{"id":22057138,"url":"https://github.com/capnspacehook/go-workflows","last_synced_at":"2026-02-01T01:32:51.161Z","repository":{"id":196254924,"uuid":"694850061","full_name":"capnspacehook/go-workflows","owner":"capnspacehook","description":"Collection of useful reusable Github Actions workflows for Go","archived":false,"fork":false,"pushed_at":"2025-12-22T05:39:32.000Z","size":111,"stargazers_count":0,"open_issues_count":3,"forks_count":2,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-12-23T16:57:51.222Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/capnspacehook.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-09-21T20:30:52.000Z","updated_at":"2025-12-22T05:39:29.000Z","dependencies_parsed_at":null,"dependency_job_id":"4ff494e6-6081-4346-ba09-f28cff995933","html_url":"https://github.com/capnspacehook/go-workflows","commit_stats":null,"previous_names":["capnspacehook/go-workflows"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/capnspacehook/go-workflows","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capnspacehook%2Fgo-workflows","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capnspacehook%2Fgo-workflows/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capnspacehook%2Fgo-workflows/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capnspacehook%2Fgo-workflows/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/capnspacehook","download_url":"https://codeload.github.com/capnspacehook/go-workflows/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capnspacehook%2Fgo-workflows/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28963913,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-01T01:25:30.373Z","status":"ssl_error","status_checked_at":"2026-02-01T01:25:29.809Z","response_time":128,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-30T16:16:24.842Z","updated_at":"2026-02-01T01:32:51.149Z","avatar_url":"https://github.com/capnspacehook.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# go-workflows\n\nCollection of opinionated reusable Github Actions workflows for Go.\n\nThe workflows are optimized for execution speed and many are designed with supply chain security in mind. They use [setup-go-faster](https://github.com/WillAbides/setup-go-faster) to install Go, and [cache-go](https://github.com/capnspacehook/cache-go) to cache Go modules and build artifacts separately. I use them to in both projects that are primarily CLI tools, and libraries used as a Go module.\n\nThe Go version used in the workflows is the Go version in `go.mod`. I find it helpful for CLI tool projects as\nupdating the Go version in `go.mod` means the same version of Go will be used locally and in CI. Likewise for\nlibraries linting and testing against the version in `go.mod` is useful, it will let you know if you are using\nan outdated version of Go, and you're not releasing binaries so you don't need to use the latest version of Go.\n\nThese workflows are used in my projects and may be useful to others, though I'm aware that they're likely not\ncustomizable enough/too opinionated for many projects. If you'd like to use them but need more customization, feel\nfree to open an issue or a PR that adds workflow inputs.\n\n## Workflows:\n\n### [lint-go](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/lint-go.yml)\n\nRun the latest versions of [`golangci-lint`](https://golangci-lint.run/) and [`staticcheck`](https://staticcheck.io/), and checks that `go.mod` is tidy.\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Lint Go\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/lint-go.yml\"\n  pull_request:\n    branches:\n      - \"*\"\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/lint-go.yml\"\n\n  workflow_dispatch: {}\n\njobs:\n  lint-go:\n    permissions:\n      contents: read\n    uses: capnspacehook/go-workflows/.github/workflows/lint-go.yml@master\n```\n\u003c/details\u003e\n\n### [test](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/test.yml)\n\nRuns `go test` with the race detector, and optionally runs fuzz tests as well.\n\n#### Inputs\n\n| Name | Description | Required | Default |\n| --- | --- | --- | --- |\n| `run-fuzz-tests` | Run fuzz tests recursively | false | true |\n| `fuzz-with-race` | Run fuzz tests with race detector | false | false |\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Test\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/test.yml\"\n  pull_request:\n    branches:\n      - \"*\"\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/test.yml\"\n\n  workflow_dispatch: {}\n\njobs:\n  test:\n    permissions:\n      contents: read\n    uses: capnspacehook/go-workflows/.github/workflows/test.yml@master\n```\n\u003c/details\u003e\n\n### [check-generated](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/check-generated.yml)\n\nChecks that running `go generate` does not change any files.\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Check generated files\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/check-generated.yml\"\n  pull_request:\n    branches:\n      - \"*\"\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/check-generated.yml\"\n\n  workflow_dispatch: {}\n\njobs:\n  check-generated:\n    permissions:\n      contents: read\n    uses: capnspacehook/go-workflows/.github/workflows/check-generated.yml@master\n```\n\u003c/details\u003e\n\n### [vuln](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/vuln.yml)\n\nScans Go dependencies for known security vulnerabilities using [`govulncheck`](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck).