CNTRLPLANE-4008: feat: add hypershiftlinter golangci-lint plugin

[bryan-cox]

What this PR does / why we need it:

Adds the hypershiftlinter golangci-lint v2 Go plugin: a framework plus 7 static-analysis analyzers that enforce test conventions from TESTING.md and test/e2e/v2/AGENTS.md. This PR introduces and unit-tests the analyzers only — it does not enable enforcement yet. Enablement (wiring into .golangci.yml/make lint) and the mechanical fix-up of existing violations are deferred to a follow-up PR (#9271) so that:

• This PR can be reviewed/merged on its own smaller surface (plugin + analyzers + their tests).
• hack/tools/hypershiftlinter.so and make test-linter land on main first, so the CI workflow that runs the analyzers' own unit tests (test-linter.yaml / test-linter-reusable.yaml) can actually execute on subsequent PRs — a brand-new reusable workflow can't get a green pre-merge run on the PR that introduces it, since GitHub resolves uses: ...@main and the pull_request trigger from the base branch.
• The full "enable + fix all existing violations" change can be reviewed and rolled out separately in CNTRLPLANE-4008: enable hypershiftlinter and fix test naming #9271 without blocking this foundational plumbing.

Commit 1 — Vendor analysistest:

Promotes golang.org/x/tools from indirect to direct in hack/tools/go.mod and vendors the analysistest, checker, diff, testenv, and txtar packages needed by the analyzer test suites.

Commit 2 — Plugin framework:

plugin.go (BuildAnalyzers with optional enable list via settings) and cmd/plugin/main.go (golangci-lint plugin entry point). Builds as a Go shared library (.so) via go build -buildmode=plugin. Adds the hypershiftlinter.so build target, an opt-in hypershift-lint-all target, and a test-linter target to the Makefile. Does not touch make lint/lint-fix — enforcement is intentionally deferred to #9271.

Commit 3 — Analyzers:

7 analyzers split by scope:

• TESTING.md (unit tests only): testcasename, testfuncname
• AGENTS.md (test/e2e/v2/ only): guestcluster, contextbackground, vacuouspass, ipv6url, sippyannotation

Each analyzer has analysistest-based unit tests with good/bad testdata/ fixtures.

Commit 4 — CI workflows:

test-linter.yaml (caller, path-filtered to hack/tools/hypershiftlinter/**) and test-linter-reusable.yaml (runs make test-linter, i.e. go test ./hypershiftlinter/analyzers/...). Named Unit Tests (HyperShift Linter) to match the existing Unit Tests check naming convention. Also switches lint-reusable.yaml from copying pre-built runner-image tools to an actions/cache step keyed on Makefile + go.mod + go.sum + hypershiftlinter source, avoiding the version-mismatch failures that occur when the pre-built golangci-lint host binary and a source-built plugin disagree on golang.org/x/tools.

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-4008

Special notes for your reviewer:

• The plugin builds as a Go shared library (.so) via go build -buildmode=plugin. Plugin and golangci-lint host binary must be compiled from the same hack/tools/go.mod — a golang.org/x/tools version mismatch causes plugin.Open() to fail at runtime.
• hypershiftlinter is not enabled in this PR — .golangci.yml and make lint are unchanged from main. make hypershift-lint-all exists as an opt-in target for manually running the analyzers against the current tree.
• make test-linter runs the analyzers' own unit tests and passes locally with all 7 analyzer packages green.
• Follow-up: #9271 enables the plugin in .golangci.yml/make lint and fixes all resulting test-naming violations. It depends on this PR merging first so hypershiftlinter.so exists.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• New Features

  • Added a HyperShift linter with checks for test naming, annotations, terminology, IPv6-safe URLs, context usage, and ineffective assertions.
  • Added commands to build, run, configure, and test the linter.

• CI

  • Added automated linter test workflows and improved lint-tool caching.

• Documentation

  • Added usage guidance, supported checks, build requirements, and rollout information.

• Tests

  • Added coverage for all new linting rules and supported file patterns.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ce70db9f-f7bf-4b67-b4c9-a2343bc72396

📥 Commits

Reviewing files that changed from the base of the PR and between f4cfd7d and 91e3068.

⛔ Files ignored due to path filters (2)

• hack/tools/hypershiftlinter/analyzers/contextbackground/testdata/src/test/e2e/v2/bad/bad_test.go is excluded by !**/testdata/**
• hack/tools/hypershiftlinter/analyzers/contextbackground/testdata/src/test/e2e/v2/good/good_test.go is excluded by !**/testdata/**

📒 Files selected for processing (1)

• hack/tools/hypershiftlinter/analyzers/contextbackground/contextbackground.go

🚧 Files skipped from review as they are similar to previous changes (1)

• hack/tools/hypershiftlinter/analyzers/contextbackground/contextbackground.go

---

📝 Walkthrough

Walkthrough

This change adds a golangci-lint plugin with seven analyzers for unit-test and v2 E2E test conventions. The plugin supports JSON analyzer selection and provides a golangci-lint entry point. Makefile targets build the plugin and run its tests. GitHub Actions runs linter tests on relevant pull requests and caches lint tools. Documentation describes the analyzers and commands.

