Introduce static code analysis

[mhmxs]

Golangci-lint, Gosec, Govulncheck and Nilaway has been introduced. CodeQL Github also has been added.

Fixes: #44

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[mhmxs]

@luthermonson @avestuk @zliang-akamai Could you please take a look

[avestuk]

I'm fine with the SCA change. I'm glad to see the updates to break out reconcile into smaller pieces!

My one question is why you've chosen to use named returns in all of the the new reconcile functions such as reconcileUpdate. Personally I'm just not used to seeing naked returns in Go and I find it a bit jarring.

[mhmxs]

why you've chosen to use named returns in all of the the new reconcile functions

@avestuk the answer is simply because the original Reconcilie function is full of defer statements, and i didn't change the code style during refactoring.

[avestuk]

@avestuk the answer is simply because the original Reconcilie function is full of defer statements, and i didn't change the code style during refactoring.

Eminently reasonable! What do you think about only doing named returns in Reconcile/reconcile functions where we have got the defer statements? I'm thinking that it'd be preferable to keep the named return pieces limited to places where we need them in order to modify the return values. That way it's clear why it's being done and we don't have it across the whole code base?

[mhmxs]

That way it's clear why it's being done and we don't have it across the whole code base?

@avestuk I did what i could, but reconcile update has to be an exception too.

[avestuk]

That works for me!

[avestuk]

reconcile update has to be an exception too.

Sorry just reading through that function and I'm not seeing why reconcileUpdate needs to be an exception?

[mhmxs]

needs to be an exception?

@avestuk Otherwise it looks like:

...() (ctr.Result, *.linodego.Instance, err) {
var res ...
var linodeInstance...
var err ...

And all the returns are the same return res, linodeInstance, err

[avestuk]

Not a blocker for me, but I'd prefer explicit, repeated returns than the bare return.