Repository: kubernetes-sigs/security-profiles-operator
Pull request #1605 (2023-04-06 09:22:22)

Update golangci-lint and config



#### What type of PR is this?


/kind cleanup


#### What this PR does / why we need it:
This also fixes the new reported lints.

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1605#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1605#pullrequestreview-1374591088" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1605#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.golangci.yml b/.golangci.yml
index 1665524b1..11ca7acd7 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -137,115 +137,109 @@ linters-settings:
       - HACK
   gocritic:
     enabled-checks:
-      # Diagnostic
       - appendAssign
+      - appendCombine
       - argOrder
+      - assignOp
       - badCall
       - badCond
       - badLock
       - badRegexp
       - badSorting
+      - boolExprSimplify
+      - builtinShadow
       - builtinShadowDecl
+      - captLocal
       - caseOrder
       - codegenComment
+      - commentFormatting
       - commentedOutCode
+      - commentedOutImport
+      - defaultCaseOrder
       - deferInLoop
+      - deferUnlambda
       - deprecatedComment
+      - docStub
       - dupArg
       - dupBranchBody
       - dupCase
+      - dupImport
       - dupSubExpr
       - dynamicFmtString
+      - elseif
       - emptyDecl
+      - emptyFallthrough
+      - emptyStringTest
+      - equalFold
       - evalOrder
       - exitAfterDefer
+      - exposedSyncMutex
       - externalErrorReassign
       - filepathJoin
       - flagDeref
       - flagName
+      - hexLiteral
+      - httpNoBody
+      - hugeParam
+      - ifElseChain
+      - importShadow
+      - indexAlloc
+      - initClause
       - mapKey
+      - methodExprCall
+      - nestingReduce
+      - newDeref
       - nilValReturn
+      - octalLiteral
       - offBy1
-      - regexpPattern
-      - returnAfterHttpError
-      - sloppyReassign
-      - sloppyTypeAssert
-      - sortSlice
-      - sprintfQuotedString
-      - sqlQuery
-      - syncMapLoadAndDelete
-      - truncateCmp
-      - unnecessaryDefer
-      - weakCond
-
-      # Performance
-      - appendCombine
-      - equalFold
-      - hugeParam
-      - indexAlloc
+      - paramTypeCombine
       - preferDecodeRune
+      - preferFilepathJoin
       - preferFprint
       - preferStringWriter
       - preferWriteByte
+      - ptrToRefParam
       - rangeExprCopy
       - rangeValCopy
-      - sliceClear
-      - stringXbytes
-
-      # Style
-      - assignOp
-      - boolExprSimplify
-      - captLocal
-      - commentFormatting
-      - commentedOutImport
-      - defaultCaseOrder
-      - deferUnlambda
-      - docStub
-      - dupImport
-      - elseif
-      - emptyFallthrough
-      - emptyStringTest
-      - exposedSyncMutex
-      - hexLiteral
-      - httpNoBody
-      - ifElseChain
-      - ioutilDeprecated
-      - methodExprCall
-      - newDeref
-      - octalLiteral
-      - preferFilepathJoin
       - redundantSprint
       - regexpMust
+      - regexpPattern
       - regexpSimplify
+      - returnAfterHttpError
       - ruleguard
       - singleCaseSwitch
+      - sliceClear
       - sloppyLen
+      - sloppyReassign
+      - sloppyTestFuncName
+      - sloppyTypeAssert
+      - sortSlice
+      - sprintfQuotedString
+      - sqlQuery
       - stringConcatSimplify
+      - stringXbytes
       - stringsCompare
       - switchTrue
+      - syncMapLoadAndDelete
       - timeCmpSimplify
       - timeExprSimplify
       - todoCommentWithoutDetail
       - tooManyResultsChecker
+      - truncateCmp
       - typeAssertChain
       - typeDefFirst
       - typeSwitchVar
+      - typeUnparen
+      - uncheckedInlineErr
       - underef
       - unlabelStmt
       - unlambda
+      - unnamedResult
+      - unnecessaryBlock
+      - unnecessaryDefer
       - unslice
       - valSwap
+      - weakCond
       - whyNoLint
       - wrapperFunc
       - yodaStyleExpr
-
-      # Opinionated
-      - builtinShadow
-      - importShadow
-      - initClause
-      - nestingReduce
-      - paramTypeCombine
-      - ptrToRefParam
-      - typeUnparen
-      - unnamedResult
-      - unnecessaryBlock
diff --git a/Makefile b/Makefile
index d5b4101fe..18e2d784d 100644
--- a/Makefile
+++ b/Makefile
@@ -14,7 +14,7 @@
 
