chore: enable strconcat rule from perfsprint

Signed-off-by: Matthieu MOREL <[email protected]>

.golangci.yaml

@@ -91,7 +91,7 @@ linters-settings:
     # Optimizes `fmt.Sprintf` with only one argument.
     sprintf1: false
     # Optimizes into strings concatenation.
-    strconcat: false
+    strconcat: true
   revive:
     ignore-generated-header: true
   testifylint:

magefiles/magefile.go

@@ -54,7 +54,7 @@ func buildLdflags() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return fmt.Sprintf("-s -w -X=github.com/aquasecurity/trivy/pkg/version/app.ver=%s", ver), nil
+	return "-s -w -X=github.com/aquasecurity/trivy/pkg/version/app.ver=" + ver, nil
 }
 
 type Tool mg.Namespace

pkg/cache/redis_test.go

@@ -66,7 +66,7 @@ func TestRedisCache_PutArtifact(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			err = c.PutArtifact(tt.args.artifactID, tt.args.artifactConfig)
@@ -152,7 +152,7 @@ func TestRedisCache_PutBlob(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			err = c.PutBlob(tt.args.blobID, tt.args.blobConfig)
@@ -234,7 +234,7 @@ func TestRedisCache_GetArtifact(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			got, err := c.GetArtifact(tt.artifactID)
@@ -324,7 +324,7 @@ func TestRedisCache_GetBlob(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			got, err := c.GetBlob(tt.blobID)
@@ -433,7 +433,7 @@ func TestRedisCache_MissingBlobs(t *testing.T) {
 				addr = "dummy:6379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			missingArtifact, missingBlobIDs, err := c.MissingBlobs(tt.args.artifactID, tt.args.blobIDs)
@@ -456,7 +456,7 @@ func TestRedisCache_Close(t *testing.T) {
 	defer s.Close()
 
 	t.Run("close", func(t *testing.T) {
-		c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", s.Addr()), "", "", "", false, 0)
+		c, err := cache.NewRedisCache("redis://"+s.Addr(), "", "", "", false, 0)
 		require.NoError(t, err)
 
 		closeErr := c.Close()
@@ -478,7 +478,7 @@ func TestRedisCache_Clear(t *testing.T) {
 	s.Set("foo", "bar")
 
 	t.Run("clear", func(t *testing.T) {
-		c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", s.Addr()), "", "", "", false, 0)
+		c, err := cache.NewRedisCache("redis://"+s.Addr(), "", "", "", false, 0)
 		require.NoError(t, err)
 
 		require.NoError(t, c.Clear())
@@ -532,7 +532,7 @@ func TestRedisCache_DeleteBlobs(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			err = c.DeleteBlobs(tt.args.blobIDs)

pkg/commands/app.go

@@ -136,7 +136,7 @@ func loadPluginCommands() []*cobra.Command {
 	for _, p := range plugins {
 		p := p
 		cmd := &cobra.Command{
-			Use:     fmt.Sprintf("%s [flags]", p.Name),
+			Use:     p.Name + " [flags]",
 			Short:   p.Summary,
 			Long:    p.Description,
 			GroupID: groupPlugin,

pkg/commands/artifact/run.go

@@ -341,16 +341,13 @@ func Run(ctx context.Context, opts flag.Options, targetKind TargetKind) (err err
 	defer func() {
 		if errors.Is(err, context.DeadlineExceeded) {
 			// e.g. https://aquasecurity.github.io/trivy/latest/docs/configuration/
-			log.WarnContext(ctx, fmt.Sprintf("Provide a higher timeout value, see %s", doc.URL("/docs/configuration/", "")))
+			log.WarnContext(ctx, "Provide a higher timeout value, see "+doc.URL("/docs/configuration/", ""))
 		}
 	}()
 
 	if opts.ServerAddr != "" && opts.Scanners.AnyEnabled(types.MisconfigScanner, types.SecretScanner) {
 		log.WarnContext(ctx,
-			fmt.Sprintf(
-				"Trivy runs in client/server mode, but misconfiguration and license scanning will be done on the client side, see %s",
-				doc.URL("/docs/references/modes/client-server", ""),
-			),
+			"Trivy runs in client/server mode, but misconfiguration and license scanning will be done on the client side, see "+doc.URL("/docs/references/modes/client-server", ""),
 		)
 	}
 

pkg/dependency/id.go

@@ -1,7 +1,7 @@
 package dependency
 
 import (
-	"fmt"
+	"strconv"
 	"strings"
 
