Update nobin config with base64 and confusables checking

* Move the flags from the Makefile to .nobin.yaml
* Check for unexpected base64 data of 32 characters or more
* Check for Unicode characters that can be confused with Latin letters
  or digits
* Run nobin in lint-quick.yml instead of test.yml

test.yml skips docs-only changes, but docs are a likely place for a
link spelled with a look-alike letter. lint-quick.yml runs on every
change.

Both checks rely on heuristics and skip some candidates to avoid false
positives. The config file lists the known exceptions.

Signed-off-by: Jan Dubois <jan.dubois@suse.com>

.github/workflows/lint-quick.yml

@@ -25,6 +25,8 @@ jobs:
       with:
         go-version: stable
         cache: false
+    - name: Run nobin
+      run: make nobin
     - name: Run editorconfig-checker
       run: make editorconfig-checker
     - name: Run yamllint

.github/workflows/test.yml

@@ -41,8 +41,6 @@ jobs:
         make install-protoc-tools
     - name: Verify generated files
       run: make generate check-generated
-    - name: Run nobin
-      run: make nobin
     - name: Install shellcheck
       run: |
         sudo apt-get update

.nobin.yaml

@@ -0,0 +1,37 @@
+# nobin configuration file, used by `make nobin`.
+# nobin checks the repository for binary files, invisible and control
+# characters, long base64 strings, and non-ASCII characters that look
+# like Latin letters or digits. This file selects the checks and lists
+# the files exempt from them.
+# https://github.com/jandubois/nobin
+all: false
+gitignore: true
+skip:
+- docs/reports/**/*.pdf
+- pkg/**/*.pb.desc
+- website/static/images/**/*.{gif,png}
+skip-ext: []
+
+# Allowed characters
+allow: []
+allow-bell: false
+allow-bom: false
+allow-emoji: true
+allow-escape: true
+
+# Additional checks (opt-in)
+block-base64: 32          # 0 = disabled, N = minimum run length
+skip-base64:
+- go.sum
+- package-lock.json
+- hack/bats/lib/**/*.gpg
+- pkg/limatmpl/embed_test.go
+- pkg/sshutil/sshutil_test.go
+
+block-confusables: alphanum   # "" = disabled, "alphanum" / "url" / "strict"
+skip-confusables: []
+
+# Output
+quiet: false
+verbose: false
+hide-skipped: false

Makefile

@@ -654,7 +654,7 @@ bats: native limactl-plugins
 # Linting targets - individual stages
 .PHONY: nobin
 nobin:
-	$(GO) run -modfile=./hack/tools/go.mod github.com/jandubois/nobin --allow-emoji --allow-escape --gitignore --skip-ext pb.desc --skip 'website/static/images/**/*.{gif,png}' --skip 'docs/reports/**/*.pdf'
+	$(GO) run -modfile=./hack/tools/go.mod github.com/jandubois/nobin
 
 .PHONY: editorconfig-checker
 editorconfig-checker: