diff --git a/.circleci/config.yml b/.circleci/config.yml
index 01bb69eb..7a67b9ea 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,10 +1,8 @@
 ---
 version: 2.1
-
 orbs:
   prometheus: prometheus/prometheus@0.11.0
-  go: circleci/go@0.2.0
-
+  go: circleci/go@1.7.0
 jobs:
   test_frontend:
     # We need to use a machine executor because the front-end validation runs
@@ -12,144 +10,138 @@ jobs:
     # executor (even with setup_remote_docker).
     machine: true
     steps:
-    - checkout
-    - run: sudo service docker restart
-    - run:
-        name: Remove existing Go installation
-        command: sudo rm -rf /usr/local/go
-    # Whenever the Go version is updated here, .promu.yml should also be updated.
-    - go/install:
-        version: "1.16"
-    - run:
-        name: Remove generated code
-        command: make clean
-    - run:
-        name: Generate front-end code
-        command: make all
-        working_directory: ~/project/ui/app
-        environment:
-          JUNIT_DIR: ~/test-results
-    - run:
-        name: Generate assets
-        command: make assets
-    - run:
-        name: Generate API v2 code
-        command: make apiv2
-    - run: git diff --exit-code
-    - store_test_results:
-        path: ~/test-results
-
+      - checkout
+      - run: sudo service docker restart
+      - run:
+          name: Remove existing Go installation
+          command: sudo rm -rf /usr/local/go
+      # Whenever the Go version is updated here, .promu.yml should also be updated.
+      - go/install:
+          version: "1.17"
+      - run:
+          name: Remove generated code
+          command: make clean
+      - run:
+          name: Generate front-end code
+          command: make all
+          working_directory: ~/project/ui/app
+          environment:
+            JUNIT_DIR: ~/test-results
+      - run:
+          name: Generate assets
+          command: make assets
+      - run:
+          name: Generate API v2 code
+          command: make apiv2
+      - run: git diff --exit-code
+      - store_test_results:
+          path: ~/test-results
   test:
     docker:
-    # Whenever the Go version is updated here, .promu.yml should also be updated.
-    - image: circleci/golang:1.16
-    # maildev containers are for running the email tests against a "real" SMTP server.
-    # See notify/email_test.go for details.
-    - image: djfarrelly/maildev:1.1.0
-      name: maildev-noauth
-      entrypoint: bin/maildev
-      command:
-      - -v
-    - image: djfarrelly/maildev:1.1.0
-      name: maildev-auth
-      entrypoint: bin/maildev
-      command:
-      - -v
-      - --incoming-user
-      - user
-      - --incoming-pass
-      - pass
-
+      # Whenever the Go version is updated here, .promu.yml should also be updated.
+      - image: quay.io/prometheus/golang-builder:1.17-base
+      # maildev containers are for running the email tests against a "real" SMTP server.
+      # See notify/email_test.go for details.
+      - image: djfarrelly/maildev:1.1.0
+        name: maildev-noauth
+        entrypoint: bin/maildev
+        command:
+          - -v
+      - image: djfarrelly/maildev:1.1.0
+        name: maildev-auth
+        entrypoint: bin/maildev
+        command:
+          - -v
+          - --incoming-user
+          - user
+          - --incoming-pass
+          - pass
     environment:
       EMAIL_NO_AUTH_CONFIG: /tmp/smtp_no_auth.yml
       EMAIL_AUTH_CONFIG: /tmp/smtp_auth.yml
-
     steps:
-    - prometheus/setup_environment
-    - go/load-cache:
-        key: v1-go-mod
-    - run:
-        command: |
-          cat \<<EOF > $EMAIL_NO_AUTH_CONFIG
-          smarthost: maildev-noauth:1025
-          server: http://maildev-noauth:1080/
-          EOF
-          cat \<<EOF > $EMAIL_AUTH_CONFIG
-          smarthost: maildev-auth:1025
-          server: http://maildev-auth:1080/
-          username: user
-          password: pass
-          EOF
-    - run:
-        command: make
-        environment:
-          # By default Go uses GOMAXPROCS but a Circle CI executor has many
-          # cores (> 30) while the CPU and RAM resources are throttled. If we
-          # don't limit this to the number of allocated cores, the job is
-          # likely to get OOMed and killed.
-          GOOPTS: "-p 2"
-    - prometheus/check_proto:
-        version: "3.15.8"
-    - prometheus/store_artifact:
-        file: alertmanager
-    - prometheus/store_artifact:
-        file: amtool
-    - go/save-cache:
-        key: v1-go-mod
-    - store_test_results:
-        path: test-results
-
+      - prometheus/setup_environment
+      - go/load-cache:
+          key: v1-go-mod
+      - run:
+          command: |
+            cat \<<EOF > $EMAIL_NO_AUTH_CONFIG
+            smarthost: maildev-noauth:1025
+            server: http://maildev-noauth:1080/
+            EOF
+            cat \<<EOF > $EMAIL_AUTH_CONFIG
+            smarthost: maildev-auth:1025
+            server: http://maildev-auth:1080/
