golang-continuous-integration Skill for Claude Code: Go CI/CD with GitHub Actions

Makes Claude set up Go CI/CD on GitHub Actions: tests, linting, security scans, dependency bots, releases and Docker builds.

Installs: 40.2K; on skills.sh
Stars: 3.7K; on GitHub
Files: 18; besides SKILL.md
Updated: Nov 2026; last repo commit

golang-continuous-integration makes Claude write and improve GitHub Actions pipelines for Go projects. It bundles 16 ready-made files under assets, among them test, lint, security, integration, release and Docker workflows, Dependabot and Renovate config, three GoReleaser configs and a Codecov config.

It wires tools into a pipeline and does not decide what the findings mean. SKILL.md sends choosing security fixes to golang-security and dependency choices to golang-dependency-management. It lists go, goreleaser and gh as required programs.

Good for

Go maintainers setting up or fixing .github/workflows files
Teams adding security scanning, coverage gates or Dependabot to a Go repo
Anyone automating releases with GoReleaser or building Docker images

Install golang-continuous-integration

Claude Code

Copy this prompt.

Install the golang-continuous-integration skill in Claude Code. Run this command:

/plugin marketplace add samber/cc
/plugin install cc-skills-golang@samber

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route, not several. The README says the skills cross-reference each other and a subset gives a partial and potentially inconsistent view, so the plugin or the whole-set CLI command is the better choice. The plugin installs the repo's 46 skill folders; its manifest declares no hooks, commands or MCP servers. Claude Code names plugin skills /plugin-name:skill-name, so after the plugin install the full name is /cc-skills-golang:golang-continuous-integration. The samber/cc marketplace lists seven plugins; the second command installs only cc-skills-golang.

From the project README. Source.

What's in the skill

When it loads

GitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release pipelines, Docker build/push, repository security settings, and AI-driven PR review. Use when setting up or improving Go project CI, writing or fixing `.github/workflows/*.yml`, adding a linter or security scanner as a pipeline job, wiring automated dependency-update bots, or adding quality gates. Covers wiring tools into a pipeline, not the analysis they perform: do NOT use for choosing or interpreting security findings (→ See `samber/cc-skills-golang@golang-security` skill) or for choosing, upgrading, or auditing dependency versions (→ See `samber/cc-skills-golang@golang-dependency-management` skill).

Sections in SKILL.md

Action Versions
Quick Reference
Testing
Coverage Configuration
Integration Tests
Linting
golangci-lint Configuration
Security & SAST
CodeQL Configuration
Container Image Scanning
Dependency Management
Dependabot
Renovate (alternative)
Release Automation
Release Workflow
GoReleaser for CLI/Programs

Key facts

Author: samber (metadata.author in SKILL.md)
License: MIT (license field in SKILL.md)
Version: 1.4.2 (metadata.version in SKILL.md)
Installs on skills.sh: 40,169 as of 2026-11-02
GitHub stars: 3,749 for the whole samber/cc-skills-golang repo, 2026-11-02
Last repo commit: 2026-11-01
What is inside: 19 files including SKILL.md: 1 reference guide, 16 asset files, an evals file.
Needs: Programs named in the SKILL.md frontmatter: go, goreleaser, gh
Works in: Designed for Claude Code, Codex or similar harness, and for projects using Golang (compatibility field in SKILL.md)

What it includes

Add CI for the first time, or audit an existing pipeline
Setup generates workflows in the order test, lint, security, release. In Improve mode Claude reads the current workflow files first, finds gaps against the quick reference table, then proposes targeted additions.
Write · Setup and Improve modes
go test -race, -shuffle=on, coverage thresholds in codecov.yml
Says CI must run tests with -race, and shows a Go version matrix with fail-fast turned off.
Write · Test and coverage workflow
golangci-lint, govulncheck, gosec, CodeQL, Bearer, Trivy
Says golangci-lint must run on every pull request and govulncheck must run in CI.
Write · Lint and security workflows
Grouped update PRs, optional auto-merge workflow
Includes a Dependabot auto-merge workflow with a warning that it needs contents: write and pull-requests: write.
Write · Dependabot or Renovate
Configs for CLI programs, libraries and multi-binary repos
A release workflow limited to v* tag pushes plus three GoReleaser configs.
Write · GoReleaser
Multi-platform images to GHCR and Docker Hub with Trivy scanning
Needs DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets if you push to Docker Hub. Pull requests build but do not push.
Write · Docker build and push
A Claude Code review workflow and Copilot review instructions
Adds parallel review jobs for quality, correctness, security and depth. SKILL.md has a cost note: the review agents run concurrently on each pull request.
Write · AI-driven PR review
Branch protection, workflow permissions, secrets and environments
The repository security settings that the pipeline relies on.
Read · references/repo-security.md

