| name | go-review |
| description | Review Go code for security, correctness, performance, and maintainability. Use when reviewing Go PRs requiring judgment beyond automated checks. |
| license | Apache-2.0 |
| metadata | {"author":"y-miyazaki","version":"1.1.2"} |
Input
- Go files in PR or changeset (required)
- PR context: diff, commit messages, and
go-validation output (required for PR review; for ad-hoc file review without PR, skip step 2 and evaluate all applicable checks directly)
Output Specification
Return structured Markdown in accordance with references/common-output-format.md.
Minimal inline contract (used if reference file is unavailable):
## Checks Summary
- Total: <n>, Passed: <n>, Failed: <n>, Deferred: <n>
## Checks (Failed/Deferred Only)
| ItemID | Status | Evidence | Fix |
## Issues
1. <ItemID>: <title>
- File: <path>#L<line>
- Problem: <specific>
- Recommendation: <fix>
Execution Scope
- Systematically apply review checklist from references/common-checklist.md
- Focus on checks requiring human/AI judgment (design, concurrency, security patterns)
- Do not run go-validation or execute gofumpt/go vet/golangci-lint/go test/govulncheck
- Do not modify code files or approve/merge PRs
USE FOR:
- review Go PRs where
.go files are in the changeset (validation output may or may not exist)
- assess design, security, and concurrency risks not covered by static checks
- perform risk-focused review on multi-package changes
- ad-hoc review of Go source files outside a PR context
DO NOT USE FOR:
- run formatting/lint/test/vulnerability command pipelines (use go-validation)
- implement code fixes directly
- changesets containing only non-Go files (e.g., docs-only, CI config-only)
Reference Files Guide
Workflow
- Read PR context and change intent.
- Confirm
go-validation results exist. If missing, inform the user that validation should run first, then proceed with a partial review: evaluate design, security, and concurrency checks (which do not require tool output) and defer lint/test/vuln-dependent checks (mark as Deferred with reason "validation evidence unavailable").
- Review relevant checklist categories and collect failed/deferred ItemIDs. When uncertain which categories apply, prioritize category-security, category-concurrency, category-error-handling, and category-global first; read other category files when the changeset touches those areas.
- Output required report sections per references/common-output-format.md. Prioritize
SEC-* findings first. Include file path and line reference for each finding.
- Exclude generated files and
vendor/ from primary findings unless they introduce security-critical risk.
- For very large PRs (>50 changed Go files), prioritize security/correctness checks first and defer low-risk style checks if evidence is insufficient.
Severity and Status Rules
| Status | When to use |
|---|
| Failed | Finding is confirmed from source code with concrete evidence (file + line) |
| Deferred | Check cannot be evaluated โ validation output missing, file too large to fully analyze, or ambiguous without runtime context |
| Passed | Check evaluated and no issue found (counted in summary only) |
Severity priority for Issues section ordering: SEC-* > CON-* > ERR-* > all others.
Error Handling
| Condition | Severity | Action |
|---|
go-validation output missing | Recoverable | Defer validator-dependent checks, review design/security checks that don't require tool output |
common-checklist.md unavailable | Fatal | Stop, report missing dependency |
common-output-format.md unavailable | Recoverable | Use inline output contract above |
| PR contains only generated/vendor files | Recoverable | Report "no reviewable Go source" and stop |
Examples
- Prompt:
Review Go code changes for design and correctness
- Result: Structured report with per-file checks, failed items with severity/fix suggestions.
