2.9 KiB
Tooling Modernization
Beyond the Go language itself, suggest updating all non-functional developer tools that improve code quality or security for free. These are low-risk, high-value improvements: CI actions/plugins, linters (e.g. golangci-lint), SAST tools (e.g. gosec, Snyk, Semgrep), vulnerability scanners (e.g. govulncheck, Trivy), Docker base images, test coverage reporters, dependency management bots (e.g. Renovate, Dependabot), etc.
Update to the latest Go version
Compare the project's go directive in go.mod against the latest stable release and suggest updating it and the toolchain directive if present. Each Go release brings performance improvements, security fixes, and new features.
# Check current version
go version
# Update go.mod to target a newer version
go mod edit -go=1.26
# Update toolchain
go get toolchain@latest
golangci-lint v2 (golangci-lint v2.0.0+, March 2025)
Upgrade to golangci-lint v2. Migration: Run golangci-lint migrate to convert v1 config to v2. See the samber/cc-skills-golang@golang-lint skill for the recommended configuration.
govulncheck (works best with Go 1.22+)
govulncheck scans Go code for known vulnerabilities using the Go vulnerability database at vuln.go.dev. It analyzes call graphs to report only reachable vulnerabilities.
Note: The vulnerability database tracks Go standard library issues starting from Go 1.18. Third-party module vulnerabilities are tracked regardless of Go version. For best results (better call graph analysis), use Go 1.22+.
# Pin in the module (Go 1.24+)
go get -tool golang.org/x/vuln/cmd/govulncheck@latest
# Scan source code
go tool govulncheck ./...
# Scan a compiled binary
go tool govulncheck -mode=binary ./myapp
Profile-Guided Optimization (PGO) (Go 1.21+)
PGO is generally available since Go 1.21, providing 2-14% performance improvements:
# 1. Build and run with CPU profiling
go test -cpuprofile=default.pgo -bench=. ./...
# 2. Place default.pgo in the main package directory
# 3. Rebuild — PGO is applied automatically
go build ./...
Go 1.22+ expanded PGO to devirtualize more interface calls. Go 1.23+ reduced PGO build time overhead to single digits.
AI-Driven Code Review in CI
Add an AI agent as a PR reviewer alongside traditional static analysis. When configured with this skill plugin, the agent loads the relevant Go skills — golang-security for security review, golang-concurrency for concurrency issues, golang-error-handling for error handling, and so on — giving it the same expertise as a senior Go reviewer. This catches architectural drift, logic bugs, missing context in errors, and subtle concurrency hazards that linters cannot detect.
See the samber/cc-skills-golang@golang-continuous-integration skill for ready-to-use GitHub Actions assets for both Claude Code and GitHub Copilot.