go-tools
Checks for what a green build doesn't prove. Small Go tools the spin-stack repositories run from
their go.mod; each fails CI with a specific finding and says how to resolve it.
Documentation: https://spin-stack.github.io/go-tools/
| tool | what it catches |
|---|
mutate | code your change touched that no test checks, even at 100% coverage: it breaks the code one small edit at a time and fails when the tests still pass |
testquality | tests that cannot fail, tests skipped unconditionally, and tests that sleep a second or more where a condition should be waited for |
ctxlife | goroutines that use their caller's context and outlive the call |
refs | paths, tasks and packages that AGENTS.md or CLAUDE.md names and the tree no longer has |
vulngate | vulnerabilities the code calls and that have a fix |
versions | pins written outside versions.yaml, and pins behind their upstream |
sfw | npm, npx or yarn, and a pnpm install that does not go through Socket Firewall |
taskgate | a workflow step that is not one task, a task that holds a program rather than a few commands, and a script a task runs that decides anything - so CI and a developer run the same thing, and what decides is Go with a test |
deadgate | a function the binaries link and never call, or a package none imports, that neither the allowlist nor the pending list explains - and an entry in either that explains nothing |
proven | what CI already proved about a commit, by its tree: the run that answers for it, what a run on main is of, whether it may be released, each test's time, which failed tests are flaky |
exposure | what a repository would show if made public: secrets and private values in every ref's commits, pull request heads included, and in its issues, comments and releases |
provenance, sbom, attestgate, trustroot | releases published without SLSA provenance or an SBOM |
go get -tool github.com/spin-stack/go-tools/cmd/mutate
go tool mutate -base origin/main
versions, versions/upstream, versions/gate, provenance, attestgate, sbom and
trustroot are also packages another repository imports; the rest is internal/.
Working here
task test # the Go tests, under the race detector, held to a coverage floor
task lint # golangci-lint with spin's rules, and this repository's own gates run on itself
task mutate # break what the change against BASE (origin/main) touched, and ask the tests
task site # the documentation site (site/), built
The site is Astro Starlight under site/, styled as spin-stack/website,
and published to GitHub Pages from main. The example on its mutate page is
cmd/mutate/testdata/example, which TestTheExampleTheSiteShows runs on every CI run.
License
Apache License 2.0. See LICENSE.
