go-tooling-security

Name: go-tooling-security
Author: fusengine

21stars3forks

How to install go-tooling-security?

fusengine/agents/go-tooling-security

$npx -y skills add fusengine/agents --skill go-tooling-security

Installs into the current project.

Summary

Use when: setting up Go modules/workspaces, configuring golangci-lint v2, scanning dependencies with govulncheck, modernizing code with go fix, or building a Go CI quality gate. Do NOT use for: writing Go application logic (use the Go expert), non-Go languages, SOLID/architecture

Files · 1

View on GitHub

SKILL.md

1	# Go Tooling & Security
2
3	## Agent Workflow (MANDATORY)
4
5	Before ANY tooling/security change, use `TeamCreate` to spawn 3 agents:
6
7	1. fuse-ai-pilot:explore-codebase - Find existing go.mod/go.work, `.golangci.yml`, CI files
8	2. fuse-ai-pilot:research-expert - Verify latest golangci-lint v2 + govulncheck docs via Context7/Exa
9	3. mcp__context7__query-docs - Check current Go 1.26 `go fix` modernizer set
10
11	After changes, run fuse-ai-pilot:sniper for validation.
12
13	---
14
15	## Overview
16
17	\| Area \| Description \|
18	\|------\|-------------\|
19	\| Modules & Workspaces \| `go.mod` directives, `go.work` for multi-module dev without `replace` \|
20	\| golangci-lint v2 \| Config version `"2"`, `formatters` section, `golangci-lint migrate` \|
21	\| govulncheck \| Reachability-based scan of the call graph against `vuln.go.dev` \|
22	\| go fix modernizers \| Go 1.26 suite of fixers, `//go:fix inline` for API migrations \|
23	\| CI quality gate \| fmt → vet → golangci-lint → govulncheck → test -race \|
24
25	---
26
27	## Critical Rules
28
29	1. Never invent flags or directives - Confirm every `go`/tool flag against official docs first
30	2. golangci-lint v2 config MUST start with `version: "2"` - v1 configs are rejected; migrate, don't hand-edit
31	3. govulncheck runs in source mode by default - Reachability filters noise; only reported findings matter
32	4. `go.work` is usually not committed - Commit only when modules are developed exclusively together
33	5. CI gate order is fail-fast - Formatting/vet before linters before vulnerability scan before tests
34
35	---
36
37	## Architecture
38
39	```
40	repo/
41	├── go.work # optional: multi-module workspace
42	├── go.work.sum
43	├── module-a/
44	│ ├── go.mod # module, go, require, toolchain
45	│ └── go.sum
46	├── module-b/
47	│ └── go.mod
48	├── .golangci.yml # version: "2"
49	└── .github/workflows/ci.yml
50	```
51
52	→ See [ci-workflow.md](references/templates/ci-workflow.md) for the complete gate
53
54	---
55
56	## Reference Guide
57
58	### Concepts
59
60	\| Topic \| Reference \| When to Consult \|
61	\|-------\|-----------\|-----------------\|
62	\| Modules & Workspaces \| [modules-workspaces.md](references/modules-workspaces.md) \| Editing go.mod/go.work, multi-module repos \|
63	\| golangci-lint v2 \| [golangci-lint-v2.md](references/golangci-lint-v2.md) \| Config, v1→v2 migration, formatters \|
64	\| govulncheck \| [govulncheck.md](references/govulncheck.md) \| Dependency vulnerability scanning \|
65	\| go fix modernizers \| [go-fix-modernizers.md](references/go-fix-modernizers.md) \| Modernizing code, `//go:fix inline`, PGO \|
66
67	### Templates
68
69	\| Template \| When to Use \|
70	\|----------\|-------------\|
71	\| [golangci-v2-config.md](references/templates/golangci-v2-config.md) \| Dropping in a recommended `.golangci.yml` \|
72	\| [ci-workflow.md](references/templates/ci-workflow.md) \| Wiring the full CI quality gate \|
73
74	---
75
76	## Quick Reference
77
78	### Workspace bootstrap
79
80	```bash
81	go work init ./module-a ./module-b # create go.work
82	go work use ./module-c # add a module
83	go work sync # sync build list to modules
84	```
85
86	→ See [modules-workspaces.md](references/modules-workspaces.md)
87
88	### Migrate + run golangci-lint v2
89
90	```bash
91	golangci-lint migrate # v1 config → v2 (backs up original)
92	golangci-lint run ./...
93	```
94
95	→ See [golangci-v2-config.md](references/templates/golangci-v2-config.md)
96
97	### Scan for reachable vulnerabilities
98
99	```bash
100	go install golang.org/x/vuln/cmd/govulncheck@latest
101	govulncheck ./... # source mode, call-graph reachability
102	```
103
104	→ See [govulncheck.md](references/govulncheck.md)
105
106	### Modernize the codebase
107
108	```bash
109	go fix ./... # apply Go 1.26 modernizers
110	```
111
112	→ See [go-fix-modernizers.md](references/go-fix-modernizers.md)
113
114	---
115
116	## Best Practices
117
118	### DO
119	- Pin toolchain with the `toolchain` directive for reproducible builds
120	- Gate CI on `govulncheck ./...` and treat reachable findings as failures
121	- Use `go.work` for local cross-module work instead of scattering `replace` directives
122	- Keep `formatters` (gofmt/goimports) separate from `linters` in the v2 config
123
124	### DON'T
125	- Hand-write a v2 config from a v1 file — run `golangci-lint migrate`
126	- Commit `go.work` in repos whose modules are also developed with external modules
127	- Supp

