Repository navigation
CI lacks lint, format check, staticcheck, govulncheck, and coverage #23
Description
Summary
.github/workflows/ci.yml runs three checks: go vet, go build, go test -race. That's the lower bound of what Go CI typically does. Issues filed elsewhere in this review would have been caught at PR time by standard tooling:
| Existing issue | Caught by |
|---|---|
#6 (YAML config bugs, errors.New(fmt.Sprintf) patterns) |
staticcheck / golangci-lint |
| #13 (CVE-2023-39325, EOL Go) | govulncheck |
| #14 (statsd injection) | partly catchable with custom linters |
#21 (ad-hoc log usage) |
golangci-lint (revive: deprecated stdlib) |
general ioutil.ReadFile use (config.go:50) |
staticcheck (SA1019) |
There's also no coverage signal — go test runs but the percentage isn't tracked, posted to PRs, or gated.
Suggested fix
Extend .github/workflows/ci.yml:
- name: Format check
run: |
fmt_out="$(gofmt -l .)"
if [ -n "$fmt_out" ]; then
echo "Files need gofmt:"; echo "$fmt_out"; exit 1
fi
- name: Vet
run: go vet ./...
- name: Lint
uses: golangci/golangci-lint-action@v6
with:
version: latest
- name: Vuln check
run: |
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...
- name: Test with coverage
run: go test -race -coverprofile=coverage.out ./...
- name: Upload coverage
uses: actions/upload-artifact@v4
with:
name: coverage
path: coverage.outAdd a minimal .golangci.yml so behavior is reproducible locally:
linters:
enable:
- gofmt
- goimports
- govet
- staticcheck
- revive
- errcheck
- ineffassign
- unused
- unconvert
- misspellThis addresses both prevention (catch bugs at PR time) and observability of code health (coverage trend).
Activity