go-ci

Go CI

A Go pipeline has exactly four gates: build, vet/lint, test with race detector, vulnerability scan. Everything else is optimization.

Detailed reference material, loaded on demand:

• references/security-and-automation.md — CodeQL and gosec SARIF, Dependabot config, SHA pinning, repository hardening, Trivy, an AI review workflow.

Read a reference file only when the summary below is not enough.

1. Baseline GitHub Actions Workflow

name: ci
on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod   # single source of truth
          cache: true               # caches module + build cache
      - run: go build ./...
      - run: go vet ./...
      - run: go test -race -shuffle=on -coverprofile=coverage.out ./...

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
      - uses: golangci/golangci-lint-action@v9  # v7+ runs golangci-lint v2
        with:
          version: v2.6                         # pin a minor; v2.6+ has `modernize`

  vuln:
    runs-on: ubuntu-latest
    steps:
      - uses: golang/govulncheck-action@v1
        with:
          go-version-file: go.mod

Action major versions move several times a year. Treat the ones above as a snapshot, and let Dependabot's github-actions ecosystem keep them current rather than editing them by hand.

Key decisions baked in:

• go-version-file: go.mod — never hardcode the Go version in two places.
• cache: true on setup-go handles module and build caches; do not add manual actions/cache steps for Go on top of it.
• -race -shuffle=on — races and order-dependent tests fail in CI, not production.
• permissions: contents: read — least privilege by default.
• Lint in a separate job — it fails fast and parallelizes with tests.