Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alexastrum/skl --skill golang-continuous-integrationgit clone --depth 1 https://github.com/alexastrum/sklWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alexastrum/skl/golang-continuous-integration)<a href="https://agentmods.dev/skills/alexastrum/skl/golang-continuous-integration"><img src="https://agentmods.dev/badge/skills/alexastrum/skl/golang-continuous-integration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alexastrum/skl/golang-continuous-integration"><img src="https://agentmods.dev/badge/skills/alexastrum/skl/golang-continuous-integration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.03256 |
| Opus 5 | $0.00044 | $0.01628 |
| Sonnet 5 | $0.00017 | $0.00651 |
| Haiku 4.5 | $0.00009 | $0.00326 |
Grade A, and why
golang-continuous-integration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
91% identical to golang-continuous-integration — 29 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 268 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Persona: You are a Go DevOps engineer. You treat CI as a quality gate — every pipeline decision is weighed against build speed, signal reliability, and security posture.
Modes:
- Setup — adding CI to a project for the first time: start with the Quick Reference table, then generate workflows in this order: test → lint → security → release. Prefer the latest stable major version for each GitHub Action.
- Improve — auditing or extending an existing pipeline: read current workflow files first, identify gaps against the Quick Reference table, then propose targeted additions without duplicating existing steps.
Go Continuous Integration
Set up production-grade CI/CD pipelines for Go projects using GitHub Actions.
Action Versions
The versions in the examples below are reference versions that may be outdated. GitHub Actions release frequently — the current major version for each action (actions/checkout, actions/setup-go, golangci/golangci-lint-action, codecov/codecov-action, goreleaser/goreleaser-action, etc.) may differ from what is shown here.
Quick Reference
| Stage | Tool | Purpose |
|---|---|---|
| Test | go test -race |
Unit + race detection |
| Coverage | codecov/codecov-action |
Coverage reporting |
| Lint | golangci-lint |
Comprehensive linting |
| Vet | go vet |
Built-in static analysis |
| SAST | gosec, CodeQL, Bearer |
Security static analysis |
| Vuln scan | govulncheck |
Known vulnerability detection |
| Docker | docker/build-push-action |
Multi-platform image builds |
| Deps | Dependabot / Renovate | Automated dependency updates |
| Release | GoReleaser | Automated binary releases |
| AI Review | Claude Code / Copilot | AI-powered PR review |
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/claude-code-review.yml 21 KB
- assets/codecov.yml 135 B
- assets/codeql-config.yml 118 B
- assets/copilot-review-instructions.md 3.6 KB
- assets/dependabot-auto-merge.yml 698 B
- assets/dependabot.yml 623 B
- assets/docker.yml 2.4 KB
- assets/goreleaser-cli.yml 551 B
- assets/goreleaser-lib.yml 122 B
- assets/goreleaser-monorepo.yml 452 B
- assets/integration.yml 1.1 KB
- assets/lint.yml 494 B
- assets/release.yml 539 B
- assets/renovate.json 467 B
- assets/security.yml 1.6 KB
- assets/test.yml 1.0 KB
- evals/evals.json 18 KB
- references/repo-security.md 3.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 268 lines · 87 tokens per session scan A 5f2b28373630
golang-continuous-integration is a skill published in the GitHub repository alexastrum/skl (11 stars, last pushed 3mo ago), licensed MIT. It adds 87 tokens to every session and 3,256 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. It is 91% identical to golang-continuous-integration, differing in 29 lines, and is treated as a copy.
Other skills, from other repositories
gograph
Go repository intelligence for Claude Code. Use when reading, navigating, editing, reviewing, or refactoring a Go codebase. Exposes 64 query, analysis, and workflow capabilities through the local gograph MCP server, including bounded first-call exploration, AST-aware call graphs, blast-radius analysis, impact, and…
go-ci-workflow
Use when creating or refactoring GitHub Actions CI workflows for Go repositories. Covers repository-shape detection, Make-driven delegation with formal fallbacks, Go setup, caching, tool pinning, permissions, reusable workflows, and quality gate design.
printing-press-polish
Polish a generated CLI to pass verification and become publish-ready. Runs diagnostics (dogfood, verify, scorecard, go vet, gosec), automatically fixes all issues (verify failures, static-analysis findings, dead code, descriptions, README, MCP tool quality), reports the before/after delta, and offers to publish. Use…
use-modern-go
Use the Modern Go Guidelines CLI whenever writing, modifying, fixing, or refactoring Go code. Apply its version-specific guidance to generated changes.
printing-press
Set up a new integration, connector, or CLI binding for any API. Wrap or generate a ship-ready Go CLI from an OpenAPI, HAR, or Postman spec via the lean research -> generate -> build -> shipcheck loop. Use when the user says build a CLI, wrap this API, set up a new integration, add a connector, integrate with a…
go-127
What changed in Go 1.27 (released August 2026) and how it changes the way Go is written in pi-go. Use this skill when writing or reviewing Go that could use a 1.27 feature, when bumping the go directive in go.mod, when a build or test behaves differently after a toolchain upgrade, or when code-guidelines-go points…