SkillAtlasSkill 详情

golang-dependency-management

AI agent skills are reusable instruction sets that extend your coding assistant with domain-spec...

审核状态:已审核Quality 72Security 70

复制安装命令

用 Codex 或 Claude 安装复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它先审查 Skill 页面再帮你安装。

复制前请先查看来源、License 和安全提示。

项目 README

来源文件:README.md

抓取于 2026年8月8日

Agent Skills for production-ready Golang projects

AI agent skills are reusable instruction sets that extend your coding assistant with domain-specific expertise, loaded on demand so they don't bloat your context. This repository covers Go-specific skills only (language, testing, security, observability, etc.); for dev workflow skills (git conventions, CI/CD, PR reviews) you'll want to add a separate skills plugin.

For generic skills, please visit cc-skills.

[!IMPORTANT] Bootstrapped with Claude Code by distilling my Go project commits. Edited, tested, reviewed and reworked by a human.

No AI slop here. AI-made skills are useless.

image

🚀 How to use

Install with skills CLI (universal, works with any Agent Skills-compatible tool):

npx skills add https://github.com/samber/cc-skills-golang --all
# or a single skill:
npx skills add https://github.com/samber/cc-skills-golang --skill golang-performance
Claude Code
/plugin marketplace add samber/cc
/plugin install cc-skills-golang@samber
Openclaw

Copy skills into the cross-client discovery directory:

git clone https://github.com/samber/cc-skills-golang.git ~/.openclaw/skills/cc-skills-golang
# or in workspace:
git clone https://github.com/samber/cc-skills-golang.git ~/.openclaw/workspace/skills/cc-skills-golang
Gemini CLI
gemini extensions install https://github.com/samber/cc-skills-golang

Update with gemini extensions update cc-skills-golang.

Cursor

Copy skills into the cross-client discovery directory:

git clone https://github.com/samber/cc-skills-golang.git  ~/.cursor/skills/cc-skills-golang

Cursor auto-discovers skills from .agents/skills/ and .cursor/skills/.

Copilot

Copy skills into the cross-client discovery directory:

/plugin install https://github.com/samber/cc-skills-golang
# or
git clone https://github.com/samber/cc-skills-golang.git ~/.copilot/skills/cc-skills-golang

Copilot auto-discovers skills from .copilot/skills/.

OpenCode

Copy skills into the cross-client discovery directory:

git clone https://github.com/samber/cc-skills-golang.git ~/.agents/skills/cc-skills-golang

OpenCode auto-discovers skills from .agents/skills/, .opencode/skills/, and .claude/skills/.

Codex (OpenAI)

Clone into the cross-client discovery path:

git clone https://github.com/samber/cc-skills-golang.git ~/.agents/skills/cc-skills-golang

Codex auto-discovers skills from ~/.agents/skills/ and .agents/skills/. Update with cd ~/.agents/skills/cc-skills-golang && git pull.

Antigravity

Clone and symlink into the cross-client discovery path:

git clone https://github.com/samber/cc-skills-golang.git ~/.antigravity/skills/cc-skills-golang

Update with cd ~/.antigravity/skills/cc-skills-golang && git pull.

🧩 Skills

These skills are designed as atomic, cross-referencing units. A skill may reference conventions defined in another (e.g. error-handling rules that affect logging live in golang-error-handling, not golang-observability). Installing only a subset will give you a partial and potentially inconsistent view of the guidelines. For best results, install all general-purpose skills together.

                         ┌────────────────────────────────────────┐
                         │             Golang Skills              │
                         └──────────────────┬─────────────────────┘
                                            │
   ┌─────────────────┬──────────────────────┼──────────────────────┐
   ▼                 ▼                      ▼                      ▼
┌──────────────┐ ┌──────────────┐ ┌─────────────────┐ ┌──────────────────────┐
│ Code Quality │ │ Arch & Design│ │    QA & Perf    │ │    Project Start     │
├──────────────┤ ├──────────────┤ ├─────────────────┤ ├──────────────────────┤
│ code-style   │ │ design-patt  │ │ testing         │ │ project-layout       │
│ naming       │ │ concurrency  │ │ benchmark       │ │ popular-libs         │
│ error-handl  │ │ context      │ │ performance     │ │ cli                  │
│ safety       │ │ dep-inject   │ │ troubleshoot    │ │ continuous-integ.    │
│ structs-iface│ │ data-structs │ │ observability   │ │ stay-updated         │
│ documentation│ │ database     │ │                 │ │ dep-management       │
│ lint         │ │ modernize    │ │                 │ │ gopls                │
│ security     │ │ refactoring  │ │                 │ │ pkg-go-dev           │
└──────────────┘ └──────────────┘ └─────────────────┘ └──────────────────────┘

