go-cli-github

Go CLI GitHub

This repository is a template for a Go CLI tool or service. It is quite opinionated about security and release engineering, but hopefully in a good way.

It comes pre-configured for integration with GitHub-specific features such as Dependabot security tooling, CodeQL, and branch protection. It also automatically builds and tests your code using GitHub Actions.

Features

• Use GoReleaser to automatically build and create GitHub Releases and container images on merge to main.

  • This uses the Conventional Commits Versioner to automatically version each release.

• Lint your commit messages, Go code, GitHub Actions, and Dockerfiles.

• Test Pull Requests using go test.

• Build container images from Pull Requests and push them to the GitHub container registry for manual testing and review.

• Static code analysis using CodeQL and Go Report Card.

• Coverage analysis using the GitHub coverage API.

• Security analysis using OpenSSF.

• Signed binary and container release artifacts using artifact attestations.

• SBOM generation for both release artifacts and container images, with image SBOMs pushed to the container registry.

How to use

First set up the GitHub repo

1. Create a new empty GitHub repository.

Then push some code to main:

1. Install gonew and run this command, replacing the last argument with the name of your new module:

   gonew github.com/smlx/go-cli-github@main github.com/smlx/newproject
   

2. Create the git repo and push to main (which will become the default branch):

   cd newproject
   git init .
   git branch -M main
   git remote add origin git@github.com:smlx/newproject.git
   git add .
   git commit -am 'chore: create repository from template'
   

Then customize the code for your repository:

1. Update the code for your project:

   • rename cmd/go-cli-github to cmd/$YOUR_COMMAND
     • if you only have one binary: rm -rf cmd/another-binary
   • update .github/workflows/build.yaml, replacing go-cli-github with $YOUR_COMMAND
     • if you only have one binary: delete references to another-binary
   • update .goreleaser.yaml to build cmd/$YOUR_COMMAND
     • if you only have one binary: delete the YAML anchor and references to another-binary
   • if you don't need docker images:
     1. edit .goreleaser.yaml and delete dockers_v2
     2. edit .github/workflows/build.yaml and delete the build-image job.
     3. edit .github/workflows/release.yaml and delete the ghcr login, and image attestation steps.
     4. delete Dockerfile
   • update the links at the top of README.md
   • update the contact email in SECURITY.md
   • if you aren't in an enterprise that has code quality enabled, delete the coverage workflow (.github/workflows/coverage.yaml)
   • if your repository is not public (i.e. internal or private)
     1. delete the OSSF workflow (.github/workflows/ossf-analysis.yaml)
     2. remove the OSSF and Go Reference badges from the top of the README.md

2. Commit and push:

   git add .
   git commit -am 'chore: update template for new project'
   git push -u origin main
   

3. Open a test PR, ensure all checks go green, then merge the PR. If workflows aren't green, commit and push to the branch until they are.

   git checkout -b setup main
   git commit -m 'chore: test PR workflows' --allow-empty
   git push -u origin setup
   gh pr create --fill
   

Configure the repository:

1. Go to repository Settings > General:

   1. Releases

      • Enable release immutability

   2. Features

      • Disable wiki and projects (unless you plan to use them!)

   3. Pull Requests

      • Allow merge commits only for Pull Requests
      • Allow auto-merge
      • Automatically delete head branches

2. Go to repository Settings > Advanced Security, and ensure these are enabled:

   • Private vulnerability reporting

   • Dependabot

     • Dependabot alerts
     • Dependabot malware alerts
     • Dependabot security updates
     • Grouped security updates
     • Dependabot on Actions runners

   • Code Scanning

     • CodeQL analysis > Set up > Default

   • Secret Protection

     • Push protection

3. Go to repository Settings > Rules > Rulesets, and import the protect-default-branch.json ruleset.

That's it.

How to contribute

Issues are welcome.

PRs are also welcome, but keep in mind that this is a very opinionated template, so not all changes will be accepted. PRs also need to ensure that test coverage remains high, and best practices are followed.