61 lines
2.9 KiB
Markdown
61 lines
2.9 KiB
Markdown
# Tooling Modernization
|
|
|
|
Beyond the Go language itself, suggest updating all non-functional developer tools that improve code quality or security for free. These are low-risk, high-value improvements: CI actions/plugins, linters (e.g. golangci-lint), SAST tools (e.g. gosec, Snyk, Semgrep), vulnerability scanners (e.g. govulncheck, Trivy), Docker base images, test coverage reporters, dependency management bots (e.g. Renovate, Dependabot), etc.
|
|
|
|
## Update to the latest Go version
|
|
|
|
Compare the project's `go` directive in `go.mod` against the latest stable release and suggest updating it and the `toolchain` directive if present. Each Go release brings performance improvements, security fixes, and new features.
|
|
|
|
```bash
|
|
# Check current version
|
|
go version
|
|
|
|
# Update go.mod to target a newer version
|
|
go mod edit -go=1.26
|
|
|
|
# Update toolchain
|
|
go get toolchain@latest
|
|
```
|
|
|
|
## golangci-lint v2 _(golangci-lint v2.0.0+, March 2025)_
|
|
|
|
Upgrade to golangci-lint v2. **Migration**: Run `golangci-lint migrate` to convert v1 config to v2. See the `samber/cc-skills-golang@golang-lint` skill for the recommended configuration.
|
|
|
|
## govulncheck _(works best with Go 1.22+)_
|
|
|
|
`govulncheck` scans Go code for known vulnerabilities using the Go vulnerability database at `vuln.go.dev`. It analyzes call graphs to report only **reachable** vulnerabilities.
|
|
|
|
**Note**: The vulnerability database tracks Go standard library issues starting from Go 1.18. Third-party module vulnerabilities are tracked regardless of Go version. For best results (better call graph analysis), use Go 1.22+.
|
|
|
|
```bash
|
|
# Pin in the module (Go 1.24+)
|
|
go get -tool golang.org/x/vuln/cmd/govulncheck@latest
|
|
|
|
# Scan source code
|
|
go tool govulncheck ./...
|
|
|
|
# Scan a compiled binary
|
|
go tool govulncheck -mode=binary ./myapp
|
|
```
|
|
|
|
## Profile-Guided Optimization (PGO) _(Go 1.21+)_
|
|
|
|
PGO is generally available since Go 1.21, providing 2-14% performance improvements:
|
|
|
|
```bash
|
|
# 1. Build and run with CPU profiling
|
|
go test -cpuprofile=default.pgo -bench=. ./...
|
|
|
|
# 2. Place default.pgo in the main package directory
|
|
# 3. Rebuild — PGO is applied automatically
|
|
go build ./...
|
|
```
|
|
|
|
Go 1.22+ expanded PGO to devirtualize more interface calls. Go 1.23+ reduced PGO build time overhead to single digits.
|
|
|
|
## AI-Driven Code Review in CI
|
|
|
|
Add an AI agent as a PR reviewer alongside traditional static analysis. When configured with this skill plugin, the agent loads the relevant Go skills — `golang-security` for security review, `golang-concurrency` for concurrency issues, `golang-error-handling` for error handling, and so on — giving it the same expertise as a senior Go reviewer. This catches architectural drift, logic bugs, missing context in errors, and subtle concurrency hazards that linters cannot detect.
|
|
|
|
See the `samber/cc-skills-golang@golang-continuous-integration` skill for ready-to-use GitHub Actions assets for both Claude Code and GitHub Copilot.
|