 	"github.com/mitchellh/hashstructure/v2"
@@ -52,5 +52,5 @@ func UID(filePath string, pkg types.Package) string {
 	if err != nil {
 		log.Warn("Failed to calculate the package hash", log.String("pkg", pkg.Name), log.Err(err))
 	}
-	return fmt.Sprintf("%x", hash)
+	return strconv.FormatUint(hash, 16)
 }

pkg/dependency/parser/golang/binary/parse.go

@@ -3,7 +3,6 @@ package binary
 import (
 	"cmp"
 	"debug/buildinfo"
-	"fmt"
 	"runtime/debug"
 	"slices"
 	"sort"
@@ -60,7 +59,7 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependenc
 	stdlibVersion := strings.TrimPrefix(info.GoVersion, "go")
 	stdlibVersion, _, _ = strings.Cut(stdlibVersion, " ")
 	// Add the `v` prefix to be consistent with module and dependency versions.
-	stdlibVersion = fmt.Sprintf("v%s", stdlibVersion)
+	stdlibVersion = "v" + stdlibVersion
 
 	ldflags := p.ldFlags(info.Settings)
 	pkgs := make(ftypes.Packages, 0, len(info.Deps)+2)

pkg/dependency/parser/golang/mod/parse.go

@@ -1,7 +1,6 @@
 package mod
 
 import (
-	"fmt"
 	"io"
 	"regexp"
 	"sort"
@@ -96,7 +95,7 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependenc
 				Name: "stdlib",
 				// Our versioning library doesn't support canonical (goX.Y.Z) format,
 				// So we need to add `v` prefix for consistency (with module and dependency versions).
-				Version:      fmt.Sprintf("v%s", toolchainVer),
+				Version:      "v" + toolchainVer,
 				Relationship: ftypes.RelationshipDirect, // Considered a direct dependency as the main module depends on the standard packages.
 			}
 		}

pkg/dependency/parser/java/pom/artifact.go

@@ -170,7 +170,7 @@ func evaluateVariable(s string, props map[string]string, seenProps []string) str
 func printLoopedPropertiesStack(env string, usedProps []string) {
 	var s string
 	for _, prop := range usedProps {
-		s += fmt.Sprintf("%s -> ", prop)
+		s += prop + " -> "
 	}
 	log.Warn("Lopped properties were detected", log.String("prop", s+env))
 }

pkg/dependency/parser/java/pom/pom.go

@@ -69,7 +69,7 @@ func (p *pom) projectProperties() map[string]string {
 		}
 
 		// e.g. ${project.groupId}
-		key := fmt.Sprintf("project.%s", k)
+		key := "project." + k
 		projectProperties[key] = v
 
 		// It is deprecated, but still available.

pkg/dependency/parser/ruby/gemspec/parse.go

@@ -2,7 +2,6 @@ package gemspec
 
 import (
 	"bufio"
-	"fmt"
 	"regexp"
 	"strings"
 
@@ -64,19 +63,19 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) (pkgs []ftypes.Package, deps []ftypes
 
 		// Capture name, version, license, and licenses
 		switch {
-		case strings.HasPrefix(line, fmt.Sprintf("%s.name", newVar)):
+		case strings.HasPrefix(line, newVar+".name"):
 			// https://guides.rubygems.org/specification-reference/#name
 			name = findSubString(nameRegexp, line, "name")
 			name = trim(name)
-		case strings.HasPrefix(line, fmt.Sprintf("%s.version", newVar)):
+		case strings.HasPrefix(line, newVar+".version"):
 			// https://guides.rubygems.org/specification-reference/#version
 			version = findSubString(versionRegexp, line, "version")
 			version = trim(version)
-		case strings.HasPrefix(line, fmt.Sprintf("%s.licenses", newVar)):
+		case strings.HasPrefix(line, newVar+".licenses"):
 			// https://guides.rubygems.org/specification-reference/#licenses=
 			license = findSubString(licensesRegexp, line, "licenses")
 			license = parseLicenses(license)
-		case strings.HasPrefix(line, fmt.Sprintf("%s.license", newVar)):
+		case strings.HasPrefix(line, newVar+".license"):
 			// https://guides.rubygems.org/specification-reference/#license=
 			license = findSubString(licenseRegexp, line, "license")
 			license = trim(license)

pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go

@@ -98,7 +98,7 @@ func (a *historyAnalyzer) Analyze(ctx context.Context, input analyzer.ConfigAnal
 	}
 
 	if !userFound && input.Config.Config.User != "" {
-		user := fmt.Sprintf("USER %s", input.Config.Config.User)
+		user := "USER " + input.Config.Config.User
 		dockerfile.WriteString(user)
 	}
 

pkg/fanal/analyzer/language/rust/cargo/cargo.go

@@ -3,7 +3,6 @@ package cargo
 import (
 	"context"
 	"errors"
-	"fmt"
 	"io"
 	"io/fs"
 	"maps"
@@ -238,7 +237,7 @@ func (a cargoAnalyzer) matchVersion(currentVersion, constraint string) (bool, er
 	//   - 1.2.* -> 1.2.*
 	//   - ^1.2  -> ^1.2
 	if _, err := goversion.Parse(constraint); err == nil {
-		constraint = fmt.Sprintf("^%s", constraint)
+		constraint = "^" + constraint
 	}
 
 	ver, err := semver.Parse(currentVersion)

pkg/fanal/analyzer/secret/secret.go

@@ -3,7 +3,6 @@ package secret
 import (
 	"bytes"
 	"context"
-	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -131,7 +130,7 @@ func (a *SecretAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInput
 	// Also, paths to these files do not have "/" prefix.
 	// We need to add a "/" prefix to properly filter paths from the config file.
 	if input.Dir == "" { // add leading `/` for files extracted from image
-		filePath = fmt.Sprintf("/%s", filePath)
+		filePath = "/" + filePath
 	}
 
 	result := a.scanner.Scan(secret.ScanArgs{

pkg/fanal/applier/docker.go

@@ -115,7 +115,7 @@ func ApplyLayers(layers []ftypes.BlobInfo) ftypes.ArtifactDetail {
 
 		// Apply OS packages
 		for _, pkgInfo := range layer.PackageInfos {
-			key := fmt.Sprintf("%s/type:ospkg", pkgInfo.FilePath)
+			key := pkgInfo.FilePath + "/type:ospkg"
 			nestedMap.SetByString(key, sep, pkgInfo)
 		}
 
@@ -131,7 +131,7 @@ func ApplyLayers(layers []ftypes.BlobInfo) ftypes.ArtifactDetail {
 				Digest: layer.Digest,
 				DiffID: layer.DiffID,
 			}
-			key := fmt.Sprintf("%s/type:config", config.FilePath)
+			key := config.FilePath + "/type:config"
 			nestedMap.SetByString(key, sep, config)
 		}
 

pkg/fanal/image/daemon/image_test.go

@@ -1,7 +1,6 @@
 package daemon
 
 import (
-	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -33,7 +32,7 @@ func TestMain(m *testing.M) {
 	te := engine.NewDockerEngine(opt)
 	defer te.Close()
 
-	os.Setenv("DOCKER_HOST", fmt.Sprintf("tcp://%s", te.Listener.Addr().String()))
+	os.Setenv("DOCKER_HOST", "tcp://"+te.Listener.Addr().String())
 
 	os.Exit(m.Run())
 }

pkg/fanal/image/image_test.go

@@ -2,7 +2,6 @@ package image
 
 import (
 	"context"
-	"fmt"
 	"net/http/httptest"
 	"testing"
 	"time"
@@ -39,7 +38,7 @@ func setupEngineAndRegistry(t *testing.T) (*httptest.Server, *httptest.Server) {
 		Auth:   auth.Auth{},
 	})
 
