golang-continuous-integration

Create workflows for testing, linting, security, and release in that order. The test workflow should run go test with -race, -shuffle=on, and -coverprofile across a Go version matrix with fail-fast disabled, plus a go mod tidy check using git diff --exit-code.

Use govulncheck for call-path-aware vulnerability detection, gosec for Go-specific SAST, CodeQL with the security-and-quality query suite, and Bearer for sensitive data flow issues. Upload SARIF results to the repository Security tab with security-events: write permission.

Renovate offers gomodTidy to run go mod tidy automatically, native automerge without a separate workflow, better grouping rules, and monorepo support. Dependabot is simpler and built into GitHub but needs a separate workflow for auto-merge.

Set skip: true in the builds section so GoReleaser only generates a changelog and GitHub Release. For libraries, a simple release created via gh release create is often sufficient without GoReleaser at all.

Go caches test results, so tests may pass without re-running against services like PostgreSQL or Redis. Use the -count=1 flag to disable caching, and define service containers with health checks in the workflow's services block.

Auto-merge requires contents: write and pull-requests: write, which are elevated permissions. Guard the workflow with an actor check for dependabot[bot], exclude major updates, and rely on branch protection with required status checks as the real safety net.