mirror of https://github.com/samber/cc-skills-golang.git synced 2026-09-11 19:46:44 +03:00

Files

T

Samuel BertheandGitHub ec8c349e29 docs: comprehensive skill-writing guideline update and retroactive fixes (#100 )

* docs: tighten skill description guidelines and fix overlap gaps

Description frontmatter is the only signal Claude Code reads before
deciding to load a skill, so under-specified triggers or missing
sibling boundaries directly cause mis-selection or silent skipping.

- add 8 description-writing rules to CLAUDE.md (ordering, point of
  view, concrete nouns, pushy-but-scoped triggers, sibling scoping,
  front-loading, no workflow narration, negative-clause siblings)
- add length-calibration guidance reserving long descriptions for
  moment-triggered skills, distinct from topic-triggered ones
- retroactively apply the new rules to the 16 skills that violated
  them: missing overlap disclaimers (golang-security, golang-safety,
  golang-concurrency, golang-troubleshooting, golang-dependency-management,
  golang-continuous-integration, golang-design-patterns, golang-modernize,
  golang-project-layout, golang-popular-libraries, golang-lint,
  golang-data-structures, golang-samber-mo), oversized descriptions
  (golang-refactoring, golang-pkg-go-dev), and a too-abstract one
  (golang-stay-updated)

* docs: add skill body writing style guidelines

Body content quality (voice, terminology, specificity, feedback
loops) was undocumented even though description quality already had
a dedicated section — leaving body-writing conventions to individual
judgment call by call.

- add a Body writing style section: imperative verb-first voice, one
  term per concept, one default with an escape hatch, assume reader
  competence, tables/checklists over prose, specificity matched to
  fragility, copyable progress checklists, feedback loops over rule
  enumeration
- fold the ALWAYS/NEVER-in-caps-as-a-smell refinement into the
  existing Teach reasoning, not only rules section
- add the under-250-lines target and 147-line official median to
  the existing Token budgets line-count bullet

* docs: apply new body writing style rules to 11 skill bodies

Retroactively applies CLAUDE.md's new Body writing style rules
(added earlier on this branch) after a read-only audit of all 46
active skill bodies flagged 10 real violations.

- add rationale to bare ALL-CAPS ALWAYS/NEVER items that weren't
  actually order-dependent or destructive (golang-context,
  golang-modernize, golang-samber-do, golang-project-layout,
  golang-structs-interfaces, golang-testing, golang-troubleshooting)
- split oversized bodies into references/: golang-structs-interfaces
  (386 -> 300 lines, new struct-fields.md and type-assertions.md)
  and golang-testing (476 -> 417 lines, new benchmarks.md,
  coverage.md, examples.md)
- trim golang-dependency-injection's duplicated 4-library comparison
  down to a 2-way contrast, pointing to its existing reference files
  for the rest
- merge golang-safety's two split Cross-References sections into one
- normalize the ASCII "->" arrow to "→" for consistency with the
  rest of the repo (golang-samber-mo, golang-testing,
  golang-concurrency)

* docs: add progressive disclosure guidance for skill bodies

The old Progressive disclosure section had a merge artifact (three
numbered items all labeled "Instructions" with three different,
overlapping token thresholds) and said nothing about why references
matter or how compaction and nested reads actually fail.

- reframe around the real asymmetry: body content is a recurring
  per-turn cost, references/ is paid once and only if loaded
- fix the duplicate "Instructions" bullets by cross-referencing
  Token budgets instead of restating three conflicting numbers
- document the nested-reference truncation failure mode (head -100
  silently drops the deepest content) on the existing one-level-deep
  rule in the Skill Body intro
- add the auto-compaction budget fact (~5,000 tokens survive per
  skill, ~25,000 shared) and the table-of-contents-over-100-lines,
  organize-by-domain, and explicit-load-pointer rules

* docs: add tables of contents to long reference files

CLAUDE.md's new progressive disclosure guidance requires a Table of
Contents on any reference file over 100 lines, so a partial read
(head -100, or truncation on a long file) still reveals the file's
full scope instead of silently hiding sections past the cutoff.

Generated mechanically for all 123 qualifying reference files (every
skills/*/references/*.md over 100 lines that didn't already have
one) with a one-off script: extract H2/H3 headings outside fenced
code blocks, build GitHub-compatible anchors, insert after the H1
title and intro paragraph. Idempotent - already-TOC'd files (the 4
golang-gopls reference files) were left untouched.