From the official docs

Permissions

Medium risk

Claude can edit your Go files and run go and git commands while this skill is active. It also writes CI workflow files that can carry repository write permissions.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It writes CI files that get repository permissions
The workflows it adds can have write access: SKILL.md warns the auto-merge workflow needs contents: write and pull-requests: write, and release and Docker jobs publish to GitHub Releases and registries. Keep branch protection on and read each workflow before merging it. github.com
The AI review workflow spends API credits and runs npx on your CI runner
claude-code-review.yml uses anthropics/claude-code-action with secrets.ANTHROPIC_API_KEY, runs npx skills add https://github.com/samber/cc-skills-golang --skill '*' -y --copy in each job, and asks for pull-requests: write and id-token: write. A comment in the file says those permissions apply to the whole repository, not only the current pull request. SKILL.md adds a cost note: the review jobs run concurrently on every pull request. github.com
It edits files and runs commands in your project
The frontmatter lists Edit, Write and these shell commands: go:*, golangci-lint:*, git:*, goreleaser:*, gh:*. Work on a branch and read the diff before you commit. github.com
SKILL.md lists install commands for its tools
Its Dependencies list gives these commands, which download and build or install software on your machine if Claude or you run them: goreleaser: go install github.com/goreleaser/goreleaser/v2@latest; gh: brew install gh. Check each before approving. github.com
The Copilot route copies skills into your repo
SKILL.md tells you to run npx skills add https://github.com/samber/cc-skills-golang --agent github-copilot --skill '*' -y --copy and then ln -s .agents .copilot. github.com
The recommended plugin route installs the whole repo
The plugin route and the --all skills CLI command add all 46 skill folders in the repo, not only this one. The plugin manifest (.claude-plugin/plugin.json, version 2.0.1) declares a name, description, author, license and keywords, and lists no hooks, commands or MCP servers. The skills CLI docs say --all installs every skill into every agent it supports without prompts. github.com

Technical details

Talks to	Web fetch through your assistant (WebFetch). The AI review workflow calls the Anthropic API from your CI runner, and the Docker workflow pushes to GHCR and Docker Hub
Sign-in and keys	The skill itself names no key, but the workflows it writes read GitHub Actions secrets you create: ANTHROPIC_API_KEY in the AI review workflow (claude-code-review.yml) and DOCKERHUB_USERNAME and DOCKERHUB_TOKEN in the Docker workflow if you push to Docker Hub. Other workflows use the built-in GITHUB_TOKEN.
Scopes	Reads and edits files in your Go project Runs the shell commands listed in the allowed-tools field: go:, golangci-lint:, git:, goreleaser:, gh:*

Questions

What does golang-continuous-integration do?

It makes Claude write and improve GitHub Actions pipelines for Go projects: tests with the race detector, linting, security scans, coverage, Dependabot or Renovate, GoReleaser releases, Docker builds and AI-assisted pull request review.

How do I install golang-continuous-integration?

Install the whole golang set, not only this skill. The README calls the skills atomic, cross-referencing units and says a partial install gives a potentially inconsistent view. The install box lists the Claude Code plugin (/plugin marketplace add samber/cc, then /plugin install cc-skills-golang@samber), the skills CLI for the whole set or for this skill alone, and the README's Codex, Gemini CLI, Cursor and OpenCode routes. The README documents no Claude app route, so none is listed.

Do I need the other golang skills with golang-continuous-integration?

Installing the set is the safer choice. SKILL.md hands neighboring topics to other skills: golang-lint, golang-security, golang-testing, golang-dependency-management, golang-modernize. The README says to install the general-purpose skills together, and the whole-set install does that.

What does golang-continuous-integration need on my machine?

The frontmatter names these programs: go, goreleaser, gh. SKILL.md names no API key or account.

Is golang-continuous-integration safe?

It is instruction text plus workflow and config templates under assets. When you use it, Claude can edit files and run go, golangci-lint, git, goreleaser and gh commands in your project, as its frontmatter allows. The frontmatter also lists WebFetch, so pages Claude opens are read into your conversation. The workflows it writes can hold repository write permissions, and its AI review workflow uses an ANTHROPIC_API_KEY secret you create, so read each one before you merge it. Work on a branch, read the diff and approve commands you do not recognize.

golang-continuous-integration vs golang-security and golang-dependency-management?

This skill covers wiring tools into a pipeline. Its description says not to use it for choosing or interpreting security findings (golang-security) or for choosing, upgrading or auditing dependency versions (golang-dependency-management).

Does golang-continuous-integration work in Codex, Cursor or the Claude app?

The SKILL.md compatibility field says it is designed for Claude Code, Codex or a similar harness, and the README says the skills are built for Claude Code, Codex, Gemini, Copilot, Antigravity and Cursor. The install box covers Claude Code, Codex, Gemini CLI, Cursor, OpenCode and the skills CLI. The README documents no Claude app route.

Can it publish releases or push images by itself?

It writes workflow files that do. The release workflow it ships runs on v* tag pushes, and the Docker workflow pushes to GHCR and, with secrets you set, Docker Hub. Pull requests build images without pushing them. Nothing publishes until you commit and push the workflows.

Information

updated Nov 2, 2026

Repository: samber/cc-skills-golang
Folder: skills/golang-continuous-integration

samber/cc-skills-golang skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 7

cc-skills-golang README · github.com
skills CLI commands · github.com
cc-skills-golang plugin.json · github.com
samber/cc marketplace.json · github.com
Claude Code skills · code.claude.com
golang-continuous-integration SKILL.md · github.com
claude-code-review.yml · github.com