 GO ?= go
 
-GOLANGCI_LINT_VERSION = v1.51.1
+GOLANGCI_LINT_VERSION = v1.52.2
 REPO_INFRA_VERSION = v0.2.5
 KUSTOMIZE_VERSION = 5.0.0
 OPERATOR_SDK_VERSION ?= v1.25.0
diff --git a/dependencies.yaml b/dependencies.yaml
index 66867f2fc..5117c48c2 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -20,7 +20,7 @@ dependencies:
       match: CI_IMAGE
 
   - name: golangci-lint
-    version: 1.51.1
+    version: 1.52.2
     refPaths:
     - path: Makefile
       match: GOLANGCI_LINT_VERSION
diff --git a/internal/pkg/cli/logsink.go b/internal/pkg/cli/logsink.go
index 1cc859a77..0bf3ca963 100644
--- a/internal/pkg/cli/logsink.go
+++ b/internal/pkg/cli/logsink.go
@@ -28,12 +28,12 @@ type LogSink struct{}
 
 // Init receives optional information about the logr library for LogSink
 // implementations that need it.
-func (*LogSink) Init(info logr.RuntimeInfo) {}
+func (*LogSink) Init(logr.RuntimeInfo) {}
 
 // Enabled tests whether this LogSink is enabled at the specified V-level.
 // For example, commandline flags might be used to set the logging
 // verbosity and disable some info logs.
-func (*LogSink) Enabled(level int) bool {
+func (*LogSink) Enabled(int) bool {
 	return true
 }
 
@@ -41,7 +41,7 @@ func (*LogSink) Enabled(level int) bool {
 // The level argument is provided for optional logging.  This method will
 // only be called when Enabled(level) is true. See Logger.Info for more
 // details.
-func (l *LogSink) Info(level int, msg string, keysAndValues ...interface{}) {
+func (l *LogSink) Info(_ int, msg string, keysAndValues ...interface{}) {
 	l.Print(msg, nil, keysAndValues...)
 }
 
@@ -79,12 +79,12 @@ func (*LogSink) Print(msg string, err error, keysAndValues ...interface{}) {
 
 // WithValues returns a new LogSink with additional key/value pairs.  See
 // Logger.WithValues for more details.
-func (*LogSink) WithValues(keysAndValues ...interface{}) logr.LogSink {
+func (*LogSink) WithValues(...interface{}) logr.LogSink {
 	return &LogSink{}
 }
 
 // WithName returns a new LogSink with the specified name appended.  See
 // Logger.WithName for more details.
-func (l *LogSink) WithName(name string) logr.LogSink {
+func (l *LogSink) WithName(string) logr.LogSink {
 	return &LogSink{}
 }
diff --git a/internal/pkg/daemon/apparmorprofile/apparmor_supported.go b/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
index 1681ce024..bfaa5e941 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
@@ -81,7 +81,7 @@ func (a *aaProfileManager) CustomResourceTypeName() string {
 	return customResourceTypeName
 }
 
-func loadProfile(logger logr.Logger, name, content string) (bool, error) {
+func loadProfile(_ logr.Logger, name, content string) (bool, error) {
 	mount := hostop.NewMountHostOp(hostop.WithAssumeContainer())
 	a := aa.NewAppArmor()
 
diff --git a/internal/pkg/daemon/apparmorprofile/apparmor_unsupported.go b/internal/pkg/daemon/apparmorprofile/apparmor_unsupported.go
index bb29f9d2a..80c6e3e83 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmor_unsupported.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmor_unsupported.go
@@ -33,18 +33,18 @@ func (a *aaProfileManager) Enabled() bool {
 	return false
 }
 
-func (a *aaProfileManager) RemoveProfile(bp profilebasev1alpha1.StatusBaseUser) error {
+func (a *aaProfileManager) RemoveProfile(profilebasev1alpha1.StatusBaseUser) error {
 	return errAppArmorNotSupported
 }
 
-func (a *aaProfileManager) InstallProfile(bp profilebasev1alpha1.StatusBaseUser) (bool, error) {
+func (a *aaProfileManager) InstallProfile(profilebasev1alpha1.StatusBaseUser) (bool, error) {
 	return false, errAppArmorNotSupported
 }
 
-func loadProfile(logger logr.Logger, name, content string) (bool, error) {
+func loadProfile(logr.Logger, string, string) (bool, error) {
 	return false, errAppArmorNotSupported
 }
 
-func removeProfile(logger logr.Logger, profileName string) error {
+func removeProfile(logr.Logger, string) error {
 	return errAppArmorNotSupported
 }
diff --git a/internal/pkg/daemon/apparmorprofile/setup.go b/internal/pkg/daemon/apparmorprofile/setup.go
index 8579cd19a..9997c2e30 100644
--- a/internal/pkg/daemon/apparmorprofile/setup.go
+++ b/internal/pkg/daemon/apparmorprofile/setup.go
@@ -27,7 +27,7 @@ import (
 
