use consistent alias for containerd's errdefs package, and validate in CI
### use consistent alias for containerd's errdefs package

The signatures of functions in containerd's errdefs packages are very
similar to those in our own, and it's easy to accidentally use the wrong
package.

This patch uses a consistent alias for all occurrences of this import.

### golangci-lint: enable importas linter to force consistent aliases

This enforces the github.com/containerd/containerd/errdefs package to
be aliased as "cerrdefs". Any other alias (or no alias used) results
in a linting failure:

    integration/container/pause_test.go:9:2: import "github.com/containerd/containerd/errdefs" imported as "c8derrdefs" but must be "cerrdefs" according to config (importas)
        c8derrdefs "github.com/containerd/containerd/errdefs"
        ^


**- How to verify it**

**- Description for the changelog**
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog:
-->


**- A picture of a cute animal (not mandatory but encouraged)**


hack/validate/golangci-lint.yml
linters:
  enable:
    - depguard
    - goimports
    - gosec
    - gosimple
    - govet
    - ineffassign
    - misspell
    - revive
    - staticcheck
    - typecheck
    - unconvert
    - unused

  disable:
    - errcheck

  run:
    concurrency: 2
    modules-download-mode: vendor

    skip-dirs:
      - docs

linters-settings:
  govet:
    check-shadowing: false
  depguard:
    list-type: blacklist
    include-go-root: true
    packages:
      # The io/ioutil package has been deprecated.
      # https://go.dev/doc/go1.16#ioutil
      - io/ioutil
  revive:
    rules:
      # FIXME make sure all packages have a description. Currently, there's many packages without.
      - name: package-comments
        disabled: true
issues:
  # The default exclusion rules are a bit too permissive, so copying the relevant ones below
  exclude-use-default: false

  exclude-rules:
    # We prefer to use an "exclude-list" so that new "default" exclusions are not
    # automatically inherited. We can decide whether or not to follow upstream
    # defaults when updating golang-ci-lint versions.
    # Unfortunately, this means we have to copy the whole exclusion pattern, as
    # (unlike the "include" option), the "exclude" option does not take exclusion
    # ID's.
    #
    # These exclusion patterns are copied from the default excluses at:
    # https://github.com/golangci/golangci-lint/blob/v1.46.2/pkg/config/issues.go#L10-L104

    # EXC0001
    - text: "Error return value of .((os\\.)?std(out|err)\\..*|.*Close|.*Flush|os\\.Remove(All)?|.*print(f|ln)?|os\\.(Un)?Setenv). is not checked"
      linters:
        - errcheck
    # EXC0006
    - text: "Use of unsafe calls should be audited"
      linters:
        - gosec
    # EXC0007
    - text: "Subprocess launch(ed with variable|ing should be audited)"
      linters:
        - gosec
    # EXC0008
    # TODO: evaluate these and fix where needed: G307: Deferring unsafe method "*os.File" on type "Close" (gosec)
    - text: "(G104|G307)"
      linters:
        - gosec
    # EXC0009
    - text: "(Expect directory permissions to be 0750 or less|Expect file permissions to be 0600 or less)"
      linters:
        - gosec
    # EXC0010
    - text: "Potential file inclusion via variable"
      linters:
        - gosec

    # Looks like the match in "EXC0007" above doesn't catch this one
    # TODO: consider upstreaming this to golangci-lint's default exclusion rules
    - text: "G204: Subprocess launched with a potential tainted input or cmd arguments"
      linters:
        - gosec
    # Looks like the match in "EXC0009" above doesn't catch this one
    # TODO: consider upstreaming this to golangci-lint's default exclusion rules
    - text: "G306: Expect WriteFile permissions to be 0600 or less"
      linters:
        - gosec

    # Exclude some linters from running on tests files.
    - path: _test\.go
      linters:
        - errcheck
        - gosec

    # Suppress golint complaining about generated types in api/types/
    - text: "type name will be used as (container|volume)\\.(Container|Volume).* by other packages, and that stutters; consider calling this"
      path: "api/types/(volume|container)/"
      linters:
        - revive
    # FIXME temporarily suppress these. See #39924
    - text: "SA1019: .*\\.Xattrs has been deprecated since Go 1.10: Use PAXRecords instead"
      linters:
        - staticcheck
    # FIXME temporarily suppress these. See #39926
    - text: "SA1019: httputil.NewClientConn"
      linters:
        - staticcheck
    # FIXME temporarily suppress these (related to the ones above)
    - text: "SA1019: httputil.ErrPersistEOF"
      linters:
        - staticcheck