+            username: user
+            password: pass
+            EOF
+      - run:
+          command: make
+          environment:
+            # By default Go uses GOMAXPROCS but a Circle CI executor has many
+            # cores (> 30) while the CPU and RAM resources are throttled. If we
+            # don't limit this to the number of allocated cores, the job is
+            # likely to get OOMed and killed.
+            GOOPTS: "-p 2"
+      - prometheus/check_proto:
+          version: "3.15.8"
+      - prometheus/store_artifact:
+          file: alertmanager
+      - prometheus/store_artifact:
+          file: amtool
+      - go/save-cache:
+          key: v1-go-mod
+      - store_test_results:
+          path: test-results
   mixin:
     docker:
-    # Whenever the Go version is updated here, .promu.yml should also be updated.
-    - image: circleci/golang:1.16
-
+      # Whenever the Go version is updated here, .promu.yml should also be updated.
+      - image: quay.io/prometheus/golang-builder:1.17-base
     steps:
-    - checkout
-    - run: cd doc/alertmanager-mixin; go install github.com/monitoring-mixins/mixtool/cmd/mixtool@latest
-    - run: cd doc/alertmanager-mixin; go install github.com/google/go-jsonnet/cmd/jsonnetfmt@latest
-    - run: cd doc/alertmanager-mixin; go install github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@latest
-    - run: cd doc/alertmanager-mixin; make lint
-
+      - checkout
+      - run: cd doc/alertmanager-mixin; go install github.com/monitoring-mixins/mixtool/cmd/mixtool@latest
+      - run: cd doc/alertmanager-mixin; go install github.com/google/go-jsonnet/cmd/jsonnetfmt@latest
+      - run: cd doc/alertmanager-mixin; go install github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@latest
+      - run: cd doc/alertmanager-mixin; make lint
 workflows:
   version: 2
   alertmanager:
     jobs:
-    - test_frontend:
-        filters:
-          tags:
-            only: /.*/
-    - test:
-        filters:
-          tags:
-            only: /.*/
-    - prometheus/build:
-        name: build
-        parallelism: 8
-        filters:
-          tags:
-            only: /.*/
-    - mixin:
-        filters:
-          tags:
-            only: /.*/
-    - prometheus/publish_main:
-        context: org-context
-        requires:
-        - test_frontend
-        - test
-        - build
-        filters:
-          branches:
-            only: main
-    - prometheus/publish_release:
-        context: org-context
-        requires:
-        - test_frontend
-        - test
-        - build
-        filters:
-          tags:
-            only: /^v[0-9]+(\.[0-9]+){2}(-.+|[^-.]*)$/
-          branches:
-            ignore: /.*/
+      - test_frontend:
+          filters:
+            tags:
+              only: /.*/
+      - test:
+          filters:
+            tags:
+              only: /.*/
+      - prometheus/build:
+          name: build
+          parallelism: 8
+          filters:
+            tags:
+              only: /.*/
+      - mixin:
+          filters:
+            tags:
+              only: /.*/
+      - prometheus/publish_main:
+          context: org-context
+          requires:
+            - test_frontend
+            - test
+            - build
+          filters:
+            branches:
+              only: main
+      - prometheus/publish_release:
+          context: org-context
+          requires:
+            - test_frontend
+            - test
+            - build
+          filters:
+            tags:
+              only: /^v[0-9]+(\.[0-9]+){2}(-.+|[^-.]*)$/
+            branches:
+              ignore: /.*/
diff --git a/.golangci.yml b/.golangci.yml
index a8adb8a6..527f9822 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,13 +1,11 @@
 ---
 run:
   deadline: 5m
-
 issues:
   exclude-rules:
-  - path: _test.go
-    linters:
-    - errcheck
-
+    - path: _test.go
+      linters:
+        - errcheck
 linters-settings:
   errcheck:
     exclude: scripts/errcheck_excludes.txt
diff --git a/.promu.yml b/.promu.yml
index 2fb787b1..e9b56318 100644
--- a/.promu.yml
+++ b/.promu.yml
@@ -1,7 +1,7 @@
 go:
     # Whenever the Go version is updated here, .travis.yml and
     # .circle/config.yml should also be updated.
-    version: 1.16
+    version: 1.17
 repository:
     path: github.com/prometheus/alertmanager
 build:
diff --git a/.yamllint b/.yamllint
new file mode 100644
index 00000000..2b9e6a8f
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,17 @@
+---
+extends: default
+
+rules:
+  braces:
+    max-spaces-inside: 1
+    level: error
+  brackets:
+    max-spaces-inside: 1
+    level: error
+  commas: disable
+  comments: disable
+  comments-indentation: disable
+  document-start: disable
+  indentation:
+    spaces: consistent
+  line-length: disable
diff --git a/asset/asset.go b/asset/asset.go
index 87ad35dc..c098f38d 100644
--- a/asset/asset.go
+++ b/asset/asset.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build dev
 // +build dev
 