    ┌─────────────────────────────────────────────────────────────────────────┐
    │                      Framework / Library Skills                         │
    ├──────────────┬────────────────┬──────────────┬─────────────┬───────────┤
    │   APIs       │      DI        │  Frameworks  │  samber/*   │  Testing  │
    ├──────────────┼────────────────┼──────────────┼─────────────┼───────────┤
    │ grpc         │ google-wire    │ spf13-cobra  │ samber-lo   │ stretchr- │
    │ graphql      │ uber-dig       │ spf13-viper  │ samber-mo   │  testify  │
    │ swagger      │ uber-fx        │              │ samber-ro   │           │
    │              │                │              │ samber-do   │           │
    │              │                │              │ samber-hot  │           │
    │              │                │              │ samber-slog │           │
    │              │                │              │ samber-oops │           │
    └──────────────┴────────────────┴──────────────┴─────────────┴───────────┘

  • ⭐️ Recommended
  • ✅ Published
  • 👷 Work in progress
  • ❌ To-do
  • ⚡ Command available
  • 🧠 Ultrathink automatically
  • 🤖 Ultracode automatically
  • ⚙️ Overridable (see doc below)
  • Description (tok): weight of the description field from YAML frontmatter, always loaded into Claude's context for skill triggering
  • SKILL.md (tok): weight of the full SKILL.md file loaded when the skill triggers
  • Directory (tok): weight of all files in the skill directory (SKILL.md + referenced markdown files)

General purpose:

SkillFlagsError rate gapDescription (tok)SKILL.md (tok)Directory (tok)
⭐️✅ golang-code-style⚡ 🤖 ⚙️-40%1152,3412,957
⭐️✅ golang-data-structures⚡-39%932,5996,318
⭐️✅ golang-database⚡ ⚙️-38%972,7127,234
⭐️✅ golang-design-patterns⚡ ⚙️-37%802,6859,391
⭐️✅ golang-documentation⚡ 🤖 ⚙️-53%753,07811,177
⭐️✅ golang-error-handling⚡ 🤖 ⚙️-26%1411,7184,677
⭐️✅ golang-how-to⚡—1654,01713,853
⭐️✅ golang-modernize⚡ 🤖-61%682,9209,233
⭐️✅ golang-naming⚡ ⚙️-23%1593,0227,390
⭐️✅ golang-refactoring⚡ 🧠 🤖 ⚙️—2463,70820,216
⭐️✅ golang-safety⚡-58%782,6055,375
⭐️✅ golang-testing⚡ 🧠 🤖 ⚙️-32%1154,2347,341
⭐️✅ golang-troubleshooting⚡ 🧠 🤖-32%1282,89416,577
⭐️✅ golang-security⚡ 🧠 🤖-32%853,16021,596
✅ golang-benchmark⚡ 🧠-50%1023,04230,224
✅ golang-cli⚡-43%1252,3296,144
✅ golang-concurrency⚡ 🤖 ⚙️-39%722,1806,810
✅ golang-context⚡ ⚙️-34%821,2024,012
✅ golang-continuous-integration⚡-59%823,29112,553
✅ golang-dependency-injection⚡ 🤖 ⚙️-47%1782,9945,265
✅ golang-dependency-management⚡-54%772,3615,499
✅ golang-structs-interfaces⚡ ⚙️-35%1113,0673,067
✅ golang-lint⚡ 🤖-41%981,8536,181
✅ golang-observability⚡ 🤖 ⚙️-37%1643,09618,583
✅ golang-performance⚡ 🧠 🤖-39%1302,19018,190
✅ golang-gopls⚡—2192,30812,188
✅ golang-pkg-go-dev⚡—2303,4285,242
✅ golang-popular-libraries⚡-30%511,0444,438
✅ golang-project-layout⚡-38%691,5635,778
✅ golang-stay-updated⚡-56%441,8011,801

