Merge pull request #14489 from milantracy:lint

PiperOrigin-RevId: 978806824

Author: gvisor-bot

.clang-format

@@ -0,0 +1,17 @@
+# Copyright 2026 The gVisor Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# gVisor's C and C++ sources follow the Google C++ style guide.
+BasedOnStyle: Google
+SortIncludes: false

.codespellrc

@@ -0,0 +1,31 @@
+# Runs the source-level lint suite. See tools/lint.sh.
+name: Lint
+
+"on":
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      with:
+        persist-credentials: false
+
+    - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      with:
+        go-version-file: 'go.mod'
+
+    - run: make lint

.github/workflows/lint.yml

@@ -914,6 +914,16 @@ tag: ## Stages a release tag; the release pipeline publishes it once the artifac
 	@tools/tag_release.sh "$(RELEASE_COMMIT)" "$(RELEASE_NAME)" "$(RELEASE_NOTES)"
 .PHONY: tag
 
-codespell:
-	codespell
-.PHONY: codespell
+##
+## Lint targets.
+##
+##   These run the source-level linters that live outside the Bazel build.
+##   Deep Go analysis is owned by gVisor nogo.
+##
+lint: ## Runs the source linters.
+	@tools/lint.sh
+.PHONY: lint
+
+lint-fix: ## Reformats sources in place.
+	@tools/lint.sh --fix
+.PHONY: lint-fix

Makefile

@@ -19,7 +19,7 @@ The external FUSE server feature allows a host-side process to serve a FUSE
 filesystem into a gVisor sandbox. The host process and the sandbox communicate
 over a Unix socketpair using the standard FUSE protocol. This approach avoids
 the performance penalty incurred by context switching through the I/O proxy
-mechansim that's otherwise used to expose host filesystems.
+mechanism that's otherwise used to expose host filesystems.
 
 ### How It Works
 

g3doc/user_guide/fuse.md

@@ -81,7 +81,7 @@ Enable the flag `allow-rootfs-tar-annotation` to runtimeArgs, e.g.
 
 Since the tar file path is provided via OCI spec's annotation, it is compatible
 with Docker client when the runtime is gVisor. You can pass the annotation via
-Docker commad and observe the file change as:
+Docker command and observe the file change as:
 
 ```
 $ docker run --rm --runtime=runsc --annotation "dev.gvisor.tar.rootfs.upper"="/tmp/rootfs.tar" alpine cat /dir/file

g3doc/user_guide/rootfs_snapshot.md

@@ -65,7 +65,7 @@ int main(int argc, char** argv) {
          new_stat.st_nlink);
   }
 
-  // Check taht contents are the same.
+  // Check that contents are the same.
   fd = open(kNewPath, O_RDONLY);
   if (fd < 0) {
     errx(1, "open(%s) failed", kNewPath);

images/basic/integrationtest/link_test.c

@@ -31,7 +31,7 @@ import (
 // Queues are not safe to use concurrently in multiple goroutines.
 type Queue interface {
 	// Destroy cancels all inflight operations and releases resources owned by
-	// the Queue. Destroy waits for cancelation, so the Queue will not access
+	// the Queue. Destroy waits for cancellation, so the Queue will not access
 	// memory corresponding to inflight operations after Destroy returns.
 	Destroy()
 

pkg/aio/aio.go

@@ -140,7 +140,7 @@ func (c *Client) StartChannels() error {
 	}
 	channelsWg.Wait()
 
-	// Check that atleast 1 channel is created. This is not required by lisafs
+	// Check that at least 1 channel is created. This is not required by lisafs
 	// protocol. It exists to flag server side issues in channel creation.
 	c.channelsMu.Lock()
 	numChannels := len(c.channels)

pkg/lisafs/client.go

@@ -234,7 +234,7 @@ func (fd *frontendFD) Ioctl(ctx context.Context, uio usermem.IO, sysno uintptr,
 	}
 
 	// nr determines the argument type.
-	// Implementors:
+	// Implementers:
 	// - To map nr to a symbol, look in
 	// src/nvidia/arch/nvalloc/unix/include/nv_escape.h,
 	// kernel-open/common/inc/nv-ioctl-numbers.h, and
@@ -905,7 +905,7 @@ func rmControl(fi *frontendIoctlState) (uintptr, error) {
 		// Consequently, its parameters cannot reasonably contain pointers.
 		return rmControlSimple(fi, &ioctlParams)
 	}
-	// Implementors:
+	// Implementers:
 	// - Top two bytes of Cmd specifies class; third byte specifies category;
 	// fourth byte specifies "message ID" (command within class/category).
 	//   e.g. 0x800288:
@@ -1223,7 +1223,7 @@ func rmAlloc(fi *frontendIoctlState) (uintptr, error) {
 	if log.IsLogging(log.Debug) {
 		fi.ctx.Debugf("nvproxy: allocation class %v", ioctlParams.HClass)
 	}
-	// Implementors:
+	// Implementers:
 	// - To map hClass to a symbol, look in
 	// src/nvidia/generated/g_allclasses.h.
 	// - See src/nvidia/src/kernel/rmapi/resource_list.h for table mapping class