Go Development Patterns
Required Workflow
For reviews, invoke related skills: security-audit (OWASP), enterprise-readiness (OpenSSF/SLSA), github-project (branch protection).
Core Principles
Type Safety
- Avoid:
interface{} (use any), sync.Map, scattered type assertions, reflection
- Prefer: Generics
[T any], errors.AsType[T] (Go 1.26), concrete types
- Run
go fix ./... after upgrades
Consistency
- One pattern per problem domain
- Match existing codebase patterns
- Refactor holistically or not at all
- Config precedence: defaults < config file < env vars < flags
Testing
- Build tags isolate test tiers: unit (default),
integration, e2e
- Always use
t.Parallel(), t.Helper(), table-driven subtests
- Use
log/slog directly -- never wrap it in custom Logger interfaces
Conventions
- Naming: ID, URL, HTTP (not Id, Url, Http) — not tool-enforced (ST1003 is off by default)
- Error wrapping:
fmt.Errorf("failed to process: %w", err)
References
Git hooks: ls lefthook.yml 2>/dev/null && lefthook install || echo "Add lefthook — see references/lefthook-template.md"
Load as needed:
| Reference |
Purpose |
references/architecture.md |
Package structure, state mutation completeness |
references/logging.md |
Structured logging with log/slog, migration from logrus |
references/cron-scheduling.md |
go-cron patterns: named jobs, runtime updates, resilience |
references/resilience.md |
Pointer to go-cron's built-in retry/circuit-breaker/timeout wrappers |
references/docker.md |
Docker client patterns, buffer pooling |
references/ldap.md |
LDAP/Active Directory integration |
references/testing.md |
Build tags, resource isolation, race gotchas |
references/linting.md |
golangci-lint v2, staticcheck |
references/api-design.md |
Enum/status defensive handling |
references/fuzz-testing.md |
Go fuzzing patterns, security seeds |
references/contracts-and-invariants.md |
Contracts, invariants, property tests |
references/mutation-testing.md |
Gremlins configuration, test quality measurement |
references/makefile.md |
Standard Makefile interface for CI/CD |
references/modernization.md |
Go 1.26 modernizers, go fix, errors.AsType[T] |
references/dependencies.md |
Upgrades: go get -u all, majors, build-set scoping |
references/lefthook-template.md |
Ready-to-use lefthook.yml for Go project git hooks |
references/branch-protection.md |
Ruleset watermark: three-ruleset gate, bypass modes |
references/reusable-workflows.md |
Reusable Actions workflow callers, permission propagation, release-gate outputs |
references/single-build-release.md |
Single-build release: cross-compile once, reuse for release+container |
references/awesome-go-submission.md |
awesome-go submission: CI-parsed PR body, name collisions |
Quality Gates
Run before completing any review:
golangci-lint run --timeout 5m # Linting
go vet ./... # Static analysis
staticcheck ./... # Additional checks
govulncheck ./... # Vulnerability scan
go test -race ./... # Race detection
Stdlib Vulnerability Fixes
When govulncheck reports stdlib vulnerabilities: check fix version via vuln.go.dev, update go X.Y.Z in go.mod, run go mod tidy.
Contributing: Submit improvements to https://github.com/netresearch/go-development-skill
1---2name: go-development3description: Use when developing Go applications, implementing job schedulers or cron (netresearch/go-cron, ofelia), Docker API integrations, LDAP/AD clients, building resilient services with retry logic, setting up Go test suites (unit/integration/fuzz/mutation), or running golangci-lint.4license: (MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.05---67# Go Development Patterns89## Required Workflow1011**For reviews, invoke related skills:** security-audit (OWASP), enterprise-readiness (OpenSSF/SLSA), github-project (branch protection).1213## Core Principles1415### Type Safety1617- **Avoid:** `interface{}` (use `any`), `sync.Map`, scattered type assertions, reflection18- **Prefer:** Generics `[T any]`, `errors.AsType[T]` (Go 1.26), concrete types19- Run `go fix ./...` after upgrades2021### Consistency2223- One pattern per problem domain24- Match existing codebase patterns25- Refactor holistically or not at all26- Config precedence: defaults < config file < env vars < flags2728### Testing2930- Build tags isolate test tiers: unit (default), `integration`, `e2e`31- Always use `t.Parallel()`, `t.Helper()`, table-driven subtests32- Use `log/slog` directly -- never wrap it in custom Logger interfaces3334### Conventions3536- Naming: ID, URL, HTTP (not Id, Url, Http) — not tool-enforced (ST1003 is off by default)37- Error wrapping: `fmt.Errorf("failed to process: %w", err)`3839## References4041Git hooks: `ls lefthook.yml 2>/dev/null && lefthook install || echo "Add lefthook — see references/lefthook-template.md"`4243Load as needed:4445| Reference | Purpose |46|-----------|---------|47| `references/architecture.md` | Package structure, state mutation completeness |48| `references/logging.md` | Structured logging with log/slog, migration from logrus |49| `references/cron-scheduling.md` | go-cron patterns: named jobs, runtime updates, resilience |50| `references/resilience.md` | Pointer to go-cron's built-in retry/circuit-breaker/timeout wrappers |51| `references/docker.md` | Docker client patterns, buffer pooling |52| `references/ldap.md` | LDAP/Active Directory integration |53| `references/testing.md` | Build tags, resource isolation, race gotchas |54| `references/linting.md` | golangci-lint v2, staticcheck |55| `references/api-design.md` | Enum/status defensive handling |56| `references/fuzz-testing.md` | Go fuzzing patterns, security seeds |57| `references/contracts-and-invariants.md` | Contracts, invariants, property tests |58| `references/mutation-testing.md` | Gremlins configuration, test quality measurement |59| `references/makefile.md` | Standard Makefile interface for CI/CD |60| `references/modernization.md` | Go 1.26 modernizers, `go fix`, `errors.AsType[T]` |61| `references/dependencies.md` | Upgrades: `go get -u all`, majors, build-set scoping |62| `references/lefthook-template.md` | Ready-to-use lefthook.yml for Go project git hooks |63| `references/branch-protection.md` | Ruleset watermark: three-ruleset gate, bypass modes |64| `references/reusable-workflows.md` | Reusable Actions workflow callers, permission propagation, release-gate outputs |65| `references/single-build-release.md` | Single-build release: cross-compile once, reuse for release+container |66| `references/awesome-go-submission.md` | awesome-go submission: CI-parsed PR body, name collisions |6768## Quality Gates6970Run before completing any review:7172```bash73golangci-lint run --timeout 5m # Linting74go vet ./... # Static analysis75staticcheck ./... # Additional checks76govulncheck ./... # Vulnerability scan77go test -race ./... # Race detection78```7980## Stdlib Vulnerability Fixes8182When `govulncheck` reports stdlib vulnerabilities: check fix version via `vuln.go.dev`, update `go X.Y.Z` in `go.mod`, run `go mod tidy`.8384---8586> **Contributing:** Submit improvements to https://github.com/netresearch/go-development-skill
netresearch