[teamai] Push 87 resource(s) from XingfenD

2026-09-10 16:10:45 +08:00
parent 425c9c078a
commit 65c04def51
1314 changed files with 211681 additions and 0 deletions
@@ -0,0 +1,60 @@
+# Tooling Modernization
+
+Beyond the Go language itself, suggest updating all non-functional developer tools that improve code quality or security for free. These are low-risk, high-value improvements: CI actions/plugins, linters (e.g. golangci-lint), SAST tools (e.g. gosec, Snyk, Semgrep), vulnerability scanners (e.g. govulncheck, Trivy), Docker base images, test coverage reporters, dependency management bots (e.g. Renovate, Dependabot), etc.
+
+## Update to the latest Go version
+
+Compare the project's `go` directive in `go.mod` against the latest stable release and suggest updating it and the `toolchain` directive if present. Each Go release brings performance improvements, security fixes, and new features.
+
+```bash
+# Check current version
+go version
+
+# Update go.mod to target a newer version
+go mod edit -go=1.26
+
+# Update toolchain
+go get toolchain@latest
+```
+
+## golangci-lint v2 _(golangci-lint v2.0.0+, March 2025)_
+
+Upgrade to golangci-lint v2. **Migration**: Run `golangci-lint migrate` to convert v1 config to v2. See the `samber/cc-skills-golang@golang-lint` skill for the recommended configuration.
+
+## govulncheck _(works best with Go 1.22+)_
+
+`govulncheck` scans Go code for known vulnerabilities using the Go vulnerability database at `vuln.go.dev`. It analyzes call graphs to report only **reachable** vulnerabilities.
+
+**Note**: The vulnerability database tracks Go standard library issues starting from Go 1.18. Third-party module vulnerabilities are tracked regardless of Go version. For best results (better call graph analysis), use Go 1.22+.
+
+```bash
+# Pin in the module (Go 1.24+)
+go get -tool golang.org/x/vuln/cmd/govulncheck@latest
+
+# Scan source code
+go tool govulncheck ./...
+
+# Scan a compiled binary
+go tool govulncheck -mode=binary ./myapp
+```
+
+## Profile-Guided Optimization (PGO) _(Go 1.21+)_
+
+PGO is generally available since Go 1.21, providing 2-14% performance improvements:
+
+```bash
+# 1. Build and run with CPU profiling
+go test -cpuprofile=default.pgo -bench=. ./...
+
+# 2. Place default.pgo in the main package directory
+# 3. Rebuild — PGO is applied automatically
+go build ./...
+```
+
+Go 1.22+ expanded PGO to devirtualize more interface calls. Go 1.23+ reduced PGO build time overhead to single digits.
+
+## AI-Driven Code Review in CI
+
+Add an AI agent as a PR reviewer alongside traditional static analysis. When configured with this skill plugin, the agent loads the relevant Go skills — `golang-security` for security review, `golang-concurrency` for concurrency issues, `golang-error-handling` for error handling, and so on — giving it the same expertise as a senior Go reviewer. This catches architectural drift, logic bugs, missing context in errors, and subtle concurrency hazards that linters cannot detect.
+
+See the `samber/cc-skills-golang@golang-continuous-integration` skill for ready-to-use GitHub Actions assets for both Claude Code and GitHub Copilot.