Tools:

SkillFlagsError rate gapDescription (tok)SKILL.md (tok)Directory (tok)
✅ golang-google-wire⚡-16%1222,6617,391
✅ golang-graphql-16%763,0617,932
✅ golang-grpc⚡-41%702,3325,148
✅ golang-spf13-cobra⚡—1762,5717,342
✅ golang-spf13-viper⚡—1702,5427,089
✅ golang-swagger⚡—1442,3333,338
✅ golang-uber-dig⚡-10%1072,5766,248
✅ golang-uber-fx⚡-5%1182,8167,051
✅ golang-samber-do⚡-81%711,8773,392
✅ golang-samber-hot⚡-54%1191,9777,407
✅ golang-samber-lo⚡-40%1672,60110,279
✅ golang-samber-mo⚡ 🧠-48%822,94311,358
✅ golang-samber-oops⚡-59%702,5352,847
✅ golang-samber-ro⚡ 🧠-50%1542,95211,168
✅ golang-samber-slog⚡-19%1193,1119,833
❌ golang-temporal—000
✅ golang-stretchr-testify⚡-47%921,8492,668

🧪 Skill evaluations

With SkillWithout SkillDelta
Overall3315/3395 (98%)1915/3395 (56%)+41pp

See EVALUATIONS.md for the full per-skill breakdown.

📖 Skills description

Code Quality

golang-code-style

Go code formatting and conventions. gofmt, goimports, linting rules, comment conventions, and project-level style consistency. Overridable by company skills.

golang-documentation

Go documentation standards. Package docs, godoc conventions, code comments, example functions, README structure, and API reference generation. Overridable.

golang-error-handling

Go error handling best practices. Error creation, wrapping with fmt.Errorf and errors.Is/As, sentinel errors, custom error types, error codes, and panic recovery. Overridable.

golang-lint

Go linting best practices and golangci-lint configuration. Presets, custom rules, CI integration, inline suppression, and output interpretation.

golang-naming

Go naming conventions across all identifier types. Packages, constructors, structs, interfaces, constants, errors, receivers, acronyms, test functions. Covers MixedCaps rules, Get-prefix, and utils/helpers anti-patterns. Overridable.

golang-safety

Defensive Go coding. Prevents panics, silent data corruption, and runtime bugs. nil safety, append aliasing, map concurrent access, float comparison, zero-value design, numeric overflow.

golang-security

Go security best practices. Injection prevention (SQL, command, XSS), cryptography, filesystem/network safety, secrets management, cookie security, and tool configuration. Audit and review modes.

golang-structs-interfaces

Go struct and interface design. Composition, embedding, type assertions, interface segregation, struct tags (JSON/YAML/DB), pointer vs value receivers. Overridable.

Architecture & Design

golang-concurrency

Go concurrency patterns. Goroutines, channels, sync primitives, context cancellation, worker pools, fan-out/fan-in, pipelines. Overridable.

golang-context

Idiomatic context.Context usage. Creation, cancellation, timeouts, values, propagation patterns, and common anti-patterns. Overridable.

golang-data-structures

Go data structures internals and usage. Slices (capacity growth, append aliasing), maps, channels, sync primitives, and when to use each.

golang-database

Go database access patterns. Parameter binding, connection pooling, transactions, migrations, sqlboiler/sqlc code generation, query builders. Overridable.

golang-dependency-injection

Dependency injection patterns in Go. Constructor injection, interface-based DI, wire/dig/fx comparison, and when DI is worth the complexity. Overridable.

golang-design-patterns

Idiomatic Go design patterns. Functional options, constructors, builder pattern, middleware chains, circuit breaker, and architecture guides with file trees and code. Overridable.

golang-modernize

Modernize Go code to use recent language features. Range-over-int, min/max builtins, iterators, slices/maps/cmp/slog stdlib packages, testing patterns (t.Context, b.Loop, synctest), and tooling upgrades.

golang-refactoring

Safe, at-scale refactoring process for existing Go code. Coverage-adaptive safety net, tool-driven behavior-preserving transforms (gopls Rename/Inline/Extract, gofmt -r, eg, gopatch), the Fowler catalog mapped to Go, breaking import cycles, type-alias gradual code repair, and a human-in-the-loop workflow of staged PRs on a refactoring branch.