 // Setup adds a controller that reconciles AppArmor profiles.
 func (r *Reconciler) Setup(
-	ctx context.Context,
+	_ context.Context,
 	mgr ctrl.Manager,
 	met *metrics.Metrics,
 ) error {
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
index 1d808829b..2d6ca8818 100644
--- a/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
+++ b/internal/pkg/daemon/bpfrecorder/bpfrecorder.go
@@ -242,7 +242,7 @@ func Dial() (*grpc.ClientConn, context.CancelFunc, error) {
 }
 
 func (b *BpfRecorder) Start(
-	ctx context.Context, r *api.EmptyRequest,
+	context.Context, *api.EmptyRequest,
 ) (*api.EmptyResponse, error) {
 	if b.startRequests == 0 {
 		b.logger.Info("Starting bpf recorder")
@@ -259,7 +259,7 @@ func (b *BpfRecorder) Start(
 }
 
 func (b *BpfRecorder) Stop(
-	ctx context.Context, r *api.EmptyRequest,
+	context.Context, *api.EmptyRequest,
 ) (*api.EmptyResponse, error) {
 	if b.startRequests == 0 {
 		b.logger.Info("bpf recorder not running")
@@ -278,7 +278,7 @@ func (b *BpfRecorder) Stop(
 
 // SyscallsForProfile returns the syscall names for the provided profile name.
 func (b *BpfRecorder) SyscallsForProfile(
-	ctx context.Context, r *api.ProfileRequest,
+	_ context.Context, r *api.ProfileRequest,
 ) (*api.SyscallsResponse, error) {
 	if b.startRequests == 0 {
 		return nil, errors.New("bpf recorder not running")
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder_unsupported.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder_unsupported.go
index 708aa2589..45b73046f 100644
--- a/internal/pkg/daemon/bpfrecorder/bpfrecorder_unsupported.go
+++ b/internal/pkg/daemon/bpfrecorder/bpfrecorder_unsupported.go
@@ -35,7 +35,7 @@ var errUnsupported = errors.New("binary got compiled without bpf recorder suppor
 type BpfRecorder struct{}
 
 // New returns a new BpfRecorder instance.
-func New(logger logr.Logger) *BpfRecorder {
+func New(logr.Logger) *BpfRecorder {
 	return &BpfRecorder{}
 }
 
@@ -51,20 +51,20 @@ func Dial() (*grpc.ClientConn, context.CancelFunc, error) {
 }
 
 func (b *BpfRecorder) Start(
-	ctx context.Context, r *api.EmptyRequest,
+	context.Context, *api.EmptyRequest,
 ) (*api.EmptyResponse, error) {
 	return nil, errUnsupported
 }
 
 func (b *BpfRecorder) Stop(
-	ctx context.Context, r *api.EmptyRequest,
+	context.Context, *api.EmptyRequest,
 ) (*api.EmptyResponse, error) {
 	return nil, errUnsupported
 }
 
 // SyscallsForNamespace returns the syscall names for the provided PID.
 func (b *BpfRecorder) SyscallsForProfile(
-	ctx context.Context, r *api.ProfileRequest,
+	context.Context, *api.ProfileRequest,
 ) (*api.SyscallsResponse, error) {
 	return nil, errUnsupported
 }
diff --git a/internal/pkg/daemon/bpfrecorder/generate/main.go b/internal/pkg/daemon/bpfrecorder/generate/main.go
index e1cf505e3..db640a9f9 100644
--- a/internal/pkg/daemon/bpfrecorder/generate/main.go
+++ b/internal/pkg/daemon/bpfrecorder/generate/main.go
@@ -103,7 +103,7 @@ func generateBpfObj(builder *strings.Builder) error {
 	builder.WriteString("var bpfObjects = map[string][]byte{\n")
 
 	for _, arch := range []string{"amd64", "arm64"} {
-		builder.WriteString(fmt.Sprintf("%q: {\n", arch))
+		fmt.Fprintf(builder, "%q: {\n", arch)
 
 		file, err := os.ReadFile(filepath.Join(buildDir, bpfObj+"."+arch))
 		if err != nil {
@@ -112,7 +112,7 @@ func generateBpfObj(builder *strings.Builder) error {
 
 		size := len(file)
 		for k, v := range file {
-			builder.WriteString(fmt.Sprint(v))
+			fmt.Fprint(builder, v)
 
 			if k < size-1 {
 				builder.WriteString(", ")
diff --git a/internal/pkg/daemon/enricher/container.go b/internal/pkg/daemon/enricher/container.go
index 2c0c43a1f..4e35ec098 100644
--- a/internal/pkg/daemon/enricher/container.go
+++ b/internal/pkg/daemon/enricher/container.go
@@ -95,11 +95,7 @@ func (e *Enricher) populateContainerPodCache(
 				e.populateCacheEntryForContainer(ctx, pod, eg)
 			}
 
