samber/cc-skills-golang is a collection of reusable agent instructions for Go development, covering areas such as the language, testing, security, and observability. It is for coding agents assisting with production-oriented Golang projects. The catalogue entries are its Go-specific skills, rule, plugin, and instruction.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add samber/cc-skills-golang --skill golang-continuous-integrationgit clone --depth 1 https://github.com/samber/cc-skills-golangWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/samber/cc-skills-golang/golang-continuous-integration)<a href="https://agentmods.dev/skills/samber/cc-skills-golang/golang-continuous-integration"><img src="https://agentmods.dev/badge/skills/samber/cc-skills-golang/golang-continuous-integration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/samber/cc-skills-golang/golang-continuous-integration"><img src="https://agentmods.dev/badge/skills/samber/cc-skills-golang/golang-continuous-integration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket warn
- Snyk warn
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 164 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium MCP Rug Pull · line 258 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00181 | $0.03542 |
| Opus 5.5 | $0.00072 | $0.01417 |
| Sonnet 5.5 | $0.00036 | $0.00708 |
| Haiku 4.5 | $0.00018 | $0.00354 |
Grade A, and why
golang-continuous-integration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
2 near-identical copies found in the catalogue:
- golang-continuous-integration — 91% identical, 29 lines differ
- golang-continuous-integration — 88% identical, 80 lines differ
How it starts
The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Persona: You are a Go DevOps engineer. You treat CI as a quality gate — every pipeline decision is weighed against build speed, signal reliability, and security posture.
Modes:
- Setup — adding CI to a project for the first time: start with the Quick Reference table, then generate workflows in this order: test → lint → security → release. Prefer the latest stable major version for each GitHub Action.
- Improve — auditing or extending an existing pipeline: read current workflow files first, identify gaps against the Quick Reference table, then propose targeted additions without duplicating existing steps.
Dependencies:
- goreleaser:
go install github.com/goreleaser/goreleaser/v2@latest - gh:
brew install gh
Go Continuous Integration
Set up production-grade CI/CD pipelines for Go projects using GitHub Actions.
Action Versions
The versions in the examples below are reference versions that may be outdated. GitHub Actions release frequently — the current major version for each action (actions/checkout, actions/setup-go, golangci/golangci-lint-action, codecov/codecov-action, goreleaser/goreleaser-action, etc.) may differ from what is shown here.
Quick Reference
| Stage | Tool | Purpose |
|---|---|---|
| Test | go test -race |
Unit + race detection |
| Coverage | codecov/codecov-action |
Coverage reporting |
| Lint | golangci-lint |
Comprehensive linting |
| Vet | go vet |
Built-in static analysis |
| SAST | gosec, CodeQL, Bearer |
Security static analysis |
| Vuln scan | govulncheck |
Known vulnerability detection |
| Docker | docker/build-push-action |
Multi-platform image builds |
| Deps | Dependabot / Renovate | Automated dependency updates |
| Release | GoReleaser | Automated binary releases |
| AI Review | Claude Code / Copilot | AI-powered PR review |
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/claude-code-review.yml 21 KB
- assets/codecov.yml 135 B
- assets/codeql-config.yml 118 B
- assets/copilot-review-instructions.md 3.6 KB
- assets/dependabot-auto-merge.yml 698 B
- assets/dependabot.yml 623 B
- assets/docker.yml 2.4 KB
- assets/goreleaser-cli.yml 551 B
- assets/goreleaser-lib.yml 122 B
- assets/goreleaser-monorepo.yml 452 B
- assets/integration.yml 1.1 KB
- assets/lint.yml 494 B
- assets/release.yml 539 B
- assets/renovate.json 467 B
- assets/security.yml 1.6 KB
- assets/test.yml 1.0 KB
- evals/evals.json 18 KB
- references/repo-security.md 3.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +6 lines 106f80606011
- 1mo ago Changed · +94 tokens per session 6710160b0fb7
- 1mo ago First seen · 275 lines · 87 tokens per session scan A 7a8947a0a080
golang-continuous-integration is a skill published in the GitHub repository samber/cc-skills-golang (3,684 stars, last pushed 4d ago), licensed MIT. It adds 181 tokens to every session and 3,542 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
stack-trace-go-probe
Internal helper for meta-stack-trace-investigator. Use when a Go panic or stack trace needs Go-specific nil/error checks, go test reproducer guidance, and patch targets.
dart-tooling
Dart static analysis, linting, formatting, and code-generation standards. Use only for analysisoptions.yaml, buildrunner, dart format, DCM, lefthook, or analyze/format CI failures; defer Dart language, null-safety, Flutter tests, and generic CI questions.
golang-pro
Master Go 1.21+ with modern patterns, advanced concurrency, performance optimization, and production-ready microservices. Expert in the latest Go ecosystem including generics, workspaces, and cutting-edge frameworks. Use PROACTIVELY for Go development, architecture design, or performance optimization.
tree-sitter-language-pack-managing-parsers
Use when the user needs to manage the tree-sitter parser cache — prefetch parsers for offline or CI runs, list what is downloaded, inspect a language, find the cache directory, or clean it. Covers ts-pack download, list, info, cache-dir, clean, and init.
go-concurrency-patterns
Master Go concurrency with goroutines, channels, sync primitives, and context. Use when building concurrent Go applications, implementing worker pools, or debugging race conditions.
go-services
Build and upgrade Go services, workers and CLI applications with context propagation and explicit ownership. Use when implementing Go HTTP/data/concurrency paths; preserve module and deployment constraints and verify race-sensitive behavior deterministically.