golang-continuous-integration

Create workflows for testing, linting, security, and release in that order. Run tests with go test -race -shuffle=on across a Go version matrix with fail-fast: false, add golangci-lint, govulncheck, and CodeQL, then automate releases with GoReleaser on version tags.

Use govulncheck for vulnerabilities in actually-called code paths, gosec for Go-specific security issues, CodeQL with the security-and-quality query suite, and Bearer for sensitive data flow detection. Upload results as SARIF to the repository Security tab.

Renovate offers native automerge, gomodTidy to run go mod tidy after updates, better grouping rules, and monorepo support. Dependabot is simpler and built into GitHub but needs a separate workflow for auto-merge and lacks automatic tidying.

Go caches test results, so tests may pass without re-running against services like PostgreSQL or Redis. Use the -count=1 flag to disable caching, and define service containers with health checks in the workflow's services block.

Yes, but libraries should use a minimal GoReleaser config with builds skipped and only changelog generation, since there are no binaries to cross-compile. For simple cases, creating a GitHub Release via gh release create is often sufficient.

Auto-merge requires elevated contents: write and pull-requests: write permissions, and the github.actor guard is not fully spoof-proof. Branch protection with required status checks and approvals is the real safety net, and major updates should be excluded from auto-merge.