菜单
CI/CD with GitHub Actions for Golang — testing, linting, SAST, security scanning, coverage, Dependabot, Renovate, GoReleaser, release pipelines. Use when setting up Go project CI, GitHub Actions workflows, linters/scanners, dependency update automation, or quality gates.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/context-labs/whip --skill golang-continuous-integration命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | golang-continuous-integration |
| description | CI/CD with GitHub Actions for Golang — testing, linting, SAST, security scanning, coverage, Dependabot, Renovate, GoReleaser, release pipelines. Use when setting up Go project CI, GitHub Actions workflows, linters/scanners, dependency update automation, or quality gates. |
| user-invocable | true |
| license | MIT |
| compatibility | Designed for Claude Code, Codex or similar harness, and for projects using Golang. |
| metadata | {"author":"samber","version":"1.4.0","openclaw":{"emoji":"🚀","homepage":"https://github.com/samber/cc-skills-golang","requires":{"bins":"[Truncated]"},"install":["[Truncated]","[Truncated]","[Truncated]"]}} |
| allowed-tools | Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch Bash(goreleaser:*) Bash(gh:*) AskUserQuestion |
Persona: You are a Go DevOps engineer. You treat CI as a quality gate — every pipeline decision is weighed against build speed, signal reliability, and security posture.
Modes:
Dependencies:
go install github.com/goreleaser/goreleaser/v2@latestbrew install ghSet up production-grade CI/CD pipelines for Go projects using GitHub Actions.
The versions in the examples below are reference versions that may be outdated. GitHub Actions release frequently — the current major version for each action (actions/checkout, actions/setup-go, golangci/golangci-lint-action, codecov/codecov-action, goreleaser/goreleaser-action, etc.) may differ from what is shown here.
| Stage | Tool | Purpose |
|---|---|---|
| Test | go test -race | Unit + race detection |
| Coverage | codecov/codecov-action | Coverage reporting |
| Lint | golangci-lint | Comprehensive linting |
| Vet | go vet | Built-in static analysis |
| SAST | gosec, CodeQL, Bearer | Security static analysis |
| Vuln scan | govulncheck | Known vulnerability detection |
docker/build-push-action |
| Multi-platform image builds |
| Deps | Dependabot / Renovate | Automated dependency updates |
| Release | GoReleaser | Automated binary releases |
| AI Review | Claude Code / Copilot | AI-powered PR review |
.github/workflows/test.yml — see test.yml
Adapt the Go version matrix to match go.mod:
go 1.23 → matrix: ["1.23", "1.24", "1.25", "1.26", "stable"]
go 1.24 → matrix: ["1.24", "1.25", "1.26", "stable"]
go 1.25 → matrix: ["1.25", "1.26", "stable"]
go 1.26 → matrix: ["1.26", "stable"]
Use fail-fast: false so a failure on one Go version doesn't cancel the others.
Test flags:
-race: CI MUST run tests with the -race flag (catches data races — undefined behavior in Go)-shuffle=on: Randomize test order to catch inter-test dependencies-coverprofile: Generate coverage datagit diff --exit-code: Fails if go mod tidy changes anythingCI SHOULD enforce code coverage thresholds. Configure thresholds in codecov.yml at the repo root — see codecov.yml
.github/workflows/integration.yml — see integration.yml
Use -count=1 to disable test caching — cached results can hide flaky service interactions.
golangci-lint MUST be run in CI on every PR. .github/workflows/lint.yml — see lint.yml
Create .golangci.yml at the root of the project. See the samber/cc-skills-golang@golang-lint skill for the recommended configuration.
.github/workflows/security.yml — see security.yml
CI MUST run govulncheck. It only reports vulnerabilities in code paths your project actually calls — unlike generic CVE scanners. CodeQL results appear in the repository's Security tab. Bearer is good at detecting sensitive data flow issues.
Create .github/codeql/codeql-config.yml to use the extended security query suite — see codeql-config.yml
Available query suites:
If the project produces Docker images, Trivy container scanning is included in the Docker workflow — see docker.yml
.github/dependabot.yml — see dependabot.yml
Minor/patch updates are grouped into a single PR. Major updates get individual PRs since they may have breaking changes.
.github/workflows/dependabot-auto-merge.yml — see dependabot-auto-merge.yml
Security warning: This workflow requires
contents: writeandpull-requests: write— these are elevated permissions that allow merging PRs and modifying repository content. Theif: github.actor == 'dependabot[bot]'guard restricts execution to Dependabot only. Do not remove this guard. Note thatgithub.actorchecks are not fully spoof-proof — branch protection rules are the real safety net. Ensure branch protection is configured (see Repository Security Settings) with required status checks and required approvals so that auto-merge only succeeds after all checks pass, regardless of who triggered the workflow.
Renovate is a more mature and configurable alternative to Dependabot. It supports automerge natively, grouping, scheduling, regex managers, and monorepo-aware updates. If Dependabot feels too limited, Renovate is the go-to choice.