QA & Performance

golang-benchmark

Go benchmarking, profiling, and performance measurement. pprof, trace, CPU/memory/block profiles, flame graphs, benchmark comparison (benchstat), continuous profiling.

golang-observability

Go production observability. Structured logging (slog), Prometheus metrics, OpenTelemetry tracing, pprof profiling, RUM tracking, alerting, Grafana dashboards. Overridable.

golang-performance

Go performance optimization. Allocation reduction, CPU efficiency, memory layout, GC tuning, pooling, caching, hot-path optimization. Review and hot-path modes.

golang-testing

Production-ready Go tests. Table-driven tests, fuzzing, fixtures, goroutine leak detection (goleak), snapshot testing, code coverage, integration tests, parallel tests. Overridable.

golang-troubleshooting

Systematic Go debugging methodology. Common pitfalls, test-driven debugging, pprof capture, Delve debugger, race detection, GODEBUG tracing, production debugging.

Project Setup

golang-cli

Go CLI application development. Project layout, exit codes, signal handling, I/O patterns, argument parsing, and terminal UX.

golang-continuous-integration

CI/CD pipeline configuration for Go projects using GitHub Actions. Build, test, lint, and release workflows.

golang-dependency-management

Go module dependency strategies. go.mod conventions, versioning, replace directives, tool dependencies, and multi-module workspaces.

golang-gopls

Semantic code intelligence for your local build via gopls, the official Go language server. Go-to-definition, find references, call/implementation hierarchy, workspace symbol search, diagnostics, safe rename, and refactors (extract/inline/fill/rewrite). Reachable via gopls's own MCP server, Claude Code's native LSP tool, or the gopls CLI.

golang-pkg-go-dev

Go package and module exploration via godig, a pkg.go.dev API client (CLI + MCP server). Package docs, API references, symbols, code examples, versions, importers, licenses, and known vulnerabilities. Prefer over Context7 for Go packages.

golang-popular-libraries

Curated recommendations for production-ready Go libraries and frameworks. When the stdlib is enough vs when to reach for a package.

golang-project-layout

Go project structure and workspace setup. cmd/internal/pkg conventions, monorepo layout, CLI project structure, and when to keep things flat.

golang-stay-updated

Resources to stay current with Go. Official channels, community hubs, key people to follow, and learning resources.

APIs

golang-graphql

GraphQL API development in Go using gqlgen/graphql-go. Schema definition, resolvers, subscriptions, dataloader, and federation.

golang-grpc

gRPC in Go. Protobuf organization, service definitions, streaming, interceptors, error codes, and code generation workflow.

golang-swagger

OpenAPI/Swagger docs with swaggo/swag. Annotation comments, code generation, framework integrations (gin, echo, fiber, chi), security definitions.

Dependency Injection

golang-google-wire

Compile-time dependency injection with google/wire. Provider sets, injector generation, wire.Build, and structured DI patterns.

golang-uber-dig

Reflection-based DI with uber-go/dig. Provide/Invoke, dig.In/dig.Out, named values, value groups, optional dependencies, and Decorate.

golang-uber-fx

Application framework with uber-go/fx. fx.New, fx.Provide/Invoke, fx.Module, lifecycle hooks, fx.Annotate, fx.Decorate, signal-aware Run.

Frameworks

golang-spf13-cobra

CLI command trees with spf13/cobra. Command hierarchy, RunE hooks, flag management, shell completion, usage templates, and testing with SetArgs.

golang-spf13-viper

Layered configuration with spf13/viper. Flag > env > file > KV > default precedence, BindPFlag, hot reload, test isolation, and remote KV integration.

samber/*

golang-samber-do

Dependency injection with samber/do. Type-safe service containers, lifecycle management, scopes, health checks, and graceful shutdown.

golang-samber-hot

In-memory caching with samber/hot. 9 eviction algorithms (LRU, LFU, TinyLFU, W-TinyLFU, S3FIFO, ARC, SIEVE...), TTL, loaders, sharding, stale-while-revalidate, Prometheus metrics.

golang-samber-lo

Functional programming helpers with samber/lo. 500+ type-safe generic functions for slices, maps, channels, strings. Immutable (lo), parallel (lop), mutable (lom), iterators (loi), SIMD.

golang-samber-mo

Monadic types with samber/mo. Option, Result, Either, Future, IO, Task, State for type-safe nullable values, error handling, and functional composition.

golang-samber-oops

Structured error handling with samber/oops. Error builders, stack traces, error codes, context attributes, public vs developer messages, panic recovery, and APM integration.

golang-samber-ro

Reactive streams with samber/ro. 150+ type-safe operators, cold/hot observables, 5 subject types, 40+ plugins, automatic backpressure, and Go context integration.

golang-samber-slog

Structured logging pipeline with samber/slog-**** packages. Multi-handler routing (slog-multi), sampling, formatting, HTTP middleware, and 20+ backend sinks.