\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Vulnerability scan\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \"go.mod\"\n      - \"go.sum\"\n      - \"**.go\"\n      - \".github/workflows/vuln.yml\"\n  pull_request:\n    branches:\n      - \"*\"\n    paths:\n      - \"go.mod\"\n      - \"go.sum\"\n      - \"**.go\"\n      - \".github/workflows/vuln.yml\"\n  schedule:\n    - cron: \"0 0 * * *\"\n\n  workflow_dispatch: {}\n\njobs:\n  vuln:\n    permissions:\n      contents: read\n    uses: capnspacehook/go-workflows/.github/workflows/vuln.yml@master\n```\n\u003c/details\u003e\n\n### [release-binaries](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/release-binaries.yml)\n\nBuilds and releases Go binaries for multiple platforms using [`GoReleaser`](https://goreleaser.com/) when a tag is pushed. Also signs the binaries with [`cosign`](https://github.com/sigstore/cosign).\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Release binaries\n\non:\n  push:\n    tags:\n      - \"v*.*.*\"\n\njobs:\n  release-binaries:\n    permissions:\n      id-token: write\n      contents: write\n    uses: capnspacehook/go-workflows/.github/workflows/release-binaries.yml@master\n```\n\u003c/details\u003e\n\n### [reproduce-binary](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/reproduce-binary.yml)\n\nChecks if binaries built by [`GoReleaser`](https://goreleaser.com/) are reproducible using [`gorepro`](https://github.com/capnspacehook/gorepro).\n\n`gorepro` is a tool that extracts build information embedded in Go binaries since Go 1.18 and uses that to reproduce the binary.\nThere are currently some Go build flags that are currently not embedded (namely `-ldflags`) so `gorepro` needs to be informed of them by passing them as inputs.\n\n#### Inputs\n\n| Name | Description | Required | Default |\n| --- | --- | --- | --- |\n| `extra-build-flags` | Build flags that aren't detected by gorepro | false | '' |\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Reproduce binary\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".goreleaser.yml\"\n      - \".github/workflows/reproduce-binary.yml\"\n  pull_request:\n    branches:\n      - \"*\"\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".goreleaser.yml\"\n      - \".github/workflows/reproduce-binary.yml\"\n\n  workflow_dispatch: {}\n\njobs:\n  reproduce-binary:\n    permissions:\n      contents: read\n    uses: capnspacehook/go-workflows/.github/workflows/reproduce-binary.yml@master\n```\n\u003c/details\u003e\n\n### [update-go-version](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/update-go-version.yml)\n\nCreates a pull request to update the Go version in `go.mod` to the latest stable version.\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Update Go version\n\non:\n  schedule:\n    - cron: \"0 0 * * *\"\n\n  workflow_dispatch: {}\n\njobs:\n  update-go-version:\n    permissions:\n      contents: write\n      pull-requests: write\n    uses: capnspacehook/go-workflows/.github/workflows/update-go-version.yml@master\n```\n\u003c/details\u003e\n\n### [size-report](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/size-report.yml)\n\nAdds a comment to pull requests with info on how much the changes will affect binary sizes using [`go-size-tracker`](https://github.com/capnspacehook/go-size-tracker).\n\n#### Inputs\n\n| Name | Description | Required | Default |\n| --- | --- | --- | --- |\n| `working-directory` | Relative path to the working directory that should be used to build your binary. | false | '.' |\n| `build-environment` | Environment variables to set when building your binary. Must be separated by newlines. | false | '' |\n| `build-arguments` | Arguments to 'go build' that will build your binary. The binary must be written to a file named 'out' in the working directory. | false | '-buildvcs=false -ldflags=\"-s -w\" -trimpath -o out' |\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Size report\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/size-report.yml\"\n  pull_request:\n    branches:\n      - \"*\"\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/size-report.yml\"\n\n  workflow_dispatch: {}\n\njobs:\n  size-report:\n    permissions:\n      contents: write # so go-size-tracker can use git notes to cache size records\n      pull-requests: write # so go-size-tracker can comment on PRs\n    uses: capnspacehook/go-workflows/.github/workflows/size-report.yml@master\n```\n\u003c/details\u003e\n\n### [lint-docker](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/lint-docker.yml)\n\nLints Dockerfiles using [`hadolint`](https://github.com/hadolint/hadolint) and verifies that Docker images build successfully.