go-tools

Checks for what a green build doesn't prove. Small Go tools the spin-stack repositories run from their go.mod; each fails CI with a specific finding and says how to resolve it.

Documentation: https://spin-stack.github.io/go-tools/

tool	what it catches
mutate	code your change touched that no test checks, even at 100% coverage: it breaks the code one small edit at a time and fails when the tests still pass
testquality	tests that cannot fail, tests skipped unconditionally, and tests that sleep a second or more where a condition should be waited for
ctxlife	goroutines that use their caller's context and outlive the call
refs	paths, tasks and packages that AGENTS.md or CLAUDE.md names and the tree no longer has
vulngate	vulnerabilities the code calls and that have a fix
versions	pins written outside versions.yaml, and pins behind their upstream
sfw	npm, npx or yarn, and a pnpm install that does not go through Socket Firewall
taskgate	a workflow step that is not one task, a task that holds a program rather than a few commands, and a script a task runs that decides anything - so CI and a developer run the same thing, and what decides is Go with a test
deadgate	a function the binaries link and never call, or a package none imports, that neither the allowlist nor the pending list explains - and an entry in either that explains nothing
proven	what CI already proved about a commit, by its tree: the run that answers for it, what a run on main is of, whether it may be released, each test's time, which failed tests are flaky
exposure	what a repository would show if made public: secrets and private values in every ref's commits, pull request heads included, and in its issues, comments and releases
provenance, sbom, attestgate, trustroot	releases published without SLSA provenance or an SBOM

go get -tool github.com/spin-stack/go-tools/cmd/mutate
go tool mutate -base origin/main

versions, versions/upstream, versions/gate, provenance, attestgate, sbom and trustroot are also packages another repository imports; the rest is internal/.

Working here

task test      # the Go tests, under the race detector, held to a coverage floor
task lint      # golangci-lint with spin's rules, and this repository's own gates run on itself
task mutate    # break what the change against BASE (origin/main) touched, and ask the tests
task site      # the documentation site (site/), built

The site is Astro Starlight under site/, styled as spin-stack/website, and published to GitHub Pages from main. The example on its mutate page is cmd/mutate/testdata/example, which TestTheExampleTheSiteShows runs on every CI run.

License

Apache License 2.0. See LICENSE.