skills.rest
fusengine
fusengineCOMMUNITY
Explore all skills by this author →
Website𝕏@fusengineGitHub

go-tooling-security

Configure Go modules, golangci-lint v2, govulncheck, and CI quality gates for Go projects.

1|Updated Jul 29, 2026
Search Tags:#linting#go#vulnerability scanning#ci#golangci-lint#govulncheck#go modules
One-click install
npx skills add https://github.com/fusengine/kimi-code --skill go-tooling-security-fusengine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: go-tooling-security
Source: https://github.com/fusengine/kimi-code/tree/main/plugins/go-expert/skills/go-tooling-security
Command: npx skills add https://github.com/fusengine/kimi-code --skill go-tooling-security-fusengine

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Go projects need consistent tooling configuration across modules, linting, vulnerability scanning, and CI, but golangci-lint v2's breaking config changes, workspace semantics, and govulncheck's exit-code quirks make setup error-prone. This Skill provides verified guidance and drop-in templates for the full Go tooling and dependency security workflow. ## Core Features & Use Cases - Modules & Workspaces: Configure go.mod directives and go.work multi-module workspaces without scattering replace directives. - golangci-lint v2 Migration: Migrate v1 configs with golangci-lint migrate and apply a complete v2 config with the formatters/linters split. - Vulnerability Scanning: Run govulncheck reachability-based scans against vuln.go.dev and gate CI on reachable findings. - Use Case: You inherit a Go monorepo with an outdated v1 lint config and no security scanning. Use this Skill to migrate the config to v2, set up a go.work workspace, and wire a fail-fast CI gate running fmt, vet, lint, govulncheck, and race-enabled tests. ## Quick Start Set up a Go CI quality gate with golangci-lint v2 and govulncheck for my repository using the provided templates.

Frequently Asked Questions about go-tooling-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I migrate a golangci-lint v1 config to v2?▼

Run `golangci-lint migrate`, which rewrites the config to v2 format and backs up the original. Do not hand-edit: v2 requires `version: "2"` as the first line and moves gofmt/goimports into a dedicated `formatters` section.

How do I scan Go dependencies for vulnerabilities?▼

Install govulncheck with `go install golang.org/x/vuln/cmd/govulncheck@latest` and run `govulncheck ./...`. It uses call-graph reachability against vuln.go.dev, so it only reports vulnerabilities your code can actually reach.

Should I commit go.work to my repository?▼

Commit go.work only when the modules are developed exclusively together. Otherwise keep it local, because a committed workspace can make CI resolve unexpected dependency versions; set GOWORK=off in CI to disable workspace mode.

Why does my govulncheck CI step never fail on vulnerabilities?▼

govulncheck exits 0 when using `-json`, `-format sarif`, or `-format openvex` output. Gate CI on the plain-text run, which returns a non-zero exit code when reachable vulnerabilities are found.

What is the correct order for a Go CI quality gate?▼

Run cheapest checks first: gofmt/goimports, then go vet, then golangci-lint, then govulncheck, and finally go test -race. This fail-fast ordering avoids spending CI minutes on expensive tests when formatting or linting already fails.

Related Skills

Explore More Software Engineering Skills→
juniorfontenelejuniorfontenele

stack-go

Enforce idiomatic Go patterns, quality gates, and testing guidelines for Go projects.

Community
Intermediate
Coverage-CreativesCoverage-Creatives

Quality Gates

Enforce quality thresholds across code, tests, performance, and security in CI/CD pipelines.

Official
Advanced
asgarovfasgarovf
23

code-review

Analyze pull requests for security vulnerabilities and SOLID principles.

Community
Advanced
y1feng200156y1feng200156
33

vuln-scan

Scan project dependencies for known security vulnerabilities using Safety CLI and OSV-Scanner.

Community
Intermediate