* docs: add bundling-scripts and security guidelines

Executable helpers and skill-level security had no dedicated home in
CLAUDE.md even though the plugin already ships scripts/ directories
and handles third-party library content that could carry injections.

- add a Bundling scripts section: when to bundle (deterministic,
  repeated, or fragile operations), errors handled inside the
  script, justified constants, forward-slash paths, explicit
  dependencies, execute-vs-read framing, and plan -> validate ->
  execute for batch or destructive work
- add a Security section anchored on the Principle of Lack of
  Surprise: no credential handling or data exfiltration, no runtime
  instruction-fetching, external content treated as data, allowed-
  tools granting without prompting even in untrusted directories,
  least-privilege tool scoping, and auditing bundled files (not just
  SKILL.md) before installing a third-party skill
- cross-reference existing Snyk agent scanner compliance and
  Library-specific skills sections instead of duplicating their
  detailed patterns

* docs: add anti-patterns quick-reference table

A single lookup table naming every failure mode and pointing at the
section that owns the fix makes today's accumulated guidance
(description, body, progressive disclosure, scripts, security)
scannable in one pass instead of requiring a full read to recall
where a given rule lives.

- add the Anti-patterns table before Evaluation, cross-referencing
  existing sections for rows already covered in full
- add net-new guidance where no existing rule covered the row:
  version-relative facts over date-relative ones with a collapsed
  <details> block for superseded patterns, forward slashes in body
  examples (not just scripts), a verified frontmatter field-count
  warning (confirmed against the Agent Skills spec: six fields -
  name, description, license, compatibility, metadata, allowed-tools
  - everything else is a harness extension), top-level version:
  rejection, description YAML-quoting pitfalls, MCP tool name
  server-qualification, allowed-tools as a pre-approval list rather
  than a sandbox, @-mention force-loading of another skill, a
  discovery-degradation ceiling around 20-50 installed skills, and
  per-model eval validity
- add a short "facts in CLAUDE.md, procedures in skills" principle
  to Project Overview, the CLAUDE.md-vs-skill counterpart to the
  existing skill-vs-skill Atomic skills and deduplication rule

* fix: correct TOC anchor slugs and prettier/markdownlint findings

Running the documented lint pipeline (prettier, then
markdownlint-cli2) surfaced a real bug in the TOC-generation script
used earlier on this branch: its anchor slugger collapsed runs of
whitespace into a single hyphen and stripped inline emphasis markers
without excluding intraword underscores, producing anchors that did
not match GitHub's actual algorithm (each whitespace character maps
to its own hyphen, with no collapsing). This broke 306 link
fragments across 61 reference files whose headings contained an
em dash, ampersand, parentheses, or a snake_case identifier.

- fix the slugify algorithm and regenerate all 123 previously
  generated TOCs; the fix is idempotent, so headings without special
  punctuation are byte-identical to before
- fix two `MD038` violations in CLAUDE.md (` : ` code spans with
  a trailing space) introduced by an earlier commit on this branch
- apply prettier's table-column alignment to two new reference files
  (golang-testing/references/coverage.md, examples.md)

20 anchors across two files (golang-how-to/references/by-category.md,
project-config.md) remain flagged by markdownlint's MD051 rule for
headings containing emoji with variation selectors -- its own --fix
computes the identical anchor its checker then rejects, a stable
fixed point that is a markdownlint-cli2 limitation, not a defect in
the generated content (the heading text itself is unaffected; only
the anchor's exact string fails the linter's cross-check). Left as a
known limitation rather than chased further.

All other lint findings across the repository (515 total, MD022/
MD037/MD025/etc.) are pre-existing and outside every file this
branch touches -- confirmed by diffing the error file list against
this branch's changed-file list.

* chore: bump patch version on all 40 skills changed on this branch

* chore: bump plugin version to 2.0.1

* oops

2026-09-01 11:45:24 +02:00

24 KiB

Raw Blame History

🕵 AI-Driven Code Review in CI

Add AI agents as PR reviewers alongside traditional static analysis. When configured with this skill plugin, the agent applies the relevant Go skills per review area — catching architectural drift, logic bugs, and concurrency hazards that linters cannot detect.