People who liked this also viewed

6 picks

Type

go-tooling-security

21stars3forks

View on GitHub

How to install go-tooling-security?

fusengine/agents/go-tooling-security

$npx -y skills add fusengine/agents --skill go-tooling-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Go Tooling & Security
2
3	## Agent Workflow (MANDATORY)
4
5	Before ANY tooling/security change, use `TeamCreate` to spawn 3 agents:
6
7	1. fuse-ai-pilot:explore-codebase - Find existing go.mod/go.work, `.golangci.yml`, CI files
8	2. fuse-ai-pilot:research-expert - Verify latest golangci-lint v2 + govulncheck docs via Context7/Exa
9	3. mcp__context7__query-docs - Check current Go 1.26 `go fix` modernizer set
10
11	After changes, run fuse-ai-pilot:sniper for validation.
12
13	---
14
15	## Overview
16
17	\| Area \| Description \|
18	\|------\|-------------\|
19	\| Modules & Workspaces \| `go.mod` directives, `go.work` for multi-module dev without `replace` \|
20	\| golangci-lint v2 \| Config version `"2"`, `formatters` section, `golangci-lint migrate` \|
21	\| govulncheck \| Reachability-based scan of the call graph against `vuln.go.dev` \|
22	\| go fix modernizers \| Go 1.26 suite of fixers, `//go:fix inline` for API migrations \|
23	\| CI quality gate \| fmt → vet → golangci-lint → govulncheck → test -race \|
24
25	---
26
27	## Critical Rules
28
29	1. Never invent flags or directives - Confirm every `go`/tool flag against official docs first
30	2. golangci-lint v2 config MUST start with `version: "2"` - v1 configs are rejected; migrate, don't hand-edit
31	3. govulncheck runs in source mode by default - Reachability filters noise; only reported findings matter
32	4. `go.work` is usually not committed - Commit only when modules are developed exclusively together
33	5. CI gate order is fail-fast - Formatting/vet before linters before vulnerability scan before tests
34
35	---
36
37	## Architecture
38
39	```
40	repo/
41	├── go.work # optional: multi-module workspace
42	├── go.work.sum
43	├── module-a/
44	│ ├── go.mod # module, go, require, toolchain
45	│ └── go.sum
46	├── module-b/
47	│ └── go.mod
48	├── .golangci.yml # version: "2"
49	└── .github/workflows/ci.yml
50	```
51
52	→ See [ci-workflow.md](references/templates/ci-workflow.md) for the complete gate
53
54	---
55
56	## Reference Guide
57
58	### Concepts
59
60	\| Topic \| Reference \| When to Consult \|
61	\|-------\|-----------\|-----------------\|
62	\| Modules & Workspaces \| [modules-workspaces.md](references/modules-workspaces.md) \| Editing go.mod/go.work, multi-module repos \|
63	\| golangci-lint v2 \| [golangci-lint-v2.md](references/golangci-lint-v2.md) \| Config, v1→v2 migration, formatters \|
64	\| govulncheck \| [govulncheck.md](references/govulncheck.md) \| Dependency vulnerability scanning \|
65	\| go fix modernizers \| [go-fix-modernizers.md](references/go-fix-modernizers.md) \| Modernizing code, `//go:fix inline`, PGO \|
66
67	### Templates
68
69	\| Template \| When to Use \|
70	\|----------\|-------------\|
71	\| [golangci-v2-config.md](references/templates/golangci-v2-config.md) \| Dropping in a recommended `.golangci.yml` \|
72	\| [ci-workflow.md](references/templates/ci-workflow.md) \| Wiring the full CI quality gate \|
73
74	---
75
76	## Quick Reference
77
78	### Workspace bootstrap
79
80	```bash
81	go work init ./module-a ./module-b # create go.work
82	go work use ./module-c # add a module
83	go work sync # sync build list to modules
84	```
85
86	→ See [modules-workspaces.md](references/modules-workspaces.md)
87
88	### Migrate + run golangci-lint v2
89
90	```bash
91	golangci-lint migrate # v1 config → v2 (backs up original)
92	golangci-lint run ./...
93	```
94
95	→ See [golangci-v2-config.md](references/templates/golangci-v2-config.md)
96
97	### Scan for reachable vulnerabilities
98
99	```bash
100	go install golang.org/x/vuln/cmd/govulncheck@latest
101	govulncheck ./... # source mode, call-graph reachability
102	```
103
104	→ See [govulncheck.md](references/govulncheck.md)
105
106	### Modernize the codebase
107
108	```bash
109	go fix ./... # apply Go 1.26 modernizers
110	```
111
112	→ See [go-fix-modernizers.md](references/go-fix-modernizers.md)
113
114	---
115
116	## Best Practices
117
118	### DO
119	- Pin toolchain with the `toolchain` directive for reproducible builds
120	- Gate CI on `govulncheck ./...` and treat reachable findings as failures
121	- Use `go.work` for local cross-module work instead of scattering `replace` directives
122	- Keep `formatters` (gofmt/goimports) separate from `linters` in the v2 config
123
124	### DON'T
125	- Hand-write a v2 config from a v1 file — run `golangci-lint migrate`
126	- Commit `go.work` in repos whose modules are also developed with external modules
127	- Supp

People who liked this also viewed

6 picks

Type