Testing

golang-stretchr-testify

Testing with stretchr/testify. assert, require, mock, and suite packages. Assertions, mock expectations, argument matchers, suite lifecycle, and custom matchers.

🕵 Use in CI for AI-driven reviews

Add AI agents as PR reviewers alongside traditional static analysis. When configured with this skill plugin, the agent applies the relevant Go skills per review area — catching architectural drift, logic bugs, and concurrency hazards that linters cannot detect.

See GOLANG-AI-DRIVEN-REVIEW.md for full setup instructions (Claude Code Action and GitHub Copilot).

🎯 Tuning Skill Triggers

If a skill triggers too often or not often enough, please open an issue suggesting a description change. The description field in SKILL.md frontmatter is the primary triggering mechanism — small wording adjustments can significantly improve trigger accuracy. Some SKILL.md files might have a When to use section which is another level of exclusion. Finally, SKILL.md files are an entrypoint for lazy loading references with deep knowledge located in references/.

🔄 Overlap

Claude reports very little overlap between skills in this repo, thanks to cross-reference. I suggest enabling most of the skills and leveraging lazy loading. The recommended ⭐️ skills load ~1,100 tokens of descriptions at startup; full skill content is only pulled in when relevant. Note:

  • I estimate that 50% of golang-naming and golang-code-style overlap with linters (golangci-lint).
  • A large part of the security rules in golang-security have been distilled from the Bearer (SAST) checklist. The skill is still useful for methodology.
  • If your team has its own conventions, create a company skill and declare the override explicitly near the top of its body: This skill supersedes samber/cc-skills-golang@golang-naming skill for [company] projects. Skills marked ⚙️ in the table above support this mechanism.

✍️ Contribute

  • 100 tokens per skill description - what? when to use this skill?
  • 1.000–2.500 tokens per SKILL.md — keep the main file focused on essentials
  • Use secondary markdown files for depth — reference them from SKILL.md with relative links (e.g., [Logging](./logging.md)). Claude reads these on demand when the topic is relevant, so they don't count against the context budget until needed
  • Up to 10.000 tokens for full skill and secondary files
  • 2–4 skills loaded simultaneously in a typical session — design skills to coexist
  • Stay below ~10k tokens of total loaded SKILL.md anytime to avoid degrading response quality

For more guidelines, please check CLAUDE.md.

💫 Fuel the Revolution

  • ⭐️ Star this repo - Your star powers the caffeine engine!
  • ☕️ Buy me a coffee - I'll literally use it to build more skills while drinking actual coffee

GitHub Sponsors

📝 License

Copyright © 2026 Samuel Berthe.

This project is under MIT license.

数据与 AI

中风险

  • 来源需自行核对维护者身份。
  • 包含脚本或命令调用,安装前请复核。
  • 可能需要外部 token、网络权限或第三方服务。
  • 未检测到高风险命令。
  • 扫描发现:3 条。

Codex — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/samber/cc-skills-golang.git
  3. 将 "skills/golang-dependency-management" 文件夹复制到 Codex 的 skills 目录中。
  4. 重启 Codex 让新的 skill 生效。

Codex — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Codex 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Codex 让新的 skill 生效。

Claude Code — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/samber/cc-skills-golang.git
  3. 将 "skills/golang-dependency-management" 文件夹复制到 Claude Code 的 skills 目录中。
  4. 重启 Claude Code 让新的 skill 生效。

Claude Code — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Claude Code 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Claude Code 让新的 skill 生效。

Cursor — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/samber/cc-skills-golang.git
  3. 将 "skills/golang-dependency-management" 文件夹复制到 Cursor 的 skills 目录中。
  4. 重启 Cursor 让新的 skill 生效。

