chore: golangci-lint update (#2248)

Signed-off-by: Ian Lewis <ianlewis@google.com>

.github/workflows/pre-submit.lint.yml

@@ -58,8 +58,8 @@ jobs:
         with:
           go-version-file: "go.mod"
       - env:
-          GOLANGCI_LINT_VERSION: "1.52.2"
-          GOLANGCI_LINT_CHECKSUM: "c9cf72d12058a131746edd409ed94ccd578fbd178899d1ed41ceae3ce5f54501"
+          GOLANGCI_LINT_VERSION: "1.53.2"
+          GOLANGCI_LINT_CHECKSUM: "2298f73b9bc03b88b91fee06c5d519fc7f9d7f328e2c388615bbd7e85a9d6cae"
         run: |
           set -euo pipefail
 

.golangci.yml

@@ -90,6 +90,47 @@ linters:
     # TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable thelper
     # - wrapcheck
 linters-settings:
+  depguard:
+    rules:
+      all:
+        files:
+          - $all
+        allow:
+          - $gostd
+
+          # Approved orgs.
+          - "github.com/slsa-framework"
+          - "github.com/in-toto"
+          - "github.com/google"
+          - "github.com/sigstore"
+          - "github.com/secure-systems-lab"
+          - "github.com/go-openapi"
+
+          # Approved packages.
+          - "github.com/spf13/cobra" # For CLI
+          - "github.com/coreos/go-oidc" # For verifying OIDC tokens.
+
+          # Allowed packages in container-based builder.
+          - "github.com/pelletier/go-toml" # For container-based builder config.
+        deny:
+          - pkg: "reflect"
+            desc: Please don't use reflect package
+          - pkg: "unsafe"
+            desc: Please don't use unsafe package
+
+      main:
+        files:
+          - $all
+          # This is an exception for the container-based builder to allow it to use go-cmp.
+          # TODO(#2247): Don't allow go-cmp in non-test code.
+          - "!**/internal/builders/docker/commands.go"
+          # NOTE: test code is allowed to use github.com/google/go-cmp (there is no
+          #       deny for it) but non-test code is not.
+          - "!$test"
+        deny:
+          - pkg: "github.com/google/go-cmp"
+            desc: Please don't use go-cmp for non-test code.
+
   errcheck:
     check-type-assertions: true
     check-blank: true