-			if werr := eg.Wait(); werr != nil {
-				return werr
-			}
-
-			return nil
+			return eg.Wait()
 		},
 		func(inErr error) bool {
 			return errors.Is(inErr, errContainerIDEmpty)
diff --git a/internal/pkg/daemon/enricher/grpc.go b/internal/pkg/daemon/enricher/grpc.go
index 70b611c9f..777b77198 100644
--- a/internal/pkg/daemon/enricher/grpc.go
+++ b/internal/pkg/daemon/enricher/grpc.go
@@ -39,7 +39,7 @@ const (
 
 // Syscalls returns the syscalls for a provided profile.
 func (e *Enricher) Syscalls(
-	ctx context.Context, r *api.SyscallsRequest,
+	_ context.Context, r *api.SyscallsRequest,
 ) (*api.SyscallsResponse, error) {
 	syscalls, ok := e.syscalls.Load(r.GetProfile())
 	if !ok {
@@ -58,7 +58,7 @@ func (e *Enricher) Syscalls(
 
 // ResetSyscalls removes the syscalls for a provided profile.
 func (e *Enricher) ResetSyscalls(
-	ctx context.Context, r *api.SyscallsRequest,
+	_ context.Context, r *api.SyscallsRequest,
 ) (*api.EmptyResponse, error) {
 	e.syscalls.Delete(r.GetProfile())
 	return &api.EmptyResponse{}, nil
@@ -66,7 +66,7 @@ func (e *Enricher) ResetSyscalls(
 
 // Avcs returns the AVC messages for a provided profile.
 func (e *Enricher) Avcs(
-	ctx context.Context, r *api.AvcRequest,
+	_ context.Context, r *api.AvcRequest,
 ) (*api.AvcResponse, error) {
 	avcs, ok := e.avcs.Load(r.GetProfile())
 	if !ok {
@@ -94,7 +94,7 @@ func (e *Enricher) Avcs(
 
 // ResetAvcs removes the avcs for a provided profile.
 func (e *Enricher) ResetAvcs(
-	ctx context.Context, r *api.AvcRequest,
+	_ context.Context, r *api.AvcRequest,
 ) (*api.EmptyResponse, error) {
 	e.avcs.Delete(r.GetProfile())
 	return &api.EmptyResponse{}, nil
diff --git a/internal/pkg/daemon/enricher/syscall_unsupported.go b/internal/pkg/daemon/enricher/syscall_unsupported.go
index a1f045e1f..0fa67c9c2 100644
--- a/internal/pkg/daemon/enricher/syscall_unsupported.go
+++ b/internal/pkg/daemon/enricher/syscall_unsupported.go
@@ -24,6 +24,6 @@ import "errors"
 var errUnsupportedPlatform = errors.New("unsupported platform")
 
 // syscallName returns the syscall name for the provided ID.
-func syscallName(id int32) (string, error) {
+func syscallName(int32) (string, error) {
 	return "", errUnsupportedPlatform
 }
diff --git a/internal/pkg/daemon/profilerecorder/profilerecorder.go b/internal/pkg/daemon/profilerecorder/profilerecorder.go
index b8b1ad7c5..9415aff48 100644
--- a/internal/pkg/daemon/profilerecorder/profilerecorder.go
+++ b/internal/pkg/daemon/profilerecorder/profilerecorder.go
@@ -122,7 +122,7 @@ func (r *RecorderReconciler) SchemeBuilder() *scheme.Builder {
 func (r *RecorderReconciler) Setup(
 	ctx context.Context,
 	mgr ctrl.Manager,
-	met *metrics.Metrics,
+	_ *metrics.Metrics,
 ) error {
 	const name = "profilerecorder"
 	c, err := r.NewClient(mgr)
@@ -704,9 +704,8 @@ func (r *RecorderReconciler) collectBpfProfiles(
 			if grpcstatus.Convert(err).Message() == bpfrecorder.ErrNotFound.Error() {
 				r.log.Error(err, "Recorded profile not found", "name", profile.name)
 				continue
-			} else {
-				return fmt.Errorf("get syscalls for profile: %w", err)
 			}
+			return fmt.Errorf("get syscalls for profile: %w", err)
 		}
 
 		arch, err := r.goArchToSeccompArch(response.GoArch)
diff --git a/internal/pkg/daemon/seccompprofile/impl.go b/internal/pkg/daemon/seccompprofile/impl.go
index 8c4fc233b..5cacef062 100644
--- a/internal/pkg/daemon/seccompprofile/impl.go
+++ b/internal/pkg/daemon/seccompprofile/impl.go
@@ -45,7 +45,7 @@ type impl interface {
 }
 
 func (*defaultImpl) Pull(
-	ctx context.Context, l logr.Logger, from, username, password string,
+	ctx context.Context, l logr.Logger, from, _, _ string,
 ) (*artifact.PullResult, error) {
 	return artifact.New(l).Pull(ctx, from, "", "")
 }
diff --git a/internal/pkg/daemon/seccompprofile/seccompprofile.go b/internal/pkg/daemon/seccompprofile/seccompprofile.go
index a9a8d8f3b..55797cccc 100644
--- a/internal/pkg/daemon/seccompprofile/seccompprofile.go
+++ b/internal/pkg/daemon/seccompprofile/seccompprofile.go
@@ -163,7 +163,7 @@ func (AllowedSyscallsChangedPredicate) Update(e event.UpdateEvent) bool {
 