Install the Renovate GitHub App, then create renovate.json at the repo root — see renovate.json
Key advantages over Dependabot:
gomodTidy: Automatically runs go mod tidy after updatesGoReleaser automates binary builds, checksums, and GitHub Releases. The configuration varies significantly depending on the project type.
.github/workflows/release.yml — see release.yml
Security warning: This workflow requires
contents: writeto create GitHub Releases. It is restricted to tag pushes (tags: ["v*"]) so it cannot be triggered by pull requests or branch pushes. Only users with push access to the repository can create tags.
Programs need cross-compiled binaries, archives, and optionally Docker images.
.goreleaser.yml — see goreleaser-cli.yml
Libraries don't produce binaries — they only need a GitHub Release with a changelog. Use a minimal config that skips the build.
.goreleaser.yml — see goreleaser-lib.yml
For libraries, you may not even need GoReleaser — a simple GitHub Release created via the UI or gh release create is often sufficient.
When a repository contains multiple commands (e.g., cmd/api/, cmd/worker/).
.goreleaser.yml — see goreleaser-monorepo.yml
For projects that produce Docker images. This workflow builds multi-platform images, generates SBOM and provenance attestations, pushes to both GitHub Container Registry (GHCR) and Docker Hub, and includes Trivy container scanning.
.github/workflows/docker.yml — see docker.yml
Security warning: Permissions are scoped per job: the
container-scanjob only getscontents: read+security-events: write, while thedockerjob getspackages: write(to push to GHCR) andattestations: write+id-token: write(for provenance/SBOM signing). This ensures the scan job cannot push images even if compromised. Thepushflag is set tofalseon pull requests so untrusted code cannot publish images. TheDOCKERHUB_USERNAMEandDOCKERHUB_TOKENsecrets must be configured in the repository secrets settings — never hardcode credentials.
Key details:
linux/amd64,linux/arm64). Remove platforms you don't need.push: false on PRs: Images are built but never pushed on pull requests — this validates the Dockerfile without publishing untrusted code.v1.2.3 → 1.2.3, 1.2, 1), branch tags (main), and SHA tags.provenance: mode=max and sbom: true generate supply chain attestations. These require attestations: write and id-token: write permissions.GITHUB_TOKEN, no extra secret needed) and Docker Hub (requires DOCKERHUB_USERNAME + DOCKERHUB_TOKEN secrets). Remove the Docker Hub login and image line if not needed.docker.io/ line from images:.Repository security settings (branch protection, workflow permissions, secrets, environments) form the security foundation for the CI pipeline — these are documented in repo-security.md.
Add AI agents as PR reviewers alongside traditional static analysis. When loaded with this skill plugin, the agent applies the relevant Go skills per review area — catching architectural drift, logic bugs, missing error context, and concurrency hazards that linters cannot detect.
Cost note: AI review agents run concurrently per PR. For cost control, remove jobs you don't need or raise the PR trigger filter to specific branches only.
Each subsection below is a generated artifact targeting one specific reviewer — the linked asset file runs on a CI runner, not the developer's local harness, so its tool names and permission flags are deliberately literal rather than capability prose.
.github/workflows/ai-review.yml — see claude-code-review.yml
The workflow runs parallel jobs, each scoped to a set of review areas and priority level:
| Job | Areas | Priority |
|---|---|---|
quality | Code style, Naming, Documentation, Design patterns | Suggestion-first |
correctness | Error handling, Code safety, Concurrency | Blocking-first |
security | Security, Dependencies | Blocking-first |
quality-depth | Tests, Performance, Observability, Modernize | Mixed |
Additional skills that may be relevant depending on the project: golang-cli, golang-context, golang-data-structures, golang-database, golang-dependency-injection, or any library-specific skill.
The Claude Code GitHub App integration is configured via the /install-github-app command, which sets up the required API secrets.
Copy skills into your repo, then append copilot-review-instructions.md to .github/copilot-instructions.md:
npx skills add https://github.com/samber/cc-skills-golang --agent github-copilot --skill '*' -y --copy
ln -s .agents .copilot
| Mistake | Fix |
|---|---|
Missing -race in CI tests | Always use go test -race |
No -shuffle=on | Randomize test order to catch inter-test dependencies |
| Caching integration test results | Use -count=1 to disable caching |
go mod tidy not checked | Add go mod tidy && git diff --exit-code step |
Missing fail-fast: false | One Go version failing shouldn't cancel other jobs |
| Not pinning action versions | GitHub Actions MUST use pinned major versions (e.g. @vN, not @master) |
No permissions block | Follow least-privilege per job |
| Ignoring govulncheck findings | Fix or suppress with justification |
| No AI review in CI | Add Claude Code or Copilot review — catches logic, security, and architectural issues that static analysis misses |
See samber/cc-skills-golang@golang-lint, samber/cc-skills-golang@golang-security, samber/cc-skills-golang@golang-testing, samber/cc-skills-golang@golang-dependency-management, samber/cc-skills-golang@golang-modernize skills.