Contents:

Claude Code Action
GitHub Copilot
Cost and tuning

Claude Code Action

Run /install-github-app in Claude Code to install the GitHub app and connect to the Claude API. Then create .github/workflows/ai-code-review.yml:

name: AI Code Review (Claude)

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]

# Security note: these permissions apply to the entire repository, not just the current PR.
# `pull-requests: write` allows the workflow to post, edit, and resolve comments on ANY pull request.
# `actions: read` allows reading logs from ANY workflow run, which may contain sensitive output.
# Scope risk by restricting the trigger to PRs from trusted contributors or protected branches,
# and by never logging secrets in CI steps.
permissions:
  contents: read
  issues: read
  pull-requests: write
  actions: read
  id-token: write

concurrency:
  group: claude-review-${{ github.event.pull_request.number || github.event.issue.number }}-${{ github.event_name }}
  cancel-in-progress: true

jobs:
  # ── Job 1: Code quality (suggestion-first) ──────────────────────────────────
  # Covers: style, naming, documentation
  quality:
    name: Review — Quality
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Skip bot PRs (Dependabot, Renovate, etc.)
    # Remove this filter if you want bots to get reviewed.
    if: ${{ github.event_name == 'pull_request' && !endsWith(github.event.pull_request.user.login, '[bot]') }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: stable

      - name: Install Go skills
        run: npx skills add https://github.com/samber/cc-skills-golang -a claude-code --skill '*' -y --copy

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          show_full_output: true
          use_sticky_comment: true
          track_progress: true
          sticky_comment_header: "<!-- claude-review-quality -->"
          additional_permissions: |
            actions: read
          claude_args: >-
            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__context7__resolve-library-id,mcp__context7__query-docs,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}
            AUTHOR: ${{ github.event.pull_request.user.login }}

            You are a senior Go engineer performing a focused code quality review.

            Review this pull request.
            - Use `gh pr diff` to read the diff.
            - Use `gh pr view` to read description and metadata.
            - Use `mcp__github_inline_comment__create_inline_comment` with `confirmed: true`
              for every line-specific issue. Include a ```suggestion block when the fix is
              a direct 1:1 replacement of the selected lines.
            - Use `gh pr comment` only for a top-level summary.
            - Post nothing else. No chat output.

            ## Scope — apply these skill guidelines

            - **Code style** — formatting, comment quality, idiomatic Go patterns (Skill("golang-code-style")).
            - **Naming** — packages, types, variables, functions, constants (Skill("golang-naming")).
            - **Documentation** — exported symbols, package-level docs, README impact (Skill("golang-documentation")).

            ## Priority — suggestion-first

            These areas reflect style and readability, not correctness. Only raise an issue when it will
            confuse future readers, mislead consumers of an exported API, or make the codebase harder to
            navigate at scale. Do not flag formatting that `gofmt` handles automatically.

            ## How to report

            Every comment must:
            1. Name the specific problem (not just its symptom)
            2. Explain under what conditions it matters or fails
            3. Provide a concrete fix — renamed identifier, corrected code snippet, or safer pattern

            Write short, concise comments. Only comment when there is a specific issue. Do not praise
            the good stuff. Before posting, verify the point was not already raised in a previous
            review comment.

            Note: the PR branch is already checked out in the current working directory.

            Check project guidelines: @./CLAUDE.md
            Check contributing guidelines: @./CONTRIBUTING.md

            Label each comment: 🟡 **SUGGESTION**

  # ── Job 2: Correctness (blocking-first) ─────────────────────────────────────
  # Covers: error handling, code safety, concurrency
  correctness:
    name: Review — Correctness
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: ${{ github.event_name == 'pull_request' && !endsWith(github.event.pull_request.user.login, '[bot]') }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: stable

      - name: Install Go skills
        run: npx skills add https://github.com/samber/cc-skills-golang -a claude-code --skill '*' -y --copy

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          show_full_output: true
          use_sticky_comment: true
          track_progress: true
          sticky_comment_header: "<!-- claude-review-correctness -->"
          additional_permissions: |
            actions: read
          claude_args: >-
            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__context7__resolve-library-id,mcp__context7__query-docs,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}
            AUTHOR: ${{ github.event.pull_request.user.login }}

            You are a senior Go engineer performing a focused correctness and safety review.

            Review this pull request.
            - Use `gh pr diff` to read the diff.
            - Use `gh pr view` to read description and metadata.
            - Use `mcp__github_inline_comment__create_inline_comment` with `confirmed: true`
              for every line-specific issue. Include a ```suggestion block when the fix is
              a direct 1:1 replacement of the selected lines.
            - Use `gh pr comment` only for a top-level summary.
            - Post nothing else. No chat output.