\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Lint Dockerfiles\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \"**Dockerfile*\"\n      - \".github/workflows/lint-docker.yml\"\n  pull_request:\n    branches:\n      - \"*\"\n    paths:\n      - \"**Dockerfile*\"\n      - \".github/workflows/lint-docker.yml\"\n\n  workflow_dispatch: {}\n\njobs:\n  lint-dockerfiles:\n    permissions:\n      contents: read\n    uses: capnspacehook/go-workflows/.github/workflows/lint-docker.yml@master\n```\n\u003c/details\u003e\n\n### [release-image](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/release-image.yml)\n\nBuilds and pushes Docker images to GitHub Container Registry (GHCR), with semantic versioning for tags and branch/sha tags for other refs. Also signs the images with [`cosign`](https://github.com/sigstore/cosign).\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Release image\n\non:\n  push:\n    branches:\n      - master\n    tags:\n      - \"v*.*.*\"\n\njobs:\n  release-image:\n    permissions:\n      contents: read\n      id-token: write\n      packages: write\n    uses: capnspacehook/go-workflows/.github/workflows/release-image.yml@master\n```\n\u003c/details\u003e\n\n### [lint-actions](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/lint-actions.yml)\n\nLints GitHub Actions workflow files using [`actionlint`](https://github.com/rhysd/actionlint).\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Lint workflows\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \".github/workflows/*\"\n  pull_request:\n    branches:\n      - \"*\"\n    paths:\n      - \".github/workflows/*\"\n\n  workflow_dispatch: {}\n\njobs:\n  lint-workflows:\n    permissions:\n      contents: read\n    uses: capnspacehook/go-workflows/.github/workflows/lint-actions.yml@master\n```\n\u003c/details\u003e\n\n### [codeql](https://github.com/capnspacehook/go-workflows/blob/master/.github/workflows/codeql.yml)\n\nRuns Github CodeQL analysis on Go code to detect security vulnerabilities and code quality issues. Skips execution for private repositories.\n\n\u003cdetails\u003e\n    \u003csummary\u003eExample usage:\u003c/summary\u003e\n\n```yaml\nname: Run CodeQL\n\non:\n  push:\n    branches:\n      - master\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/codeql.yml\"\n  pull_request:\n    branches:\n      - master\n    paths:\n      - \"**.go\"\n      - \"go.mod\"\n      - \"go.sum\"\n      - \".github/workflows/codeql.yml\"\n  schedule:\n    - cron: \"0 0 * * *\"\n\n  workflow_dispatch: {}\n\njobs:\n  codeql:\n    permissions:\n      actions: write\n      contents: read\n      security-events: write\n    uses: capnspacehook/go-workflows/.github/workflows/codeql.yml@master\n```\n\u003c/details\u003e\n\n## Verifying release artifacts\n\nGo binaries and Docker images are both signed with [`cosign`](https://github.com/sigstore/cosign). Their signatures can can be verified and the binaries can be reproduced to verify that they were built from unmodified source code, by Github Actions.\n\n### Verifying Docker images\n\nSimply check the signature of the image with `cosign`:\n\n```bash\ncosign verify ghcr.io/\u003cuser\u003e/\u003crepo\u003e:\u003cversion\u003e | jq\n```\n\nYou can verify the image was built by Github Actions by inspecting the Issuer and Subject fields of the output.\n\n### Verifying binaries\n\nDownload the checksums file, certificate, signature and the archive from a Github release to the same directory.\n\nExtract the binary from the archive, verify the checksums file and verify the contents of the binary:\n\n```bash\ntar xfs whalewall_\u003cversion\u003e_linux_amd64.tar.gz\ncosign verify-blob --certificate checksums.txt.crt --signature checksums.txt.sig checksums.txt\nsha256sum -c checksums.txt\n```\n\n### Reproducing released binaries\n\nYou can also reproduce the released binaries to verify that they were built from unmodified source code. Verifying binaries requires [`gorepro`](https://github.com/capnspacehook/gorepro).\n\nFirst, download the release archive and extract it. Clone the source repro and cd into it.\n\nInstall `gorepro` and run it on the extracted release binary. `gorepro` will tell you if reproducing the binary was successful. Don't worry about checking out the correct tag or commit, `gorepro` will handle that for you.\n\nIf you don't trust `gorepro` you can run it again additionally passing the -d flag. This will print the commands `gorepro` generated to reproduce the release binary. You can run the printed commands and verify for yourself that the reproduced binary is bit for bit identical to the released one.\n\nThis example reproduces [`whalewall`](https://github.com/capnspacehook/whalewall) v0.2.3:\n\n```bash\n# attempt to reproduce whalewall\nwget https://github.com/capnspacehook/whalewall/releases/download/v0.2.3/whalewall_0.2.3_linux_amd64.tar.gz\ntar fxs whalewall_v0.2.3_linux_amd64.tar.gz\ngit clone https://github.com/capnspacehook/whalewall whalewall-src\ncd whalewall-src\n\n# reproduce binary\ngo install github.com/capnspacehook/gorepro@latest\ngorepro -b=\"-ldflags=-s -w -X main.version v0.2.3\" ../whalewall\n\n# reproduce by manually running commands from gorepro\nBUILD_CMD=\"$(gorepro -d -b='-ldflags=-s -w -X main.version v0.2.3' ../whalewall)\"\necho \"$BUILD_CMD\"\n\"$BUILD_CMD\"\nsha256sum whalewall whalewall.repro\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcapnspacehook%2Fgo-workflows","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcapnspacehook%2Fgo-workflows","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcapnspacehook%2Fgo-workflows/lists"}