-	t.Setenv("DOCKER_HOST", fmt.Sprintf("tcp://%s", te.Listener.Addr().String()))
+	t.Setenv("DOCKER_HOST", "tcp://"+te.Listener.Addr().String())
 
 	return te, tr
 }
@@ -154,7 +153,7 @@ func TestNewDockerImage(t *testing.T) {
 		{
 			name: "happy path with Docker Registry",
 			args: args{
-				imageName: fmt.Sprintf("%s/library/alpine:3.10", serverAddr),
+				imageName: serverAddr + "/library/alpine:3.10",
 			},
 			wantID:       "sha256:af341ccd2df8b0e2d67cf8dd32e087bfda4e5756ebd1c76bbf3efa0dc246590e",
 			wantRepoTags: []string{serverAddr + "/library/alpine:3.10"},
@@ -202,7 +201,7 @@ func TestNewDockerImage(t *testing.T) {
 		{
 			name: "happy path with insecure Docker Registry",
 			args: args{
-				imageName: fmt.Sprintf("%s/library/alpine:3.10", serverAddr),
+				imageName: serverAddr + "/library/alpine:3.10",
 				option: types.ImageOptions{
 					RegistryOptions: types.RegistryOptions{
 						Credentials: []types.Credential{
@@ -260,14 +259,14 @@ func TestNewDockerImage(t *testing.T) {
 		{
 			name: "sad path with invalid tag",
 			args: args{
-				imageName: fmt.Sprintf("%s/library/alpine:3.11!!!", serverAddr),
+				imageName: serverAddr + "/library/alpine:3.11!!!",
 			},
 			wantErr: true,
 		},
 		{
 			name: "sad path with non-exist image",
 			args: args{
-				imageName: fmt.Sprintf("%s/library/alpine:100", serverAddr),
+				imageName: serverAddr + "/library/alpine:100",
 			},
 			wantErr: true,
 		},
@@ -343,7 +342,7 @@ func TestNewDockerImageWithPrivateRegistry(t *testing.T) {
 		{
 			name: "happy path with private Docker Registry",
 			args: args{
-				imageName: fmt.Sprintf("%s/library/alpine:3.10", serverAddr),
+				imageName: serverAddr + "/library/alpine:3.10",
 				option: types.ImageOptions{
 					RegistryOptions: types.RegistryOptions{
 						Credentials: []types.Credential{
@@ -360,7 +359,7 @@ func TestNewDockerImageWithPrivateRegistry(t *testing.T) {
 		{
 			name: "happy path with registry token",
 			args: args{
-				imageName: fmt.Sprintf("%s/library/alpine:3.10", serverAddr),
+				imageName: serverAddr + "/library/alpine:3.10",
 				option: types.ImageOptions{
 					RegistryOptions: types.RegistryOptions{
 						RegistryToken: registryToken,
@@ -372,14 +371,14 @@ func TestNewDockerImageWithPrivateRegistry(t *testing.T) {
 		{
 			name: "sad path without a credential",
 			args: args{
-				imageName: fmt.Sprintf("%s/library/alpine:3.11", serverAddr),
+				imageName: serverAddr + "/library/alpine:3.11",
 			},
 			wantErr: "unexpected status code 401",
 		},
 		{
 			name: "sad path with invalid registry token",
 			args: args{
-				imageName: fmt.Sprintf("%s/library/alpine:3.11", serverAddr),
+				imageName: serverAddr + "/library/alpine:3.11",
 				option: types.ImageOptions{
 					RegistryOptions: types.RegistryOptions{
 						RegistryToken: registryToken + "invalid",
@@ -542,7 +541,7 @@ func TestDockerPlatformArguments(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			imageName := fmt.Sprintf("%s/library/alpine:3.10", serverAddr)
+			imageName := serverAddr + "/library/alpine:3.10"
 			tt.args.option.ImageSources = types.AllImageSources
 			_, cleanup, err := NewContainerImage(context.Background(), imageName, tt.args.option)
 			defer cleanup()