 // Setup adds a controller that reconciles seccomp profiles.
 func (r *Reconciler) Setup(
-	ctx context.Context,
+	_ context.Context,
 	mgr ctrl.Manager,
 	met *metrics.Metrics,
 ) error {
@@ -351,7 +351,7 @@ func (r *Reconciler) resolveSyscallsForProfile(
 		return inputSyscalls, nil
 	}
 
-	baseProfile := &seccompprofileapi.SeccompProfile{}
+	var baseProfile *seccompprofileapi.SeccompProfile
 
 	if strings.HasPrefix(baseProfileName, config.OCIProfilePrefix) {
 		// Pull remote base profile from an OCI artifact registry
diff --git a/internal/pkg/daemon/selinuxprofile/common_controller.go b/internal/pkg/daemon/selinuxprofile/common_controller.go
index 6be84794a..c732fd35e 100644
--- a/internal/pkg/daemon/selinuxprofile/common_controller.go
+++ b/internal/pkg/daemon/selinuxprofile/common_controller.go
@@ -101,7 +101,7 @@ type ReconcileSelinux struct {
 
 // Setup adds a controller that reconciles selinux profiles.
 func (r *ReconcileSelinux) Setup(
-	ctx context.Context,
+	_ context.Context,
 	mgr ctrl.Manager,
 	met *metrics.Metrics,
 ) error {
diff --git a/internal/pkg/manager/nodestatus/setup.go b/internal/pkg/manager/nodestatus/setup.go
index 188484244..d497b40ae 100644
--- a/internal/pkg/manager/nodestatus/setup.go
+++ b/internal/pkg/manager/nodestatus/setup.go
@@ -27,9 +27,9 @@ import (
 
 // Setup adds a controller that reconciles the SPOd DaemonSet.
 func (r *StatusReconciler) Setup(
-	ctx context.Context,
+	_ context.Context,
 	mgr ctrl.Manager,
-	met *metrics.Metrics,
+	_ *metrics.Metrics,
 ) error {
 	r.client = mgr.GetClient()
 	r.log = ctrl.Log.WithName(r.Name())
diff --git a/internal/pkg/manager/spod/bindata/ca.go b/internal/pkg/manager/spod/bindata/ca.go
index 01f5f1151..4011ef6f1 100644
--- a/internal/pkg/manager/spod/bindata/ca.go
+++ b/internal/pkg/manager/spod/bindata/ca.go
@@ -46,7 +46,7 @@ const (
 )
 
 func GetCAInjectType(
-	ctx context.Context, log logr.Logger, namespace string, c client.Client,
+	ctx context.Context, log logr.Logger, c client.Client,
 ) (res CAInjectType, err error) {
 	err = c.Get(ctx,
 		types.NamespacedName{Name: "openshift-apiserver"},
diff --git a/internal/pkg/manager/spod/bindata/webhook.go b/internal/pkg/manager/spod/bindata/webhook.go
index aa2ea2e63..2c779f10e 100644
--- a/internal/pkg/manager/spod/bindata/webhook.go
+++ b/internal/pkg/manager/spod/bindata/webhook.go
@@ -164,9 +164,8 @@ func (w *Webhook) Create(ctx context.Context, c client.Client) error {
 					}
 				}
 				continue
-			} else {
-				return fmt.Errorf("creating %s: %w", k, err)
 			}
+			return fmt.Errorf("creating %s: %w", k, err)
 		}
 	}
 
diff --git a/internal/pkg/manager/spod/setup.go b/internal/pkg/manager/spod/setup.go
index d8a9ee735..4c5170bfd 100644
--- a/internal/pkg/manager/spod/setup.go
+++ b/internal/pkg/manager/spod/setup.go
@@ -64,7 +64,7 @@ type daemonTunables struct {
 func (r *ReconcileSPOd) Setup(
 	ctx context.Context,
 	mgr ctrl.Manager,
-	met *metrics.Metrics,
+	_ *metrics.Metrics,
 ) error {
 	r.client = mgr.GetClient()
 	r.log = ctrl.Log.WithName(r.Name())
diff --git a/internal/pkg/manager/spod/spod_controller.go b/internal/pkg/manager/spod/spod_controller.go
index c6e88c2b9..29e1321cc 100644
--- a/internal/pkg/manager/spod/spod_controller.go
+++ b/internal/pkg/manager/spod/spod_controller.go
@@ -172,7 +172,7 @@ func (r *ReconcileSPOd) Reconcile(ctx context.Context, req reconcile.Request) (r
 		Namespace: r.namespace,
 	}
 