  # Maximum issues count per one linter. Set to 0 to disable. Default is 50.
  max-issues-per-linter: 0

  # Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
  max-same-issues: 0

linters:
  enable:
    - depguard
    - goimports
    - gosec
    - gosimple
    - govet
    - importas
    - ineffassign
    - misspell
    - revive
    - staticcheck
    - typecheck
    - unconvert
    - unused

  disable:
    - errcheck

  run:
    concurrency: 2
    modules-download-mode: vendor

    skip-dirs:
      - docs

linters-settings:
  importas:
    # Do not allow unaliased imports of aliased packages.
    no-unaliased: true

    alias:
      # Enforce alias to prevent it accidentally being used instead of our
      # own errdefs package (or vice-versa).
      - pkg: github.com/containerd/containerd/errdefs
        alias: cerrdefs

  govet:
    check-shadowing: false
  depguard:
    list-type: blacklist
    include-go-root: true
    packages:
      # The io/ioutil package has been deprecated.
      # https://go.dev/doc/go1.16#ioutil
      - io/ioutil
  revive:
    rules:
      # FIXME make sure all packages have a description. Currently, there's many packages without.
      - name: package-comments
        disabled: true
issues:
  # The default exclusion rules are a bit too permissive, so copying the relevant ones below
  exclude-use-default: false

  exclude-rules:
    # We prefer to use an "exclude-list" so that new "default" exclusions are not
    # automatically inherited. We can decide whether or not to follow upstream
    # defaults when updating golang-ci-lint versions.
    # Unfortunately, this means we have to copy the whole exclusion pattern, as
    # (unlike the "include" option), the "exclude" option does not take exclusion
    # ID's.
    #
    # These exclusion patterns are copied from the default excluses at:
    # https://github.com/golangci/golangci-lint/blob/v1.46.2/pkg/config/issues.go#L10-L104

    # EXC0001
    - text: "Error return value of .((os\\.)?std(out|err)\\..*|.*Close|.*Flush|os\\.Remove(All)?|.*print(f|ln)?|os\\.(Un)?Setenv). is not checked"
      linters:
        - errcheck
    # EXC0006
    - text: "Use of unsafe calls should be audited"
      linters:
        - gosec
    # EXC0007
    - text: "Subprocess launch(ed with variable|ing should be audited)"
      linters:
        - gosec
    # EXC0008
    # TODO: evaluate these and fix where needed: G307: Deferring unsafe method "*os.File" on type "Close" (gosec)
    - text: "(G104|G307)"
      linters:
        - gosec
    # EXC0009
    - text: "(Expect directory permissions to be 0750 or less|Expect file permissions to be 0600 or less)"
      linters:
        - gosec
    # EXC0010
    - text: "Potential file inclusion via variable"
      linters:
        - gosec

    # Looks like the match in "EXC0007" above doesn't catch this one
    # TODO: consider upstreaming this to golangci-lint's default exclusion rules
    - text: "G204: Subprocess launched with a potential tainted input or cmd arguments"
      linters:
        - gosec
    # Looks like the match in "EXC0009" above doesn't catch this one
    # TODO: consider upstreaming this to golangci-lint's default exclusion rules
    - text: "G306: Expect WriteFile permissions to be 0600 or less"
      linters:
        - gosec

    # Exclude some linters from running on tests files.
    - path: _test\.go
      linters:
        - errcheck
        - gosec

    # Suppress golint complaining about generated types in api/types/
    - text: "type name will be used as (container|volume)\\.(Container|Volume).* by other packages, and that stutters; consider calling this"
      path: "api/types/(volume|container)/"
      linters:
        - revive
    # FIXME temporarily suppress these. See #39924
    - text: "SA1019: .*\\.Xattrs has been deprecated since Go 1.10: Use PAXRecords instead"
      linters:
        - staticcheck
    # FIXME temporarily suppress these. See #39926
    - text: "SA1019: httputil.NewClientConn"
      linters:
        - staticcheck
    # FIXME temporarily suppress these (related to the ones above)
    - text: "SA1019: httputil.ErrPersistEOF"
      linters:
        - staticcheck

  # Maximum issues count per one linter. Set to 0 to disable. Default is 50.
  max-issues-per-linter: 0

  # Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
  max-same-issues: 0

FWIW, I picked `cerrdefs` as that looked to be the most common used, but `c8derrdefs`or `c8derrors` also works for me (I had to pick one 😂)