            ## Scope — apply these skill guidelines

            - **Error handling** — wrapping, sentinel errors, log-and-return, swallowed errors (Skill("golang-error-handling")).
            - **Code safety** — nil dereference, map/slice aliasing, integer overflows, uninitialized state (Skill("golang-safety")).
            - **Concurrency** — goroutine lifecycle, mutex usage, channel patterns, context propagation, data races (Skill("golang-concurrency")).

            ## Priority — blocking-first

            A swallowed error, an unchecked nil, or an unsynchronized write can cause silent data corruption
            or production incidents — flag these even when the fix is non-trivial.

            ## How to report

            Every comment must:
            1. Name the specific problem (not just its symptom)
            2. Explain under what conditions it matters or fails
            3. Provide a concrete fix — corrected code snippet or safer pattern

            Write short, concise comments. Only comment when there is a specific issue. Do not praise
            the good stuff. Before posting, verify the point was not already raised.

            Note: the PR branch is already checked out in the current working directory.

            Check project guidelines: @./CLAUDE.md
            Check contributing guidelines: @./CONTRIBUTING.md

            Label each comment with its severity:
            - 🔴 **BLOCKING** — definite bug, data race, or correctness failure; must be fixed before merge.
            - 🟠 **IMPORTANT** — significant risk that requires unusual conditions to manifest.
            - 🟡 **SUGGESTION** — defensive improvement with low-probability failure mode.

  # ── Job 3: Security & dependencies (blocking-first) ─────────────────────────
  # Covers: security, dependency health
  security:
    name: Review — Security & Dependencies
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: ${{ github.event_name == 'pull_request' && !endsWith(github.event.pull_request.user.login, '[bot]') }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: stable

      - name: Install Go skills
        run: npx skills add https://github.com/samber/cc-skills-golang -a claude-code --skill '*' -y --copy

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          show_full_output: true
          use_sticky_comment: true
          track_progress: true
          sticky_comment_header: "<!-- claude-review-security -->"
          additional_permissions: |
            actions: read
          claude_args: >-
            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__context7__resolve-library-id,mcp__context7__query-docs,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}
            AUTHOR: ${{ github.event.pull_request.user.login }}

            You are a senior Go security engineer performing a focused security and dependency review.

            Review this pull request.
            - Use `gh pr diff` to read the diff.
            - Use `gh pr view` to read description and metadata.
            - Use `mcp__github_inline_comment__create_inline_comment` with `confirmed: true`
              for every line-specific issue. Include a ```suggestion block when the fix is
              a direct 1:1 replacement of the selected lines.
            - Use `gh pr comment` only for a top-level summary.
            - Post nothing else. No chat output.

            ## Scope — apply these skill guidelines

            - **Security** — injection, auth, crypto misuse, sensitive data exposure, input validation (Skill("golang-security")).
            - **Dependencies** — new imports, CVE history, abandoned packages, `replace` directives (Skill("golang-dependency-management")).

            ## Priority — blocking-first

            Security issues and supply-chain risks must be flagged before style or quality concerns.
            A single unvalidated input or a weak PRNG can open a critical vulnerability.

            ## How to report

            Every comment must:
            1. Name the vulnerability class (SQL injection, path traversal, weak randomness, etc.)
            2. Explain the attack vector and realistic impact
            3. Provide a concrete, safe alternative

            Write short, concise comments. Only comment when there is a specific issue. Do not praise
            the good stuff. Before posting, verify the point was not already raised.

            Note: the PR branch is already checked out in the current working directory.

            Check project guidelines: @./CLAUDE.md
            Check contributing guidelines: @./CONTRIBUTING.md

            Label each comment with its severity:
            - 🔴 **BLOCKING** — exploitable vulnerability or high-risk dependency; must be fixed before merge.
            - 🟠 **IMPORTANT** — significant risk that requires specific conditions.
            - 🟡 **SUGGESTION** — defense-in-depth improvement; optional but worthwhile.