-	caInjectType, err := bindata.GetCAInjectType(ctx, r.log, r.namespace, r.client)
+	caInjectType, err := bindata.GetCAInjectType(ctx, r.log, r.client)
 	if err != nil {
 		return reconcile.Result{}, fmt.Errorf("get ca inject type: %w", err)
 	}
@@ -433,7 +433,7 @@ func (r *ReconcileSPOd) handleUpdate(
 
 		if errors.IsNotFound(err) {
 			// Handle new default profile
-			if createErr := r.client.Create(ctx, profile); err != nil {
+			if createErr := r.client.Create(ctx, profile); createErr != nil {
 				if errors.IsAlreadyExists(createErr) {
 					return nil
 				}
diff --git a/internal/pkg/manager/workloadannotator/setup.go b/internal/pkg/manager/workloadannotator/setup.go
index 69aa7a51d..c802ecb20 100644
--- a/internal/pkg/manager/workloadannotator/setup.go
+++ b/internal/pkg/manager/workloadannotator/setup.go
@@ -36,7 +36,7 @@ import (
 func (r *PodReconciler) Setup(
 	ctx context.Context,
 	mgr ctrl.Manager,
-	met *metrics.Metrics,
+	_ *metrics.Metrics,
 ) error {
 	const name = "pods"
 	r.client = mgr.GetClient()
diff --git a/internal/pkg/manager/workloadannotator/workloadannotator.go b/internal/pkg/manager/workloadannotator/workloadannotator.go
index 1e53cac20..43b93fa5f 100644
--- a/internal/pkg/manager/workloadannotator/workloadannotator.go
+++ b/internal/pkg/manager/workloadannotator/workloadannotator.go
@@ -87,6 +87,7 @@ func (r *PodReconciler) Reconcile(ctx context.Context, req reconcile.Request) (r
 
 	pod := &corev1.Pod{}
 	var err error
+	//nolint:gocritic // It's intended to ignore the not found error
 	if err = r.client.Get(ctx, req.NamespacedName, pod); util.IgnoreNotFound(err) != nil {
 		logger.Error(err, "could not get pod")
 		return reconcile.Result{}, fmt.Errorf("looking up pod in pod reconciler: %w", err)
diff --git a/internal/pkg/util/mock_client.go b/internal/pkg/util/mock_client.go
index f58155849..c41dcdc5c 100644
--- a/internal/pkg/util/mock_client.go
+++ b/internal/pkg/util/mock_client.go
@@ -245,7 +245,7 @@ func NewMockClient() *MockClient {
 	}
 }
 
-func (c *MockClient) SubResource(subResource string) client.SubResourceClient {
+func (c *MockClient) SubResource(string) client.SubResourceClient {
 	return &MockSubResource{
 		SubResourceWriter: &MockSubResourceWriter{
 			MockCreate: c.MockSubResourceWriterCreate,
@@ -259,7 +259,7 @@ func (c *MockClient) SubResource(subResource string) client.SubResourceClient {
 }
 
 // Get calls MockClient's MockGet function.
-func (c *MockClient) Get(ctx context.Context, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+func (c *MockClient) Get(ctx context.Context, key client.ObjectKey, obj client.Object, _ ...client.GetOption) error {
 	return c.MockGet(ctx, key, obj)
 }
 


Test patch:
diff --git a/internal/pkg/daemon/apparmorprofile/apparmorprofile_test.go b/internal/pkg/daemon/apparmorprofile/apparmorprofile_test.go
index ce543e37e..c790c4589 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmorprofile_test.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmorprofile_test.go
@@ -121,10 +121,10 @@ func (f *FakeProfileManager) Enabled() bool {
 	return f.enabled
 }
 
-func (f *FakeProfileManager) InstallProfile(p profilebasev1alpha1.StatusBaseUser) (bool, error) {
+func (f *FakeProfileManager) InstallProfile(profilebasev1alpha1.StatusBaseUser) (bool, error) {
 	return f.installed, f.err
 }
 
-func (f *FakeProfileManager) RemoveProfile(p profilebasev1alpha1.StatusBaseUser) error {
+func (f *FakeProfileManager) RemoveProfile(profilebasev1alpha1.StatusBaseUser) error {
 	return f.err
 }
diff --git a/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go b/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go
index aaea9a919..c9fc49b23 100644
--- a/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go
+++ b/internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go
@@ -646,18 +646,18 @@ type Logger struct {
 	mutex    sync.RWMutex
 }
 
