golang-dependency-management

The golang-dependency-management skill provides comprehensive guidance and tooling for managing dependencies in Golang projects. It helps developers maintain secure, reliable, and maintainable projects by managing go.mod files, installing and upgrading packages, auditing vulnerabilities, and resolving version conflicts. The skill emphasizes best practices such as committing go.sum for cryptographic verification, running vulnerability checks before releases, and evaluating dependencies carefully before adding them. It is particularly useful in projects where dependency stability, security, and reproducibility are critical.

This skill offers features like Minimal Version Selection handling, outdated dependency tracking, binary size analysis, and automated update setup with tools like Dependabot or Renovate. It includes rules for adding new dependencies, leveraging vetted libraries, and prioritizing standard library solutions over external packages. Commands for managing go.mod and go.sum, including downloading, verifying, and vendoring modules, are highlighted to ensure CI/CD pipelines and builds remain reproducible and secure. It also outlines procedures for dependency upgrading and conflict resolution, guiding AI agents to always confirm new dependencies with the user.

The skill is designed for developers and AI coding agents working with Golang projects who need to efficiently manage project dependencies, maintain security standards, and automate updates. Typical use cases include adding or removing Go modules, auditing dependencies for vulnerabilities, resolving version conflicts, preparing hermetic builds for CI or Docker environments, and ensuring reproducible builds across teams or deployment pipelines. Target users are Go developers, DevOps engineers, and AI agents assisting in code maintenance and dependency management.