golang-continuous-integration

Setting up GitHub Actions for Go involves configuring workflows that run tests with race detection, enforce coverage reporting, and check go mod tidy consistency to prevent dependency drift. This skill generates those opinionated pipeline configurations automatically.

Adding security scanning to a Go CI/CD pipeline requires integrating SAST tools like gosec, govulncheck for call-path vulnerabilities, and CodeQL for deep analysis. This skill configures these scanners alongside linting and vetting within your GitHub Actions workflows.

GitHub Actions supports GoReleaser for automated release pipelines, including Docker build workflows with provenance, SBOM generation, and container scanning. This skill sets up those release workflows to ensure secure and auditable artifact distribution.

Dependabot can manage Go module dependencies in CI by applying safe grouping rules to prevent disruptive updates. This skill configures Dependabot within your repository to automate dependency updates while maintaining pipeline stability.

Running go test with race detection and shuffled execution (-shuffle=on) catches hidden data races and test order dependencies before merge. This skill enforces these required test flags as part of your quality gates to ensure reliable Go changes.

Preventing dependency drift in a Go repository requires checking go mod tidy consistency within your CI pipeline. This skill adds automated checks to ensure your go.sum and go.mod files remain synchronized during development.