-func (l *Logger) Init(logr.RuntimeInfo)                                {}
-func (l *Logger) Enabled(int) bool                                     { return true }
-func (l *Logger) WithValues(keysAndValues ...interface{}) logr.LogSink { return l }
-func (l *Logger) WithName(name string) logr.LogSink                    { return l }
+func (l *Logger) Init(logr.RuntimeInfo)                  {}
+func (l *Logger) Enabled(int) bool                       { return true }
+func (l *Logger) WithValues(...interface{}) logr.LogSink { return l }
+func (l *Logger) WithName(string) logr.LogSink           { return l }
 
-func (l *Logger) Info(_ int, msg string, keysAndValues ...interface{}) {
+func (l *Logger) Info(_ int, msg string, _ ...interface{}) {
 	l.mutex.Lock()
 	l.messages = append(l.messages, msg)
 	l.mutex.Unlock()
 }
 
-func (l *Logger) Error(err error, msg string, keysAndValues ...interface{}) {
+func (l *Logger) Error(_ error, msg string, _ ...interface{}) {
 	l.mutex.Lock()
 	l.messages = append(l.messages, msg)
 	l.mutex.Unlock()
diff --git a/internal/pkg/daemon/enricher/enricher_test.go b/internal/pkg/daemon/enricher/enricher_test.go
index bf1bfa433..6f358f2a1 100644
--- a/internal/pkg/daemon/enricher/enricher_test.go
+++ b/internal/pkg/daemon/enricher/enricher_test.go
@@ -83,6 +83,7 @@ func TestRun(t *testing.T) {
 				}}}, nil)
 			},
 			assert: func(mock *enricherfakes.FakeImpl, lineChan chan *tail.Line, err error) {
+				//nolint:revive // intentional empty block
 				for mock.LinesCallCount() != 1 {
 					// Wait for Lines() to be called
 				}
@@ -92,6 +93,7 @@ func TestRun(t *testing.T) {
 					Time: time.Now(),
 				}
 
+				//nolint:revive // intentional empty block
 				for mock.SendMetricCallCount() != 1 {
 					// Wait for MetricsAuditIncCallCount to be called
 				}
@@ -205,6 +207,7 @@ func TestRun(t *testing.T) {
 				mock.SendMetricReturns(errTest)
 			},
 			assert: func(mock *enricherfakes.FakeImpl, lineChan chan *tail.Line, err error) {
+				//nolint:revive // intentional empty block
 				for mock.LinesCallCount() != 1 {
 					// Wait for Lines() to be called
 				}
@@ -214,6 +217,7 @@ func TestRun(t *testing.T) {
 					Time: time.Now(),
 				}
 
+				//nolint:revive // intentional empty block
 				for mock.SendMetricCallCount() != 1 {
 					// Wait for MetricsAuditIncCallCount to be called
 				}
@@ -263,6 +267,7 @@ func TestRun(t *testing.T) {
 				}}}, nil)
 			},
 			assert: func(mock *enricherfakes.FakeImpl, lineChan chan *tail.Line, err error) {
+				//nolint:revive // intentional empty block
 				for mock.LinesCallCount() != 1 {
 					// Wait for Lines() to be called. We should hit continue
 					// in the loop, failing the find the container ID
@@ -273,6 +278,7 @@ func TestRun(t *testing.T) {
 					Time: time.Now(),
 				}
 
+				//nolint:revive // intentional empty block
 				for mock.AddToBacklogCallCount() != 1 {
 					// Make sure the backlog was added to, because the
 					// pod information shouldn't be available yet
@@ -306,10 +312,13 @@ func TestRun(t *testing.T) {
 					},
 				)
 
+				//nolint:revive // intentional empty block
 				for mock.GetFromBacklogCallCount() != 1 {
 					// Make sure the backlog was read from when the avcs
 					// were dispatched
 				}
+
+				//nolint:revive // intentional empty block
 				for mock.FlushBacklogCallCount() != 1 {
 					// Make sure the backlog was flushed. This ensures
 					// that it was not empty and the mock entry was
diff --git a/internal/pkg/webhooks/utils/utils_test.go b/internal/pkg/webhooks/utils/utils_test.go
index 414562bd9..e0076435b 100644
--- a/internal/pkg/webhooks/utils/utils_test.go
+++ b/internal/pkg/webhooks/utils/utils_test.go
@@ -92,9 +92,9 @@ type fakeClient struct {
 }
 
 func (f *fakeClient) Create(
-	_ context.Context,
-	_ client.Object,
-	_ ...client.CreateOption,
+	context.Context,
+	client.Object,
+	...client.CreateOption,
 ) error {
 	if f.updateFails {
 		return errors.New("test")
@@ -103,9 +103,9 @@ func (f *fakeClient) Create(
 }
 