 package asset
diff --git a/asset/asset_generate.go b/asset/asset_generate.go
index 2b8a4d3b..5d933a6d 100644
--- a/asset/asset_generate.go
+++ b/asset/asset_generate.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build ignore
 // +build ignore
 
 package main
diff --git a/asset/assets_vfsdata.go b/asset/assets_vfsdata.go
index 9a6b33e8..d689f260 100644
--- a/asset/assets_vfsdata.go
+++ b/asset/assets_vfsdata.go
@@ -1,5 +1,6 @@
 // Code generated by vfsgen; DO NOT EDIT.
 
+//go:build !dev
 // +build !dev
 
 package asset
diff --git a/cli/testdata/conf.bad.yml b/cli/testdata/conf.bad.yml
index a3e29200..7b3a7854 100644
--- a/cli/testdata/conf.bad.yml
+++ b/cli/testdata/conf.bad.yml
@@ -1 +1 @@
-BAD
\ No newline at end of file
+BAD
diff --git a/config/config_test.go b/config/config_test.go
index 589604a0..26265161 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -1015,7 +1015,7 @@ func TestOpsGenieDeprecatedTeamSpecified(t *testing.T) {
 	}
 
 	const expectedErr = `yaml: unmarshal errors:
-  line 18: field teams not found in type config.plain`
+  line 16: field teams not found in type config.plain`
 	if err.Error() != expectedErr {
 		t.Errorf("Expected: %s\nGot: %s", expectedErr, err.Error())
 	}
diff --git a/config/testdata/conf.empty-fields.yml b/config/testdata/conf.empty-fields.yml
index bbbbf909..20e3b7a5 100644
--- a/config/testdata/conf.empty-fields.yml
+++ b/config/testdata/conf.empty-fields.yml
@@ -5,22 +5,16 @@ global:
   smtp_auth_password: ''
   smtp_hello: ''
   slack_api_url: 'https://slack.com/webhook'
-
-
-
 templates:
-- '/etc/alertmanager/template/*.tmpl'
-
+  - '/etc/alertmanager/template/*.tmpl'
 route:
   group_by: ['alertname', 'cluster', 'service']
-
   receiver: team-X-mails
   routes:
-  - match_re:
-      service: ^(foo1|foo2|baz)$
-    receiver: team-X-mails
-
+    - match_re:
+        service: ^(foo1|foo2|baz)$
+      receiver: team-X-mails
 receivers:
-- name: 'team-X-mails'
-  email_configs:
-  - to: 'team-X+alerts@example.org'
+  - name: 'team-X-mails'
+    email_configs:
+      - to: 'team-X+alerts@example.org'
diff --git a/config/testdata/conf.good.yml b/config/testdata/conf.good.yml
index ed923f0a..2429f796 100644
--- a/config/testdata/conf.good.yml
+++ b/config/testdata/conf.good.yml
@@ -8,129 +8,110 @@ global:
   slack_api_url: "http://mysecret.example.com/"
   http_config:
     proxy_url: 'http://127.0.0.1:1025'
-
-
-
 # The directory from which notification templates are read.
 templates:
-- '/etc/alertmanager/template/*.tmpl'
-
+  - '/etc/alertmanager/template/*.tmpl'
 # The root route on which each incoming alert enters.
 route:
   # The labels by which incoming alerts are grouped together. For example,
   # multiple alerts coming in for cluster=A and alertname=LatencyHigh would
   # be batched into a single group.
   group_by: ['alertname', 'cluster', 'service']
-
   # When a new group of alerts is created by an incoming alert, wait at
   # least 'group_wait' to send the initial notification.
   # This way ensures that you get multiple alerts for the same group that start
   # firing shortly after another are batched together on the first
   # notification.
   group_wait: 30s
-
   # When the first notification was sent, wait 'group_interval' to send a batch
   # of new alerts that started firing for that group.
   group_interval: 5m
-
   # If an alert has successfully been sent, wait 'repeat_interval' to
   # resend them.
   repeat_interval: 3h
-
   # A default receiver
   receiver: team-X-mails
-
   # All the above attributes are inherited by all child routes and can
   # overwritten on each.
 
