cmd/gosimports@$(GOSIMPORTS_VERSION)
 	GOBIN="$(realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@$(YAJSV_VERSION)
 	GOBIN="$(realpath $(TEMPDIR))" go install github.com/sigstore/cosign/cmd/cosign@$(COSIGN_VERSION)
 
@@ -139,6 +143,7 @@ lint: ## Run gofmt + golangci lint checks
 
 	# run all golangci-lint rules
 	$(LINTCMD)
+	@[ -z "$(shell $(GOIMPORTS_CMD) -d .)" ] || (echo "goimports needs to be fixed" && false)
 
 	# go tooling does not play well with certain filename characters, ensure the common cases don't result in future "go get" failures
 	$(eval MALFORMED_FILENAMES := $(shell find . | grep -e ':'))
@@ -148,6 +153,7 @@ lint: ## Run gofmt + golangci lint checks
 lint-fix: ## Auto-format all source code + run golangci lint fixers
 	$(call title,Running lint fixers)
 	gofmt -w -s .
+	$(GOIMPORTS_CMD) -w .
 	$(LINTCMD) --fix
 	go mod tidy
 

cmd/syft/cli/attest.go

@@ -4,14 +4,14 @@ import (
 	"fmt"
 	"log"
 
+	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/attest"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-
-	sigopts "github.com/sigstore/cosign/cmd/cosign/cli/options"
 )
 
 const (

cmd/syft/cli/attest/attest.go

@@ -7,24 +7,6 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/wagoodman/go-progress"
-
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/stereoscope/pkg/image"
-	"github.com/anchore/syft/cmd/syft/cli/eventloop"
-	"github.com/anchore/syft/cmd/syft/cli/options"
-	"github.com/anchore/syft/cmd/syft/cli/packages"
-	"github.com/anchore/syft/internal/bus"
-	"github.com/anchore/syft/internal/config"
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft"
-	"github.com/anchore/syft/syft/event"
-	"github.com/anchore/syft/syft/formats/cyclonedxjson"
-	"github.com/anchore/syft/syft/formats/spdx22json"
-	"github.com/anchore/syft/syft/formats/syftjson"
-	"github.com/anchore/syft/syft/sbom"
-	"github.com/anchore/syft/syft/source"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/in-toto/in-toto-golang/in_toto"
@@ -43,9 +25,26 @@ import (
 	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
+	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
 	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
 
-	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
+	"github.com/anchore/stereoscope"
+	"github.com/anchore/stereoscope/pkg/image"
+	"github.com/anchore/syft/cmd/syft/cli/eventloop"
+	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/anchore/syft/cmd/syft/cli/packages"
+	"github.com/anchore/syft/internal/bus"
+	"github.com/anchore/syft/internal/config"
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft"
+	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/formats/cyclonedxjson"
+	"github.com/anchore/syft/syft/formats/spdx22json"
+	"github.com/anchore/syft/syft/formats/syftjson"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
 )
 
 var (

cmd/syft/cli/attest/password.go

@@ -7,9 +7,10 @@ import (
 	"os"
 	"strings"
 
+	"github.com/sigstore/cosign/pkg/cosign"
+
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
-	"github.com/sigstore/cosign/pkg/cosign"
 )
 
 func selectPassFunc(keypath, password string) (cosign.PassFunc, error) {

cmd/syft/cli/commands.go

@@ -4,22 +4,22 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/anchore/stereoscope"
-	"github.com/anchore/syft/internal/logger"
-	"github.com/anchore/syft/syft"
+	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
+	"github.com/gookit/color"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"github.com/wagoodman/go-partybus"
 
+	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/logger"
 	"github.com/anchore/syft/internal/version"
+	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/event"
-	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
-	"github.com/gookit/color"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"github.com/wagoodman/go-partybus"
 )
 
 const indent = "  "

cmd/syft/cli/convert.go

@@ -4,12 +4,13 @@ import (
 	"fmt"
 	"log"
 
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/convert"
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 const (

cmd/syft/cli/eventloop/event_loop.go

@@ -5,10 +5,11 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/ui"
 	"github.com/hashicorp/go-multierror"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/log"
+	"github.com/anchore/syft/internal/ui"
 )
 
 // eventLoop listens to worker errors (from execution path), worker events (from a partybus subscription), and

cmd/syft/cli/eventloop/event_loop_test.go

@@ -7,11 +7,12 @@ import (
 	"testing"
 	"time"
 
-	"github.com/anchore/syft/internal/ui"
-	"github.com/anchore/syft/syft/event"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/wagoodman/go-partybus"
+
+	"github.com/anchore/syft/internal/ui"
+	"github.com/anchore/syft/syft/event"
 )
 
 var _ ui.UI = (*uiMock)(nil)

cmd/syft/cli/options/packages.go

@@ -3,13 +3,14 @@ package options
 import (
 	"fmt"
 
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/formats/table"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 	"github.com/anchore/syft/syft/source"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-	"github.com/spf13/viper"
 )
 
 type PackagesOptions struct {

cmd/syft/cli/options/writer.go

@@ -4,11 +4,12 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/hashicorp/go-multierror"
+
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/formats/table"
 	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
-	"github.com/hashicorp/go-multierror"
 )
 
 // makeWriter creates a sbom.Writer for output or returns an error. this will either return a valid writer

cmd/syft/cli/packages.go

@@ -4,13 +4,13 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/anchore/syft/cmd/syft/cli/options"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 
+	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/packages"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 const (

cmd/syft/cli/packages/packages.go

@@ -6,6 +6,8 @@ import (
 	"io/ioutil"
 	"os"
 
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
@@ -22,7 +24,6 @@ import (
 	"github.com/anchore/syft/syft/formats/template"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/wagoodman/go-partybus"
 )
 
 func Run(ctx context.Context, app *config.Application, args []string) error {

cmd/syft/cli/poweruser.go

@@ -3,12 +3,13 @@ package cli
 import (
 	"fmt"
 
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/cmd/syft/cli/poweruser"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 const powerUserExample = `  {{.appName}} {{.command}} <image>

cmd/syft/cli/poweruser/poweruser.go

@@ -5,6 +5,9 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/gookit/color"
+	"github.com/wagoodman/go-partybus"
+
 	"github.com/anchore/stereoscope"
 	"github.com/anchore/syft/cmd/syft/cli/eventloop"
 	"github.com/anchore/syft/cmd/syft/cli/options"
@@ -21,8 +24,6 @@ import (
 	"github.com/anchore/syft/syft/formats/syftjson"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
-	"github.com/gookit/color"
-	"github.com/wagoodman/go-partybus"
 )
 
 func Run(ctx context.Context, app *config.Application, args []string) error {

cmd/syft/cli/version.go

@@ -6,12 +6,13 @@ import (
 	"log"
 	"os"
 
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
 	"github.com/anchore/syft/cmd/syft/cli/options"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/config"
 	"github.com/anchore/syft/internal/version"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 func Version(v *viper.Viper, app *config.Application) *cobra.Command {

internal/anchore/import.go

@@ -6,14 +6,15 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/antihax/optional"
+	"github.com/wagoodman/go-partybus"
+	"github.com/wagoodman/go-progress"
+
 	"github.com/anchore/client-go/pkg/external"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/internal/bus"
 	"github.com/anchore/syft/syft/event"
 	"github.com/anchore/syft/syft/sbom"
-	"github.com/antihax/optional"
-	"github.com/wagoodman/go-partybus"
-	"github.com/wagoodman/go-progress"
 )
 
 type ImportConfig struct {

internal/anchore/import_config_test.go

@@ -8,11 +8,11 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/docker/docker/pkg/ioutils"
+	"github.com/go-test/deep"
 	"github.com/wagoodman/go-progress"
 
 	"github.com/anchore/client-go/pkg/external"
-	"github.com/docker/docker/pkg/ioutils"
-	"github.com/go-test/deep"
 )
 
 type mockConfigImportAPI struct {