# Go Review

> Go code review guidelines for the Cog codebase

- Skill: `replicate/go-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add replicate/go-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/replicate/go-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: replicate (https://skillmd.com/u/replicate)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/replicate/go-review

---


## Go review guidelines

This project uses Go for the CLI (`cmd/cog/`, `pkg/`) and support tooling (`tools/`).

### What linters already catch (skip these)

golangci-lint runs errcheck, gocritic, gosec, govet, ineffassign, misspell,
revive, staticcheck, and unused. Don't flag issues these would catch.

### What to look for

**Error handling**

- Errors returned but not checked or silently discarded
- User-facing errors should use `pkg/errors.CodedError` with error codes
- Generic error wrapping that loses context (`fmt.Errorf("failed")` with no `%w`)

**Imports**

- Should be three groups: stdlib, third-party, internal (`github.com/replicate/cog/pkg/...`)
- Only flag if actually wrong, not cosmetic reordering

**Testing**

- Must use `testify/require` for fatal assertions and `testify/assert` for non-fatal
- No raw `if` checks with `t.Fatal`/`t.Errorf`
- Prefer table-driven tests for similar cases
- Prefer specific assertions (`Equal`, `Contains`, `NoError`) over `True`/`False`

**Concurrency**

- Goroutine leaks (no cleanup path, missing context cancellation)
- Shared state without synchronization
- Channel misuse (sends on closed channels, unbuffered channels in wrong contexts)

**Docker/container patterns**

- The CLI uses the Docker Go SDK. Watch for leaked clients, unclosed response bodies
- Dockerfile generation is in `pkg/dockerfile/` -- template injection risks

**Architecture**

- Commands belong in `pkg/cli/`, business logic in `pkg/`
- Config parsing/validation in `pkg/config/`
- Don't mix CLI concerns with library logic