Cursor — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Cursor 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Cursor 让新的 skill 生效。

GitHub Copilot — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/samber/cc-skills-golang.git
  3. 将 "skills/golang-dependency-management" 文件夹复制到 GitHub Copilot 的 skills 目录中。
  4. 重启 GitHub Copilot 让新的 skill 生效。

GitHub Copilot — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 GitHub Copilot 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 GitHub Copilot 让新的 skill 生效。

Windsurf — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/samber/cc-skills-golang.git
  3. 将 "skills/golang-dependency-management" 文件夹复制到 Windsurf 的 skills 目录中。
  4. 重启 Windsurf 让新的 skill 生效。

Windsurf — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Windsurf 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Windsurf 让新的 skill 生效。
查看 SKILL.md 原文
name: golang-dependency-management
description: "Dependency management strategies for Golang projects — go.mod management, installing/upgrading packages, Minimal Version Selection, vulnerability scanning, outdated dependency tracking, binary size analysis, Dependabot/Renovate setup, conflict resolution, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, auditing vulnerabilities, resolving version conflicts, or setting up automated dependency updates."
user-invocable: true
license: MIT
compatibility: Designed for Claude Code or similar AI coding agents, and for projects using Golang.
metadata:
  author: samber
  version: "1.2.4"
  openclaw:
    emoji: "📦"
    homepage: https://github.com/samber/cc-skills-golang
    requires:
      bins:
        - go
        - govulncheck
    install:
      - kind: go
        package: golang.org/x/vuln/cmd/govulncheck@latest
        bins: [govulncheck]
allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent Bash(govulncheck:*) AskUserQuestion

Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.

Dependencies:

  • govulncheck: go install golang.org/x/vuln/cmd/govulncheck@latest

Go Dependency Management

AI Agent Rule: Ask Before Adding Dependencies

Before running go get to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using go get -u to upgrade an existing dependency is safe.

Before proposing a dependency, evaluate:

  • Does the standard library already cover the use case?
  • Is the license compatible?
  • Are there well-known alternatives?
  • What it does and why it's needed?

The samber/cc-skills-golang@golang-popular-libraries skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (golang.org/x/...) or established organizations over obscure alternatives.

Key Rules

  • go.sum MUST be committed — it records cryptographic checksums of every dependency version, letting go mod verify detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious code
  • govulncheck ./... or go tool govulncheck ./... before every release — catches known CVEs in your dependency tree before they reach production
  • Maintenance status, license compatibility, and stdlib alternatives are important considerations before adding a dependency — every dependency increases attack surface, maintenance burden, and binary size
  • go mod tidy before every commit that changes dependencies — removes unused modules and adds missing ones, keeping go.mod honest

go.mod & go.sum

Essential Commands

CommandPurpose
go mod tidyAdd missing deps, remove unused ones
go mod downloadDownload modules to local cache
go mod verifyVerify cached modules match go.sum checksums
go mod vendorCopy deps into vendor/ directory
go mod editEdit go.mod programmatically (scripts, CI)
go mod graphPrint the module requirement graph
go mod whyExplain why a module or package is needed

Vendoring

Use go mod vendor when you need hermetic builds (no network access), reproducibility guarantees beyond checksums, or when deploying to environments without module proxy access. CI pipelines and Docker builds sometimes benefit from vendoring. Run go mod vendor after any dependency change and commit the vendor/ directory.

Installing & Upgrading Dependencies

Adding a Dependency

go get github.com/google/uuid          # Latest version
go get github.com/google/uuid@v1.6.0   # Specific version
go get github.com/google/uuid@latest   # Explicitly latest
go get github.com/google/uuid@<commit> # Specific commit (pseudo-version)

Before pinning a version, inspect the module's available versions, importers, and known vulnerabilities on pkg.go.dev → See samber/cc-skills-golang@golang-pkg-go-dev skill.

Upgrading

go get -u ./...            # Upgrade ALL direct+indirect deps to latest minor/patch
go get -u=patch ./...      # Upgrade to latest patch only (safer)
go get github.com/pkg@v1.5 # Upgrade specific package

Prefer go get -u=patch for routine updates. Patch and minor updates are usually lower risk than major upgrades, but still require review. For dependency updates, run:

go get -u=patch ./...
go mod tidy
go test ./...
go vet ./...
govulncheck ./...   # or: go tool govulncheck ./...

