golang-dependency-management

Name: golang-dependency-management
Author: samber

33kinstalls179forks

How to install golang-dependency-management?

samber/cc-skills-golang/golang-dependency-management

$npx -y skills add samber/cc-skills-golang --skill golang-dependency-management

Installs into the current project.

Summary

Dependency management strategies for Golang projects — go.mod management, installing/upgrading packages, Minimal Version Selection, vulnerability scanning, outdated dependency tracking, binary size analysis, Dependabot/Renovate setup, conflict resolution, and go.work workspaces.

Files · 1

View on GitHub

SKILL.md

1	Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.
2
3	Dependencies:
4
5	- govulncheck: `go install golang.org/x/vuln/cmd/govulncheck@latest`
6
7	# Go Dependency Management
8
9	## AI Agent Rule: Ask Before Adding Dependencies
10
11	Before running `go get` to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using `go get -u` to upgrade an existing dependency is safe.
12
13	Before proposing a dependency, evaluate:
14
15	- Does the standard library already cover the use case?
16	- Is the license compatible?
17	- Are there well-known alternatives?
18	- What it does and why it's needed?
19
20	The `samber/cc-skills-golang@golang-popular-libraries` skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (`golang.org/x/...`) or established organizations over obscure alternatives.
21
22	## Key Rules
23
24	- `go.sum` MUST be committed — it records cryptographic checksums of every dependency version, letting `go mod verify` detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious code
25	- `govulncheck ./...` or `go tool govulncheck ./...` before every release — catches known CVEs in your dependency tree before they reach production
26	- Maintenance status, license compatibility, and stdlib alternatives are important considerations before adding a dependency — every dependency increases attack surface, maintenance burden, and binary size
27	- `go mod tidy` before every commit that changes dependencies — removes unused modules and adds missing ones, keeping go.mod honest
28
29	## go.mod & go.sum
30
31	### Essential Commands
32
33	\| Command \| Purpose \|
34	\| ----------------- \| -------------------------------------------- \|
35	\| `go mod tidy` \| Add missing deps, remove unused ones \|
36	\| `go mod download` \| Download modules to local cache \|
37	\| `go mod verify` \| Verify cached modules match go.sum checksums \|
38	\| `go mod vendor` \| Copy deps into `vendor/` directory \|
39	\| `go mod edit` \| Edit go.mod programmatically (scripts, CI) \|
40	\| `go mod graph` \| Print the module requirement graph \|
41	\| `go mod why` \| Explain why a module or package is needed \|
42
43	### Vendoring
44
45	Use `go mod vendor` when you need hermetic builds (no network access), reproducibility guarantees beyond checksums, or when deploying to environments without module proxy access. CI pipelines and Docker builds sometimes benefit from vendoring. Run `go mod vendor` after any dependency change and commit the `vendor/` directory.
46
47	## Installing & Upgrading Dependencies
48
49	### Adding a Dependency
50
51	```bash
52	go get github.com/google/uuid # Latest version
53	go get github.com/google/uuid@v1.6.0 # Specific version
54	go get github.com/google/uuid@latest # Explicitly latest
55	go get github.com/google/uuid@<commit> # Specific commit (pseudo-version)
56	```
57
58	Before pinning a version, inspect the module's available versions, importers, and known vulnerabilities on pkg.go.dev → See `samber/cc-skills-golang@golang-pkg-go-dev` skill.
59
60	### Upgrading
61
62	```bash
63	go get -u ./... # Upgrade ALL direct+indirect deps to latest minor/patch
64	go get -u=patch ./... # Upgrade to latest patch only (safer)
65	go get github.com/pkg@v1.5 # Upgrade specific package
66	```
67
68	Prefer `go get -u=patch` for routine updates. Patch and minor updates are usually lower risk than major upgrades, but still require review. For dependency updates, run:
69
70	```bash
71	go get -u=patch ./...
72	go mod tidy
73	go test ./...
74	go vet ./...

People who liked this also viewed

6 picks

Type

golang-dependency-management

33kinstalls179forks

View on GitHub

How to install golang-dependency-management?

samber/cc-skills-golang/golang-dependency-management

$npx -y skills add samber/cc-skills-golang --skill golang-dependency-management

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.
2
3	Dependencies:
4
5	- govulncheck: `go install golang.org/x/vuln/cmd/govulncheck@latest`
6
7	# Go Dependency Management
8
9	## AI Agent Rule: Ask Before Adding Dependencies
10
11	Before running `go get` to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using `go get -u` to upgrade an existing dependency is safe.
12
13	Before proposing a dependency, evaluate:
14
15	- Does the standard library already cover the use case?
16	- Is the license compatible?
17	- Are there well-known alternatives?
18	- What it does and why it's needed?
19
20	The `samber/cc-skills-golang@golang-popular-libraries` skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (`golang.org/x/...`) or established organizations over obscure alternatives.
21
22	## Key Rules
23
24	- `go.sum` MUST be committed — it records cryptographic checksums of every dependency version, letting `go mod verify` detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious code
25	- `govulncheck ./...` or `go tool govulncheck ./...` before every release — catches known CVEs in your dependency tree before they reach production
26	- Maintenance status, license compatibility, and stdlib alternatives are important considerations before adding a dependency — every dependency increases attack surface, maintenance burden, and binary size
27	- `go mod tidy` before every commit that changes dependencies — removes unused modules and adds missing ones, keeping go.mod honest
28
29	## go.mod & go.sum
30
31	### Essential Commands
32
33	\| Command \| Purpose \|
34	\| ----------------- \| -------------------------------------------- \|
35	\| `go mod tidy` \| Add missing deps, remove unused ones \|
36	\| `go mod download` \| Download modules to local cache \|
37	\| `go mod verify` \| Verify cached modules match go.sum checksums \|
38	\| `go mod vendor` \| Copy deps into `vendor/` directory \|
39	\| `go mod edit` \| Edit go.mod programmatically (scripts, CI) \|
40	\| `go mod graph` \| Print the module requirement graph \|
41	\| `go mod why` \| Explain why a module or package is needed \|
42
43	### Vendoring
44
45	Use `go mod vendor` when you need hermetic builds (no network access), reproducibility guarantees beyond checksums, or when deploying to environments without module proxy access. CI pipelines and Docker builds sometimes benefit from vendoring. Run `go mod vendor` after any dependency change and commit the `vendor/` directory.
46
47	## Installing & Upgrading Dependencies
48
49	### Adding a Dependency
50
51	```bash
52	go get github.com/google/uuid # Latest version
53	go get github.com/google/uuid@v1.6.0 # Specific version
54	go get github.com/google/uuid@latest # Explicitly latest
55	go get github.com/google/uuid@<commit> # Specific commit (pseudo-version)
56	```
57
58	Before pinning a version, inspect the module's available versions, importers, and known vulnerabilities on pkg.go.dev → See `samber/cc-skills-golang@golang-pkg-go-dev` skill.
59
60	### Upgrading
61
62	```bash
63	go get -u ./... # Upgrade ALL direct+indirect deps to latest minor/patch
64	go get -u=patch ./... # Upgrade to latest patch only (safer)
65	go get github.com/pkg@v1.5 # Upgrade specific package
66	```
67
68	Prefer `go get -u=patch` for routine updates. Patch and minor updates are usually lower risk than major upgrades, but still require review. For dependency updates, run:
69
70	```bash
71	go get -u=patch ./...
72	go mod tidy
73	go test ./...
74	go vet ./...

People who liked this also viewed

6 picks

Type