golang-continuous-integration

Create workflows for testing with go test -race -shuffle=on across a Go version matrix, linting with golangci-lint, and security scanning with govulncheck and CodeQL. Add a GoReleaser release workflow triggered on v* tags for automated binary releases.

Renovate is the stronger choice for most Go projects: it runs go mod tidy automatically via gomodTidy, supports native automerge without a separate workflow, and handles monorepos. Dependabot works for simpler repos with grouped minor/patch updates.

Go caches test results, so unchanged packages skip re-execution. Run integration tests with -count=1 to disable caching, and use GitHub Actions service containers with health checks for dependencies like PostgreSQL and Redis.

Use govulncheck for vulnerabilities in actually-called code paths, gosec for Go-specific security issues, CodeQL with the security-and-quality query suite, and Bearer for sensitive data flow detection. Upload results as SARIF to the GitHub Security tab.

Auto-merge requires elevated contents: write and pull-requests: write permissions, so restrict it with an if: github.actor == 'dependabot[bot]' guard and exclude major updates. Branch protection with required status checks is the real safety net, since actor checks are not fully spoof-proof.

Set builds to skip: true and keep only changelog generation, since libraries produce no executables. For simple cases, creating a GitHub Release directly via gh release create is often sufficient without GoReleaser at all.