Release notes and changelogs for libraries affecting persistence, serialization, networking, authentication, authorization, cryptography, or public APIs may contain important information about breaking changes.

Removing a Dependency

go get github.com/google/uuid@none  # Mark for removal
go mod tidy                          # Clean up go.mod and go.sum

Installing CLI Tools

For Go 1.24+ modules, pin executable tools in go.mod with tool directives. Do not create a new tools.go blank-import file unless the module must support Go <1.24.

# Add tools to the current module.
go get -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
go get -tool golang.org/x/vuln/cmd/govulncheck@latest
go get -tool golang.org/x/perf/cmd/benchstat@latest

# Run pinned tools reproducibly.
go tool golangci-lint run ./...
go tool govulncheck ./...
go tool benchstat old.txt new.txt

# Install all module-pinned tools into GOBIN/PATH when needed.
go install tool

# Update pinned tools deliberately, then review go.mod/go.sum.
go get -u tool
go mod tidy

go.mod shape for a module targeting Go 1.26 or newer. This is an example target, not a cap; keep the project's actual go directive and do not change it just to add tools.

module example.com/project

go 1.26

tool (
    github.com/golangci/golangci-lint/v2/cmd/golangci-lint
    golang.org/x/vuln/cmd/govulncheck
    golang.org/x/perf/cmd/benchstat
)

For Go <1.24 only, use the legacy tools.go blank-import workaround:

//go:build tools

package tools

import (
    _ "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
    _ "golang.org/x/vuln/cmd/govulncheck"
)

Rule: Go 1.24+ = tool directives. Go <1.24 = tools.go fallback.

Go 1.26+ module target note

When using a Go 1.26 or newer toolchain, go mod init may create a module with an older default go directive. If the project intentionally targets Go 1.26+ APIs, update the directive deliberately:

go mod edit -go=1.26
go mod tidy

For future Go versions, use the project's intended target version. Do not use APIs newer than the module's go directive until the project explicitly agrees to upgrade it.

Deep Dives

  • Versioning & MVS — Semantic versioning rules (major.minor.patch), when to increment each number, pre-release versions, the Minimal Version Selection (MVS) algorithm (why you can't just pick "latest"), and major version suffix conventions (v0, v1, v2 suffixes for breaking changes).

  • Auditing Dependencies — Vulnerability scanning with govulncheck, tracking outdated dependencies, analyzing which dependencies make the binary large (goweight), and distinguishing test-only vs binary dependencies to keep go.mod clean.

  • Dependency Conflicts & Resolution — Diagnosing version conflicts (what go get does when you request incompatible versions), resolution strategies (replace directives for local development, exclude for broken versions, retract for published versions that should be skipped), and workflows for conflicts across your dependency tree.

  • Go Workspaces — go.work files for multi-module development (e.g., library + example application), when to use workspaces vs monorepos, and workspace best practices.

  • Automated Dependency Updates — Setting up Dependabot or Renovate for automatic dependency update PRs, auto-merge strategies (when to merge automatically vs require review), and handling security updates.

  • Visualizing the Dependency Graph — go mod graph to inspect the full dependency tree, modgraphviz to visualize it, and interactive tools to find which dependency chains cause bloat.

Cross-References

  • → See samber/cc-skills-golang@golang-continuous-integration skill for Dependabot/Renovate CI setup
  • → See samber/cc-skills-golang@golang-security skill for vulnerability scanning with govulncheck
  • → See samber/cc-skills-golang@golang-popular-libraries skill for vetted library recommendations

Quick Reference

# Start a new module
go mod init github.com/user/project

# Add a dependency
go get github.com/google/uuid@v1.6.0

# Upgrade all deps (patch only, safer)
go get -u=patch ./...

# Remove unused deps
go mod tidy

# Check for vulnerabilities
govulncheck ./...   # or: go tool govulncheck ./...

# Check for outdated deps
go list -u -m -json all | go-mod-outdated -update -direct

# Analyze binary size by dependency
goweight

# Understand why a dep exists
go mod why -m github.com/some/module

# Visualize dependency graph
go mod graph | modgraphviz | dot -Tpng -o deps.png

# Verify checksums
go mod verify

发现问题?提交给管理员复核

评分:

评论 (0)

暂无评论,成为第一个评论者吧!