   # The child route trees.
   routes:
-  # This routes performs a regular expression match on alert labels to
-  # catch alerts that are related to a list of services.
-  - match_re:
-      service: ^(foo1|foo2|baz)$
-    receiver: team-X-mails
-    # The service has a sub-route for critical alerts, any alerts
-    # that do not match, i.e. severity != critical, fall-back to the
-    # parent node and are sent to 'team-X-mails'
-    routes:
+    # This routes performs a regular expression match on alert labels to
+    # catch alerts that are related to a list of services.
+    - match_re:
+        service: ^(foo1|foo2|baz)$
+      receiver: team-X-mails
+      # The service has a sub-route for critical alerts, any alerts
+      # that do not match, i.e. severity != critical, fall-back to the
+      # parent node and are sent to 'team-X-mails'
+      routes:
+        - match:
+            severity: critical
+          receiver: team-X-pager
     - match:
-        severity: critical
-      receiver: team-X-pager
-  - match:
-      service: files
-    receiver: team-Y-mails
-
-    routes:
+        service: files
+      receiver: team-Y-mails
+      routes:
+        - match:
+            severity: critical
+          receiver: team-Y-pager
+    # This route handles all alerts coming from a database service. If there's
+    # no team to handle it, it defaults to the DB team.
     - match:
-        severity: critical
-      receiver: team-Y-pager
-
-  # This route handles all alerts coming from a database service. If there's
-  # no team to handle it, it defaults to the DB team.
-  - match:
-      service: database
-    receiver: team-DB-pager
-    # Also group alerts by affected database.
-    group_by: [alertname, cluster, database]
-    routes:
-    - match:
-        owner2: team-X
-      receiver: team-X-pager
-      continue: true
-    - match:
-         owner: team-Y
-      receiver: team-Y-pager
-      # continue: true
-
-
+        service: database
+      receiver: team-DB-pager
+      # Also group alerts by affected database.
+      group_by: [alertname, cluster, database]
+      routes:
+        - match:
+            owner2: team-X
+          receiver: team-X-pager
+          continue: true
+        - match:
+            owner: team-Y
+          receiver: team-Y-pager
+          # continue: true
 # Inhibition rules allow to mute a set of alerts given that another alert is
 # firing.
 # We use this to mute any warning-level notifications if the same alert is
 # already critical.
 inhibit_rules:
-- source_match:
-    severity: 'critical'
-  target_match:
-    severity: 'warning'
-  # Apply inhibition if the alertname is the same.
-  equal: ['alertname', 'cluster', 'service']
-
-
+  - source_match:
+      severity: 'critical'
+    target_match:
+      severity: 'warning'
+    # Apply inhibition if the alertname is the same.
+    equal: ['alertname', 'cluster', 'service']
 receivers:
-- name: 'team-X-mails'
-  email_configs:
-  - to: 'team-X+alerts@example.org'
-
-- name: 'team-X-pager'
-  email_configs:
-  - to: 'team-X+alerts-critical@example.org'
-  pagerduty_configs:
-  - routing_key: "mysecret"
-
-- name: 'team-Y-mails'
-  email_configs:
-  - to: 'team-Y+alerts@example.org'
-
-- name: 'team-Y-pager'
-  pagerduty_configs:
-  - routing_key: "mysecret"
-
-- name: 'team-DB-pager'
-  pagerduty_configs:
-  - routing_key: "mysecret"
-- name: victorOps-receiver
-  victorops_configs:
-    - api_key: mysecret
-      routing_key: Sample_route
-- name: opsGenie-receiver
-  opsgenie_configs:
-    - api_key: mysecret
-- name: pushover-receiver
-  pushover_configs:
-    - token: mysecret
-      user_key: key
-- name: slack-receiver
-  slack_configs:
-    - channel: '#my-channel'
-      image_url: 'http://some.img.com/img.png'
+  - name: 'team-X-mails'
+    email_configs:
+      - to: 'team-X+alerts@example.org'
+  - name: 'team-X-pager'
+    email_configs:
+      - to: 'team-X+alerts-critical@example.org'
+    pagerduty_configs:
+      - routing_key: "mysecret"
+  - name: 'team-Y-mails'
+    email_configs:
+      - to: 'team-Y+alerts@example.org'
+  - name: 'team-Y-pager'
+    pagerduty_configs:
+      - routing_key: "mysecret"
+  - name: 'team-DB-pager'
+    pagerduty_configs:
+      - routing_key: "mysecret"
+  - name: victorOps-receiver
+    victorops_configs:
+      - api_key: mysecret
+        routing_key: Sample_route
+  - name: opsGenie-receiver
+    opsgenie_configs:
+      - api_key: mysecret
+  - name: pushover-receiver
+    pushover_configs:
+      - token: mysecret
+        user_key: key
+  - name: slack-receiver
+    slack_configs:
+      - channel: '#my-channel'
+        image_url: 'http://some.img.com/img.png'
diff --git a/config/testdata/conf.group-by-all.yml b/config/testdata/conf.group-by-all.yml
index 12c8f3b9..bf45e452 100644
--- a/config/testdata/conf.group-by-all.yml
+++ b/config/testdata/conf.group-by-all.yml
@@ -1,10 +1,8 @@
 route:
-  group_by: [...]
+  group_by: ['...']
   group_wait: 30s
   group_interval: 5m
   repeat_interval: 3h
   receiver: team-X
-
 receivers:
-- name: 'team-X'
-
+  - name: 'team-X'
diff --git a/config/testdata/conf.http-config.good.yml b/config/testdata/conf.http-config.good.yml
index 879d7c2c..c7298b3e 100644
--- a/config/testdata/conf.http-config.good.yml
+++ b/config/testdata/conf.http-config.good.yml
@@ -5,7 +5,7 @@ global:
 route:
   receiver: team-X-slack
 receivers:
-- name: 'team-X-slack'
-  slack_configs:
-    - http_config:
-        proxy_url: foo
+  - name: 'team-X-slack'
+    slack_configs:
+      - http_config:
+          proxy_url: foo
diff --git a/config/testdata/conf.nil-match_re-route.yml b/config/testdata/conf.nil-match_re-route.yml
index 78e8c66f..4ea3a0e5 100644
--- a/config/testdata/conf.nil-match_re-route.yml
+++ b/config/testdata/conf.nil-match_re-route.yml
@@ -1,10 +1,8 @@
 route:
   receiver: empty
-
   routes:
-  - match_re:
-      invalid_label:
-    receiver: empty
-
+    - match_re:
+        invalid_label:
+      receiver: empty
 receivers:
-- name: empty
+  - name: empty
diff --git a/config/testdata/conf.nil-source_match_re-inhibition.yml b/config/testdata/conf.nil-source_match_re-inhibition.yml
index 5fdffffc..77862688 100644
--- a/config/testdata/conf.nil-source_match_re-inhibition.yml
+++ b/config/testdata/conf.nil-source_match_re-inhibition.yml
@@ -1,11 +1,9 @@
 route:
   receiver: empty
-
 receivers:
-- name: empty
-
+  - name: empty
 inhibit_rules:
-- source_match_re:
-    invalid_source_label:
-  target_match_re:
-    severity: critical
+  - source_match_re:
+      invalid_source_label:
+    target_match_re:
+      severity: critical
diff --git a/config/testdata/conf.nil-target_match_re-inhibition.yml b/config/testdata/conf.nil-target_match_re-inhibition.yml
index 66067cca..e229c70b 100644
--- a/config/testdata/conf.nil-target_match_re-inhibition.yml
+++ b/config/testdata/conf.nil-target_match_re-inhibition.yml
@@ -1,11 +1,9 @@
 route:
   receiver: empty
-
 receivers:
-- name: empty
-
+  - name: empty
 inhibit_rules:
-- source_match:
-    severity: critical
-  target_match_re:
-    invalid_target_label:
+  - source_match:
+      severity: critical
+    target_match_re:
+      invalid_target_label:
diff --git a/config/testdata/conf.opsgenie-both-file-and-apikey.yml b/config/testdata/conf.opsgenie-both-file-and-apikey.yml
index 13a07d22..4424db5d 100644
--- a/config/testdata/conf.opsgenie-both-file-and-apikey.yml
+++ b/config/testdata/conf.opsgenie-both-file-and-apikey.yml
@@ -1,7 +1,6 @@
 global:
   opsgenie_api_key: asd132
   opsgenie_api_key_file: '/global_file'
-
 route:
   group_by: ['alertname', 'cluster', 'service']
   group_wait: 30s
@@ -9,19 +8,18 @@ route:
   repeat_interval: 3h
   receiver: escalation-Y-opsgenie
   routes:
-  - match:
-      service: foo
-    receiver: team-X-opsgenie
-
+    - match:
+        service: foo
+      receiver: team-X-opsgenie
 receivers:
-- name: 'team-X-opsgenie'
-  opsgenie_configs:
-  - responders:
-    - name: 'team-X'
-      type: 'team'
-- name: 'escalation-Y-opsgenie'
-  opsgenie_configs:
-  - responders:
-    - name: 'escalation-Y'
-      type: 'escalation'
-    api_key: qwe456
+  - name: 'team-X-opsgenie'
+    opsgenie_configs:
+      - responders:
+          - name: 'team-X'
+            type: 'team'
+  - name: 'escalation-Y-opsgenie'
+    opsgenie_configs:
+      - responders:
+          - name: 'escalation-Y'
+            type: 'escalation'
+        api_key: qwe456
diff --git a/config/testdata/conf.opsgenie-default-apikey-file.yml b/config/testdata/conf.opsgenie-default-apikey-file.yml
index e1ed2643..72cdb6ad 100644
--- a/config/testdata/conf.opsgenie-default-apikey-file.yml
+++ b/config/testdata/conf.opsgenie-default-apikey-file.yml
@@ -1,6 +1,5 @@
 global:
   opsgenie_api_key_file: '/global_file'
-
 route:
   group_by: ['alertname', 'cluster', 'service']
   group_wait: 30s
@@ -8,19 +7,18 @@ route:
   repeat_interval: 3h