 func (f *fakeClient) Delete(
-	_ context.Context,
-	_ client.Object,
-	_ ...client.DeleteOption,
+	context.Context,
+	client.Object,
+	...client.DeleteOption,
 ) error {
 	if f.updateFails {
 		return errors.New("test")
@@ -114,9 +114,9 @@ func (f *fakeClient) Delete(
 }
 
 func (f *fakeClient) DeleteAllOf(
-	_ context.Context,
-	_ client.Object,
-	_ ...client.DeleteAllOfOption,
+	context.Context,
+	client.Object,
+	...client.DeleteAllOfOption,
 ) error {
 	if f.updateFails {
 		return errors.New("test")
@@ -125,9 +125,9 @@ func (f *fakeClient) DeleteAllOf(
 }
 
 func (f *fakeClient) Update(
-	ctx context.Context,
-	_ client.Object,
-	_ ...client.UpdateOption,
+	context.Context,
+	client.Object,
+	...client.UpdateOption,
 ) error {
 	if f.updateFails {
 		return errors.New("test")
@@ -136,10 +136,10 @@ func (f *fakeClient) Update(
 }
 
 func (*fakeClient) Patch(
-	ctx context.Context,
-	_ client.Object,
-	_ client.Patch,
-	_ ...client.PatchOption,
+	context.Context,
+	client.Object,
+	client.Patch,
+	...client.PatchOption,
 ) error {
 	return nil
 }
diff --git a/test/suite_test.go b/test/suite_test.go
index bda60a389..a910926e5 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -497,7 +497,7 @@ func (e *vanilla) SetupTest() {
 func (e *vanilla) TearDownTest() {
 }
 
-func (e *vanilla) execNodeVanilla(node string, args ...string) string {
+func (e *vanilla) execNodeVanilla(_ string, args ...string) string {
 	return e.run(args[0], args[1:]...)
 }
 
diff --git a/test/tc_base_profiles_oci_test.go b/test/tc_base_profiles_oci_test.go
index 668e039e9..63f8178f1 100644
--- a/test/tc_base_profiles_oci_test.go
+++ b/test/tc_base_profiles_oci_test.go
@@ -87,7 +87,7 @@ spec:
 	defer os.Remove(helloPodFile.Name())
 
 	namespace := e.getCurrentContextNamespace(defaultNamespace)
-	_, err = helloPodFile.WriteString(fmt.Sprintf(helloPod, namespace))
+	_, err = fmt.Fprintf(helloPodFile, helloPod, namespace)
 	e.Nil(err)
 	err = helloPodFile.Close()
 	e.Nil(err)
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index 1f5417003..044802bf8 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -95,7 +95,7 @@ spec:
 	defer os.Remove(helloPodFile.Name())
 
 	namespace := e.getCurrentContextNamespace(defaultNamespace)
-	_, err = helloPodFile.WriteString(fmt.Sprintf(helloPod, namespace))
+	_, err = fmt.Fprintf(helloPodFile, helloPod, namespace)
 	e.Nil(err)
 	err = helloPodFile.Close()
 	e.Nil(err)
diff --git a/test/tc_enable_profile_recorder_test.go b/test/tc_enable_profile_recorder_test.go
index 230f15588..7e41529ec 100644
--- a/test/tc_enable_profile_recorder_test.go
+++ b/test/tc_enable_profile_recorder_test.go
@@ -16,7 +16,7 @@ limitations under the License.
 
 package e2e_test
 
-func (e *e2e) testCaseSPODEnableProfileRecorder(nodes []string) {
+func (e *e2e) testCaseSPODEnableProfileRecorder([]string) {
 	e.enableLogEnricherInSpod()
 
 	e.logf("assert profile recorder is enabled in the spod DS when log enricher is enabled")
diff --git a/test/tc_metrics_test.go b/test/tc_metrics_test.go
index aca380b18..5fea47539 100644
--- a/test/tc_metrics_test.go
+++ b/test/tc_metrics_test.go
@@ -25,7 +25,7 @@ import (
 
 const profileName = "metrics-profile"
 
-func (e *e2e) testCaseSeccompMetrics(nodes []string) {
+func (e *e2e) testCaseSeccompMetrics([]string) {
 	e.seccompOnlyTestCase()
 	e.singleNodeTestCase()
 
diff --git a/test/tc_spod_update_selinux_test.go b/test/tc_spod_update_selinux_test.go
index 8f5058931..bf1518662 100644
--- a/test/tc_spod_update_selinux_test.go
+++ b/test/tc_spod_update_selinux_test.go
@@ -18,7 +18,7 @@ package e2e_test
 
 import "time"
 
-func (e *e2e) testCaseSPODUpdateSelinux(nodes []string) {
+func (e *e2e) testCaseSPODUpdateSelinux([]string) {
 	e.selinuxOnlyTestCase()
 
 	e.logf("assert selinux is enabled in the spod object")