  # ── Job 4: Tests, performance, observability & modernization ─────────────────
  # Covers: tests, performance, observability, modernize
  quality-depth:
    name: Review — Tests, Performance & Observability
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: ${{ github.event_name == 'pull_request' && !endsWith(github.event.pull_request.user.login, '[bot]') }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: stable

      - name: Install Go skills
        run: npx skills add https://github.com/samber/cc-skills-golang -a claude-code --skill '*' -y --copy

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          show_full_output: true
          use_sticky_comment: true
          track_progress: true
          sticky_comment_header: "<!-- claude-review-quality-depth -->"
          additional_permissions: |
            actions: read
          claude_args: >-
            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__context7__resolve-library-id,mcp__context7__query-docs,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}
            AUTHOR: ${{ github.event.pull_request.user.login }}

            You are a senior Go engineer reviewing for test coverage, performance, observability,
            and code modernization.

            Review this pull request.
            - Use `gh pr diff` to read the diff.
            - Use `gh pr view` to read description and metadata.
            - Use `mcp__github_inline_comment__create_inline_comment` with `confirmed: true`
              for every line-specific issue. Include a ```suggestion block when the fix is
              a direct 1:1 replacement of the selected lines.
            - Use `gh pr comment` only for a top-level summary.
            - Post nothing else. No chat output.

            ## Scope — apply these skill guidelines

            - **Tests** — coverage of new code, test quality, table-driven tests, use of t.Helper() (Skill("golang-testing")).
            - **Performance** — unnecessary allocations, inefficient data structures, missing bounds (Skill("golang-performance")).
            - **Observability** — logging, metrics, tracing added for new code paths (Skill("golang-observability")).
            - **Modernize code** — outdated patterns replaced with Go 1.21+ idioms (Skill("golang-modernize")).

            ## Priority

            - **Tests** and **Performance** are important — flag missing coverage on new exported paths
              and obvious allocation hot-spots on critical paths.
            - **Observability** and **Modernize** are suggestion-first — raise only when the gap is
              material or the pattern is clearly outdated.

            ## How to report

            Every comment must:
            1. Name the specific problem (not just its symptom)
            2. Explain why it matters (undetected regression, latency impact, etc.)
            3. Provide a concrete fix or example

            Write short, concise comments. Only comment when there is a specific issue. Do not praise
            the good stuff. Before posting, verify the point was not already raised.

            Note: the PR branch is already checked out in the current working directory.

            Check project guidelines: @./CLAUDE.md
            Check contributing guidelines: @./CONTRIBUTING.md

            Label each comment with its severity:
            - 🟠 **IMPORTANT** — missing test for a critical exported path; allocation hot-spot on a
              latency-sensitive path.
            - 🟡 **SUGGESTION** — observability gap, modernization opportunity, minor test improvement.

  # ── Job 5: CI failure diagnosis ──────────────────────────────────────────────
  # Waits for all review jobs, then diagnoses any failures and posts a fix summary.
  ci-diagnosis:
    name: Review — CI Failure Diagnosis
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [quality, correctness, security, quality-depth]
    if: ${{ always() && github.event_name == 'pull_request' && !endsWith(github.event.pull_request.user.login, '[bot]') }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          show_full_output: true
          use_sticky_comment: true
          track_progress: true
          sticky_comment_header: "<!-- claude-review-ci-diagnosis -->"
          additional_permissions: |
            actions: read
          claude_args: >-
            --allowedTools "Bash(gh pr comment:*),Bash(gh pr view:*),Bash(gh run view:*),Bash(gh run list:*)"

          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}
            WORKFLOW RUN ID: ${{ github.run_id }}

            You are a senior Go engineer diagnosing CI failures on a pull request.

            Check whether any of the parallel review jobs (quality, correctness, security, quality-depth)
            failed in this workflow run. If all jobs succeeded, post nothing and exit.

            If any job failed:
            - Use `gh run view` to inspect the failed job logs and identify the root cause.
            - Post a single `gh pr comment` summarizing:
              1. Which job(s) failed and why (log excerpt).
              2. Concrete steps to fix the failure (configuration change, missing secret, infra issue).
            - Post nothing else. No chat output.

  # ── Job 6: Discuss review comments ──────────────────────────────────────────
  # Triggered when a human posts a review comment. Replies only when warranted.
  discuss:
    name: Review — Discuss
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: ${{ (github.event_name == 'pull_request_review_comment' || github.event_name == 'pull_request_review') && !endsWith(github.event.sender.login, '[bot]') }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          show_full_output: true
          use_sticky_comment: false
          track_progress: false
          claude_args: >-
            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr view:*),Bash(gh pr diff:*)"

          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}

            You are a senior Go engineer participating in a code review discussion.

            A human just posted a review comment or submitted a review on this PR.
            Read the comment thread and decide whether to reply.