   receiver: escalation-Y-opsgenie
   routes:
-  - match:
-      service: foo
-    receiver: team-X-opsgenie
-
+    - match:
+        service: foo
+      receiver: team-X-opsgenie
 receivers:
-- name: 'team-X-opsgenie'
-  opsgenie_configs:
-  - responders:
-    - name: 'team-X'
-      type: 'team'
-- name: 'escalation-Y-opsgenie'
-  opsgenie_configs:
-  - responders:
-    - name: 'escalation-Y'
-      type: 'escalation'
-    api_key_file: /override_file
+  - name: 'team-X-opsgenie'
+    opsgenie_configs:
+      - responders:
+          - name: 'team-X'
+            type: 'team'
+  - name: 'escalation-Y-opsgenie'
+    opsgenie_configs:
+      - responders:
+          - name: 'escalation-Y'
+            type: 'escalation'
+        api_key_file: /override_file
diff --git a/config/testdata/conf.opsgenie-default-apikey-old-team.yml b/config/testdata/conf.opsgenie-default-apikey-old-team.yml
index e2c7b792..eca86460 100644
--- a/config/testdata/conf.opsgenie-default-apikey-old-team.yml
+++ b/config/testdata/conf.opsgenie-default-apikey-old-team.yml
@@ -1,6 +1,5 @@
 global:
   opsgenie_api_key: asd132
-
 route:
   group_by: ['alertname', 'cluster', 'service']
   group_wait: 30s
@@ -8,10 +7,9 @@ route:
   repeat_interval: 3h
   receiver: escalation-Y-opsgenie
   routes:
-  - match:
-      service: foo
-    receiver: team-X-opsgenie
-
+    - match:
+        service: foo
+      receiver: team-X-opsgenie
 receivers:
   - name: 'team-X-opsgenie'
     opsgenie_configs:
diff --git a/config/testdata/conf.opsgenie-default-apikey.yml b/config/testdata/conf.opsgenie-default-apikey.yml
index 22b9fe43..a23dfeb7 100644
--- a/config/testdata/conf.opsgenie-default-apikey.yml
+++ b/config/testdata/conf.opsgenie-default-apikey.yml
@@ -1,6 +1,5 @@
 global:
   opsgenie_api_key: asd132
-
 route:
   group_by: ['alertname', 'cluster', 'service']
   group_wait: 30s
@@ -8,19 +7,18 @@ route:
   repeat_interval: 3h
   receiver: escalation-Y-opsgenie
   routes:
-  - match:
-      service: foo
-    receiver: team-X-opsgenie
-
+    - match:
+        service: foo
+      receiver: team-X-opsgenie
 receivers:
-- name: 'team-X-opsgenie'
-  opsgenie_configs:
-  - responders:
-    - name: 'team-X'
-      type: 'team'
-- name: 'escalation-Y-opsgenie'
-  opsgenie_configs:
-  - responders:
-    - name: 'escalation-Y'
-      type: 'escalation'
-    api_key: qwe456
+  - name: 'team-X-opsgenie'
+    opsgenie_configs:
+      - responders:
+          - name: 'team-X'
+            type: 'team'
+  - name: 'escalation-Y-opsgenie'
+    opsgenie_configs:
+      - responders:
+          - name: 'escalation-Y'
+            type: 'escalation'
+        api_key: qwe456
diff --git a/config/testdata/conf.opsgenie-no-apikey.yml b/config/testdata/conf.opsgenie-no-apikey.yml
index 3e355cd4..afcca0c4 100644
--- a/config/testdata/conf.opsgenie-no-apikey.yml
+++ b/config/testdata/conf.opsgenie-no-apikey.yml
@@ -5,13 +5,12 @@ route:
   repeat_interval: 3h
   receiver: team-X-opsgenie
   routes:
-  - match:
-      service: foo
-    receiver: team-X-opsgenie
-
+    - match:
+        service: foo
+      receiver: team-X-opsgenie
 receivers:
-- name: 'team-X-opsgenie'
-  opsgenie_configs:
-  - responders:
-    - name: 'team-X'
-      type: 'team'
\ No newline at end of file
+  - name: 'team-X-opsgenie'
+    opsgenie_configs:
+      - responders:
+          - name: 'team-X'
+            type: 'team'
diff --git a/config/testdata/conf.slack-both-file-and-url.yml b/config/testdata/conf.slack-both-file-and-url.yml
index 7d1333f2..8f593066 100644
--- a/config/testdata/conf.slack-both-file-and-url.yml
+++ b/config/testdata/conf.slack-both-file-and-url.yml
@@ -1,13 +1,11 @@
 global:
   slack_api_url: "http://mysecret.example.com/"
   slack_api_url_file: '/global_file'
-
 route:
   receiver: 'slack-notifications'
   group_by: [alertname, datacenter, app]
-
 receivers:
-- name: 'slack-notifications'
-  slack_configs:
-  - channel: '#alerts1'
-    text: 'test'
+  - name: 'slack-notifications'
+    slack_configs:
+      - channel: '#alerts1'
+        text: 'test'
diff --git a/config/testdata/conf.slack-default-api-url-file.yml b/config/testdata/conf.slack-default-api-url-file.yml
index 4c8ad8ed..808fb87e 100644
--- a/config/testdata/conf.slack-default-api-url-file.yml
+++ b/config/testdata/conf.slack-default-api-url-file.yml
@@ -1,21 +1,19 @@
 global:
   slack_api_url_file: '/global_file'
-
 route:
   receiver: 'slack-notifications'
