Learning Golang - CI/CD, Release, and Dependency Management

#Introduction

Running builds and tests manually will fall behind. As a team grows, code quality must be guaranteed by machines: every commit is used in a pipeline, every pull request is verified, and every tag produces a release. Episode 17 automates all of this for a Go project.

Episode 17 covers CI/CD pipelines with GitHub Actions, securing dependencies with go mod verify and govulncheck, and a release workflow that includes versioning, semantic imports, and cross-platform binary distribution.

#Pipelines with GitHub Actions

#The Build and Test Workflow

A GitHub Actions workflow is defined in .github/workflows/. The following workflow runs format, vet, and tests on every push and pull request:

name: CI
on:
  push:
    branches: [main]
  pull_request:
 
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: "1.23"
      - run: gofmt -l .
      - run: go vet ./...
      - run: go test -race ./...

go test -race enables the race detector — mandatory for projects that use goroutines. A binary build step can be added to make sure the project still compiles for the target architecture.

#Caching Dependencies

Repeated dependency downloads slow down the pipeline. The Go setup in GitHub Actions supports automatic go.sum caching, or you can use manual caching:

go mod download
go build -o app ./cmd/server

With caching, pipeline time can drop dramatically. For pull requests from outside contributors, make sure workflow permissions don't leak secrets.

#Dependency Security

#go mod verify in the Pipeline

go mod verify checks whether the stored modules still match the go.sum checksums. Running it in CI detects dependencies that are corrupted or modified since they were downloaded.

go mod verify
go list -m -json all | jq -r '.Version' | wc -l

#govulncheck

govulncheck is the official tool from the Go team that detects vulnerabilities in a project's dependencies. It only reports vulnerabilities that are actually reachable from your code, reducing noise.

go install golang.org/x/vuln/cmd/govulncheck@latest

govulncheck ./...

When a vulnerability is found, run go get pkg@versi-terbaru and then go mod tidy. Integrate govulncheck into the CI pipeline so pull requests with vulnerable dependencies are rejected right away.

#Release Workflow

#Versioning with Semantic Versioning

Releases use semantic versioning: MAJOR.MINOR.PATCH. Major changes for breaking changes, minor for new features, patch for fixes. Go applies a special rule: v2 and above modules must add the /v2 suffix to their module path.

git tag v1.2.0
git push origin v1.2.0

#Releasing Binaries with goreleaser

goreleaser automates the release process: building binaries for many OSes and architectures, creating archives, writing release notes, and uploading them to GitHub Releases.

project_name: api-go
builds:
  - env: [CGO_ENABLED=0]
    goos: [linux, darwin, windows]
    goarch: [amd64, arm64]

Run goreleaser release after the tag is created. The result: files like api-go_1.2.0_linux_amd64.tar.gz, api-go_1.2.0_darwin_arm64.tar.gz, and so on — ready to distribute without a Go toolchain.

#Semantic Imports

For packages that others use, follow the rules: on a breaking change, bump the major version and move the code to a v2/ or v3/ directory with the matching module path. Consumers simply update the version in their go.mod.

#Keeping the Pipeline Green

Several practices keep a pipeline healthy:

• Fail fast: run the fastest, most likely-to-fail steps first.
• Deterministic: always use fixed tooling versions.
• Test on several architectures: an OS and architecture matrix catches cross-compilation problems.
• Quality gates: make coverage and lint gates, not just information.
• Branch protection: require all checks to pass before merging.

With a healthy pipeline, a team can release often without fear of breaking production.

#Closing

Episode 17 automated the journey of code to production: a CI pipeline with GitHub Actions running gofmt, go vet, and go test -race, dependency security with go mod verify and govulncheck, plus a release workflow with semantic versioning, goreleaser, and semantic imports.

Key takeaways:

• A CI pipeline runs format, vet, and tests automatically.
• go test -race is mandatory for goroutine-based code.
• govulncheck reports vulnerabilities that are actually used.
• Releases use semantic versioning MAJOR.MINOR.PATCH.
• v2 and above modules use the /v2 suffix in the path.
• goreleaser produces cross-platform binaries for releases.

In the next episode we will discuss modern tooling and the latest stable features — the go tool toolchain, gopls, go test, go fmt, and go vet, stable features such as fuzz testing and the slices and maps packages, plus the trends of cloud-native Go in production.