            Reply ONLY if:
            - The comment contains a factual mistake about Go semantics, stdlib, or a package.
            - The proposed change would introduce a bug, performance regression, or security issue.
            - A brief clarification would unblock the discussion.

            Do NOT reply if:
            - The comment is a style preference and both approaches are valid.
            - The author has already acknowledged the feedback.
            - A debate is already in progress — let it resolve naturally.
            - You already replied to this thread.

            When you reply: be short and direct. One or two sentences maximum. State the technical
            fact. If the author disagrees after your reply, drop the thread.

            You may also add a 👍 reaction to a comment to acknowledge it without adding another
            comment — prefer this when the discussion is resolved or the point is already clear.

            Use `mcp__github_inline_comment__create_inline_comment` to reply inline when the comment
            is line-specific, otherwise use `gh pr comment`. Post nothing else. No chat output.

Remove jobs you don't need to reduce cost. The ci-diagnosis and discuss jobs add no review API cost — they only run when other jobs fail or a human comments.

GitHub Copilot

Install skills into your repository, then create .github/copilot-instructions.md:

npx skills add https://github.com/samber/cc-skills-golang --agent github-copilot --skill '*' -y --copy
ln -s .agents .copilot

# Go Code Review Instructions

You are a senior Go engineer reviewing a pull request. Apply these guidelines for each area.

Before considering your reply, build a list of relevant skills:

    find .copilot/skills -type f -name SKILL.md -print0 \
      | xargs -0 yq -o=json \
      | jq -r '{name, description}'

Pick skills that look relevant. Even if they have a 0.001% chance of applying. Read them before reviewing the diff.

## Review Areas

- **Code style** — formatting, comment quality, idiomatic Go patterns (`.copilot/skills/golang-code-style/SKILL.md`)
- **Naming** — packages, types, variables, functions, constants (`.copilot/skills/golang-naming/SKILL.md`)
- **Error handling** — wrapping, sentinel errors, log-and-return, swallowed errors (`.copilot/skills/golang-error-handling/SKILL.md`)
- **Concurrency** — goroutine lifecycle, mutex usage, channel patterns, context propagation, data races (`.copilot/skills/golang-concurrency/SKILL.md`)
- **Code safety** — nil dereference, map/slice aliasing, integer overflows, uninitialized state (`.copilot/skills/golang-safety/SKILL.md`)
- **Tests** — coverage of new code, test quality, table-driven tests, use of t.Helper() (`.copilot/skills/golang-testing/SKILL.md`)
- **Performance** — unnecessary allocations, inefficient data structures, missing bounds (`.copilot/skills/golang-performance/SKILL.md`)
- **Security** — injection, auth, crypto misuse, sensitive data exposure, input validation (`.copilot/skills/golang-security/SKILL.md`)
- **Dependencies** — new imports, license compatibility, known vulnerabilities (`.copilot/skills/golang-dependency-management/SKILL.md`)
- **Documentation** — exported symbols, package docs, README impact (`.copilot/skills/golang-documentation/SKILL.md`)
- **Observability** — logging, metrics, tracing added for new code paths (`.copilot/skills/golang-observability/SKILL.md`)
- **Modernize code** — outdated patterns replaced with Go 1.21+ idioms (`.copilot/skills/golang-modernize/SKILL.md`)

## Priority

- **Blocking-first**: Security, Code safety, Error handling, Concurrency
- **Important**: Tests, Performance, Dependencies
- **Suggestion-first**: Code style, Naming, Documentation, Observability, Modernize code

## Severity Labels

- 🔴 **BLOCKING** — bug, vulnerability, data race, or correctness issue; must be fixed before merge.
- 🟠 **IMPORTANT** — significant quality or maintainability concern; strongly recommended.
- 🟡 **SUGGESTION** — style, naming, or minor improvement; optional but worthwhile.

Write short, concise comments. Reference the exact file and line. Explain what is wrong and why it matters. Provide a concrete fix. Post nothing if there is nothing to say.

Cost and tuning

The 4 parallel review jobs (quality, correctness, security, quality-depth) each spawn a Claude agent per PR push. Remove jobs you don't need. The ci-diagnosis and discuss jobs add no review API cost — they only run when other jobs fail or a human comments.

24 KiB Raw Blame History

🕵 AI-Driven Code Review in CI

Claude Code Action

GitHub Copilot

Cost and tuning

24 KiB

Raw Blame History