   group_by: [alertname, datacenter, app]
-
 receivers:
-- name: 'slack-notifications'
-  slack_configs:
-  # Use global
-  - channel: '#alerts1'
-    text: 'test'
-  # Override global with other file
-  - channel: '#alerts2'
-    text: 'test'
-    api_url_file: '/override_file'
-  # Override global with inline URL
-  - channel: '#alerts3'
-    text: 'test'
-    api_url: 'http://mysecret.example.com/'
+  - name: 'slack-notifications'
+    slack_configs:
+      # Use global
+      - channel: '#alerts1'
+        text: 'test'
+      # Override global with other file
+      - channel: '#alerts2'
+        text: 'test'
+        api_url_file: '/override_file'
+      # Override global with inline URL
+      - channel: '#alerts3'
+        text: 'test'
+        api_url: 'http://mysecret.example.com/'
diff --git a/config/testdata/conf.slack-no-api-url.yml b/config/testdata/conf.slack-no-api-url.yml
index 6362f8ad..0d1c4441 100644
--- a/config/testdata/conf.slack-no-api-url.yml
+++ b/config/testdata/conf.slack-no-api-url.yml
@@ -1,9 +1,8 @@
 route:
   receiver: 'slack-notifications'
   group_by: [alertname, datacenter, app]
-
 receivers:
-- name: 'slack-notifications'
-  slack_configs:
-  - channel: '#alerts'
-    text: 'test'
+  - name: 'slack-notifications'
+    slack_configs:
+      - channel: '#alerts'
+        text: 'test'
diff --git a/config/testdata/conf.sns-invalid.yml b/config/testdata/conf.sns-invalid.yml
index 148c71e6..4af387a2 100644
--- a/config/testdata/conf.sns-invalid.yml
+++ b/config/testdata/conf.sns-invalid.yml
@@ -1,7 +1,6 @@
 route:
   receiver: 'sns-api-notifications'
   group_by: [alertname]
-
 receivers:
   - name: 'sns-api-notifications'
     sns_configs:
diff --git a/config/testdata/conf.sns-topic-arn.yml b/config/testdata/conf.sns-topic-arn.yml
index ab83ed9e..ee8988c6 100644
--- a/config/testdata/conf.sns-topic-arn.yml
+++ b/config/testdata/conf.sns-topic-arn.yml
@@ -1,15 +1,14 @@
 route:
   receiver: 'sns-api-notifications'
   group_by: [alertname]
-
 receivers:
-- name: 'sns-api-notifications'
-  sns_configs:
-    - api_url: https://sns.us-east-2.amazonaws.com
-      topic_arn: arn:aws:sns:us-east-2:123456789012:My-Topic
-      sigv4:
-        region: us-east-2
-        access_key: access_key
-        secret_key: secret_ket
-      attributes:
-        severity: Sev2
+  - name: 'sns-api-notifications'
+    sns_configs:
+      - api_url: https://sns.us-east-2.amazonaws.com
+        topic_arn: arn:aws:sns:us-east-2:123456789012:My-Topic
+        sigv4:
+          region: us-east-2
+          access_key: access_key
+          secret_key: secret_ket
+        attributes:
+          severity: Sev2
diff --git a/config/testdata/conf.victorops-default-apikey.yml b/config/testdata/conf.victorops-default-apikey.yml
index ea0fea7a..6cc12fae 100644
--- a/config/testdata/conf.victorops-default-apikey.yml
+++ b/config/testdata/conf.victorops-default-apikey.yml
@@ -1,6 +1,5 @@
 global:
   victorops_api_key: asd132
-
 route:
   group_by: ['alertname', 'cluster', 'service']
   group_wait: 30s
@@ -8,15 +7,14 @@ route:
   repeat_interval: 3h
   receiver: team-Y-victorops
   routes:
-  - match:
-      service: foo
-    receiver: team-X-victorops
-
+    - match:
+        service: foo
+      receiver: team-X-victorops
 receivers:
-- name: 'team-X-victorops'
-  victorops_configs:
-  - routing_key: 'team-X'
-- name: 'team-Y-victorops'
-  victorops_configs:
-  - routing_key: 'team-Y'
-    api_key: qwe456
+  - name: 'team-X-victorops'
+    victorops_configs:
+      - routing_key: 'team-X'
+  - name: 'team-Y-victorops'
+    victorops_configs:
+      - routing_key: 'team-Y'
+        api_key: qwe456
diff --git a/config/testdata/conf.victorops-no-apikey.yml b/config/testdata/conf.victorops-no-apikey.yml
index 968a46b0..61c488f0 100644
--- a/config/testdata/conf.victorops-no-apikey.yml
+++ b/config/testdata/conf.victorops-no-apikey.yml
@@ -5,11 +5,10 @@ route:
   repeat_interval: 3h
   receiver: team-X-victorops
   routes:
-  - match:
-      service: foo
-    receiver: team-X-victorops
-
+    - match:
+        service: foo
+      receiver: team-X-victorops
 receivers:
-- name: 'team-X-victorops'
-  victorops_configs:
-  - routing_key: 'team-X'
+  - name: 'team-X-victorops'
+    victorops_configs:
+      - routing_key: 'team-X'
diff --git a/doc/examples/simple.yml b/doc/examples/simple.yml
index 1cd24b9c..2a0267c3 100644
--- a/doc/examples/simple.yml
+++ b/doc/examples/simple.yml
@@ -7,7 +7,7 @@ global:
 