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest
  participant GitHubActions
  participant Makefile
  participant HypershiftLinterPlugin
  participant GolangCILint

  PullRequest->>GitHubActions: change linter-related paths
  GitHubActions->>Makefile: run make test-linter
  Makefile->>HypershiftLinterPlugin: execute analyzer tests
  Makefile->>HypershiftLinterPlugin: build plugin with CGO enabled
  GolangCILint->>HypershiftLinterPlugin: call New with settings
  HypershiftLinterPlugin-->>GolangCILint: return configured analyzers

Loading

Mergeability Score: ⚪ Minimal · up to 91e30

This change adds and tests an opt-in linting plugin without changing existing lint enforcement; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the addition of the hypershiftlinter golangci-lint plugin, which is the main change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Changed Ginkgo fixtures use static string titles only; no interpolated values, generated identifiers, IPs, timestamps, or changed production E2E test files were found.
Test Structure And Quality	✅ Passed	All PR test paths are under hypershiftlinter; real tests use testing.T/analysistest, and Ginkgo-like fixtures are no-op analyzer inputs with no cluster operations or waits.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR adds Makefile/CI plumbing, Go analyzers, tests, and documentation; changed files contain no deployment, controller, operator, or Kubernetes scheduling constraints.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Added Ginkgo fixtures contain no IPv4 or external-network use; IPv4 literals occur only in non-Ginkgo static analyzer fixtures and are not runnable e2e tests.
No-Weak-Crypto	✅ Passed	The PR diff adds no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparisons; bytes.Equal only compares serialized analyzer facts.
Container-Privileges	✅ Passed	The aggregate diff adds no container/Kubernetes manifest and no privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, or root-user setting.
No-Sensitive-Data-In-Logs	✅ Passed	The PR diff adds no logging of credentials, PII, internal hostnames, or customer data; its only log.Printf is a static IPv4 test fixture, and analyzer messages contain lint guidance.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cblecker]

/lgtm

[bryan-cox]

/verified later @bryan-cox

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-azure-self-managed
/test e2e-v2-gke

[openshift-ci-robot]

@bryan-cox: This PR has been marked to be verified later by @bryan-cox.

Details

In response to this:

/verified later @bryan-cox

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[bryan-cox]

/override ci/prow/e2e-aks
/override ci/prow/e2e-aws
/override ci/prow/e2e-aws-upgrade-hypershift-operator
/override ci/prow/e2e-kubevirt-aws-ovn-reduced
/override ci/prow/e2e-v2-aws
/override ci/prow/e2e-v2-azure-self-managed
/override ci/prow/e2e-v2-gke

[bryan-cox]

Overrode e2e, this is just linter changes.

[openshift-ci]

@bryan-cox: Overrode contexts on behalf of bryan-cox: ci/prow/e2e-aks, ci/prow/e2e-aws, ci/prow/e2e-aws-upgrade-hypershift-operator, ci/prow/e2e-kubevirt-aws-ovn-reduced, ci/prow/e2e-v2-aws, ci/prow/e2e-v2-azure-self-managed, ci/prow/e2e-v2-gke

Details

In response to this:

/override ci/prow/e2e-aks
/override ci/prow/e2e-aws
/override ci/prow/e2e-aws-upgrade-hypershift-operator
/override ci/prow/e2e-kubevirt-aws-ovn-reduced
/override ci/prow/e2e-v2-aws
/override ci/prow/e2e-v2-azure-self-managed
/override ci/prow/e2e-v2-gke

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD f7e85cc and 2 for PR HEAD 91e3068 in total

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD cd26599 and 1 for PR HEAD 91e3068 in total

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD ea98bde and 0 for PR HEAD 91e3068 in total

[openshift-merge-bot]

/hold

Revision 91e3068 was retested 3 times: holding

[bryan-cox]

/override "ci/prow/e2e-v2-azure-self-managed"
/override "ci/prow/e2e-kubevirt-aws-ovn-reduced"

These tests are failing outside this PR and these most recent failures are not from this PR. Moving this PR forward so I can work on enabling the linter and fixing the linter issues.

[bryan-cox]

/hold cancel

[openshift-ci]

@bryan-cox: Overrode contexts on behalf of bryan-cox: ci/prow/e2e-kubevirt-aws-ovn-reduced, ci/prow/e2e-v2-azure-self-managed

Details

In response to this:

/override "ci/prow/e2e-v2-azure-self-managed"
/override "ci/prow/e2e-kubevirt-aws-ovn-reduced"

These tests are failing outside this PR and these most recent failures are not from this PR. Moving this PR forward so I can work on enabling the linter and fixing the linter issues.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[bryan-cox]

/override "Red Hat Konflux / hypershift-operator-enterprise-contract / hypershift-operator-main"

[bryan-cox]

/override "Red Hat Konflux / hypershift-operator-main-enterprise-contract / hypershift-operator-main"

[openshift-ci]

@bryan-cox: Overrode contexts on behalf of bryan-cox: Red Hat Konflux / hypershift-operator-enterprise-contract / hypershift-operator-main

Details

In response to this:

/override "Red Hat Konflux / hypershift-operator-enterprise-contract / hypershift-operator-main"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@bryan-cox: Overrode contexts on behalf of bryan-cox: Red Hat Konflux / hypershift-operator-main-enterprise-contract / hypershift-operator-main

Details

In response to this:

/override "Red Hat Konflux / hypershift-operator-main-enterprise-contract / hypershift-operator-main"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.