 # The directory from which notification templates are read.
 templates:
-- '/etc/alertmanager/template/*.tmpl'
+  - '/etc/alertmanager/template/*.tmpl'
 
 # The root route on which each incoming alert enters.
 route:
@@ -45,42 +45,42 @@ route:
 
   # The child route trees.
   routes:
-  # This routes performs a regular expression match on alert labels to
-  # catch alerts that are related to a list of services.
-  - matchers:
-    - service=~"foo1|foo2|baz"
-    receiver: team-X-mails
-    # The service has a sub-route for critical alerts, any alerts
-    # that do not match, i.e. severity != critical, fall-back to the
-    # parent node and are sent to 'team-X-mails'
-    routes:
+    # This routes performs a regular expression match on alert labels to
+    # catch alerts that are related to a list of services.
     - matchers:
-      - severity="critical"
-      receiver: team-X-pager
-  - matchers:
-    - service="files"
-    receiver: team-Y-mails
+        - service=~"foo1|foo2|baz"
+      receiver: team-X-mails
+      # The service has a sub-route for critical alerts, any alerts
+      # that do not match, i.e. severity != critical, fall-back to the
+      # parent node and are sent to 'team-X-mails'
+      routes:
+        - matchers:
+            - severity="critical"
+          receiver: team-X-pager
+    - matchers:
+        - service="files"
+      receiver: team-Y-mails
 
-    routes:
-    - matchers:
-      - severity="critical"
-      receiver: team-Y-pager
+      routes:
+        - matchers:
+            - severity="critical"
+          receiver: team-Y-pager
 
-  # This route handles all alerts coming from a database service. If there's
-  # no team to handle it, it defaults to the DB team.
-  - matchers:
-    - service="database"
-    receiver: team-DB-pager
-    # Also group alerts by affected database.
-    group_by: [alertname, cluster, database]
-    routes:
+    # This route handles all alerts coming from a database service. If there's
+    # no team to handle it, it defaults to the DB team.
     - matchers:
-      - owner="team-X"
-      receiver: team-X-pager
-      continue: true
-    - matchers:
-      - owner="team-Y"
-      receiver: team-Y-pager
+        - service="database"
+      receiver: team-DB-pager
+      # Also group alerts by affected database.
+      group_by: [alertname, cluster, database]
+      routes:
+        - matchers:
+            - owner="team-X"
+          receiver: team-X-pager
+          continue: true
+        - matchers:
+            - owner="team-Y"
+          receiver: team-Y-pager
 
 
 # Inhibition rules allow to mute a set of alerts given that another alert is
@@ -88,35 +88,35 @@ route:
 # We use this to mute any warning-level notifications if the same alert is
 # already critical.
 inhibit_rules:
-- source_matchers: [ severity="critical" ]
-  target_matchers: [ severity="warning" ]
-  # Apply inhibition if the alertname is the same.
-  # CAUTION:
-  #   If all label names listed in `equal` are missing
-  #   from both the source and target alerts,
-  #   the inhibition rule will apply!
-  equal: [ alertname, cluster, service ]
+  - source_matchers: [severity="critical"]
+    target_matchers: [severity="warning"]
+    # Apply inhibition if the alertname is the same.
+    # CAUTION:
+    #   If all label names listed in `equal` are missing
+    #   from both the source and target alerts,
+    #   the inhibition rule will apply!
+    equal: [alertname, cluster, service]
 
 
 receivers:
-- name: 'team-X-mails'
-  email_configs:
-  - to: 'team-X+alerts@example.org'
+  - name: 'team-X-mails'
+    email_configs:
+      - to: 'team-X+alerts@example.org'
 
-- name: 'team-X-pager'
-  email_configs:
-  - to: 'team-X+alerts-critical@example.org'
-  pagerduty_configs:
-  - service_key: <team-X-key>
+  - name: 'team-X-pager'
+    email_configs:
+      - to: 'team-X+alerts-critical@example.org'
+    pagerduty_configs:
+      - service_key: <team-X-key>
 
-- name: 'team-Y-mails'
-  email_configs:
-  - to: 'team-Y+alerts@example.org'
+  - name: 'team-Y-mails'
+    email_configs:
+      - to: 'team-Y+alerts@example.org'
 
-- name: 'team-Y-pager'
-  pagerduty_configs:
-  - service_key: <team-Y-key>
+  - name: 'team-Y-pager'
+    pagerduty_configs:
+      - service_key: <team-Y-key>
 
-- name: 'team-DB-pager'
-  pagerduty_configs:
-  - service_key: <team-DB-key>
+  - name: 'team-DB-pager'
+    pagerduty_configs:
+      - service_key: <team-DB-key>
diff --git a/examples/ha/alertmanager.yml b/examples/ha/alertmanager.yml
index d3f5e8a1..7bd5e0c5 100644
--- a/examples/ha/alertmanager.yml
+++ b/examples/ha/alertmanager.yml
@@ -5,9 +5,9 @@ route:
   repeat_interval: 1h
   receiver: 'web.hook'
 receivers:
-- name: 'web.hook'
-  webhook_configs:
-  - url: 'http://127.0.0.1:5001/'
+  - name: 'web.hook'
+    webhook_configs:
+      - url: 'http://127.0.0.1:5001/'
 inhibit_rules:
   - source_match:
       severity: 'critical'
diff --git a/scripts/tools.go b/scripts/tools.go
index 59277554..e076174c 100644
--- a/scripts/tools.go
+++ b/scripts/tools.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build tools
 // +build tools
 
 // Package tools tracks dependencies for tools that are required to generate the protobuf code.