Go release

Skill bitwise-media-group/skills/plugins/golang/skills/go-release

Coding agent marketplace for skills used by the BitWise Media Group.

Install

npx -y skills add bitwise-media-group/skills --skill go-release

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Release engineering for Go projects — GoReleaser v2 with version ldflags into an internal/version package, SBOMs and multi-arch container images, tag-triggered GitHub Actions releases, CI running build/vet/test -race/govulncheck with SHA-pinned actions, and Dependabot coverage for gomod, tools, npm, and Actions. Use when adding GitHub Actions CI for a Go repository; writing a release workflow that publishes Go binaries, SBOMs, and multi-arch container images; setting up GoReleaser for a Go project; stamping version metadata into a Go binary at build time; or adding Dependabot coverage to a Go repo. Not for scaffolding a new Go project or its Makefile.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

4.1 KB, as published. Nobody here has run it

Go release engineering

Tag-driven releases: pushing a vX.Y.Z tag builds cross-platform archives, checksums, SBOMs, and multi-arch container images via GoReleaser. CI gates every push; Dependabot keeps everything — including the action pins — fresh. This layers on the layout and Makefile from the go-project skill.

1. Stamp version metadata into `internal/version`

// Package version exposes build metadata stamped into the binary at link time.
// Keep these as vars (not consts) so -ldflags "-X ..." can rewrite them; an
// unbuilt or `go run` binary reports the defaults.
package version

var (
	Version   = "dev"     // semver release tag, e.g. v1.2.3
	Commit    = "none"    // short git SHA
	BuildDate = "unknown" // RFC3339 UTC build timestamp
)

Both make build and GoReleaser inject the same vars at the same import path:

-ldflags "-s -w -X <module>/internal/version.Version={{ .Version }} ..."

Expose the metadata through --version output or a GET /version endpoint.

2. GoReleaser config

Copy templates/goreleaser.yaml to .goreleaser.yaml and replace the myapp / OWNER/REPO placeholders. What it encodes:

Static, reproducible binaries: CGO_ENABLED=0, -trimpath, -s -w, for linux + darwin × amd64 + arm64.
tar.gz archives shipping the LICENSE, a checksums.txt, and an SBOM per archive — generated by the syft pinned in tools/go.mod and invoked via go tool, so nothing needs to be on PATH.
A changelog that excludes docs: / test: / chore: / ci: conventional-commit prefixes.
dockers_v2 multi-arch images (buildx) pushed to GHCR with OCI annotations.

Validate locally with make snapshot (goreleaser release --snapshot --clean) — full build, no publish.

3. CI workflow

Copy templates/ci.yaml to .github/workflows/ci.yaml. Every push and pull request runs go build, go vet, go test -race, and govulncheck. Conventions:

The Go version comes from go.mod (go-version-file), never hard-coded in the workflow.
Every action is pinned to a full commit SHA with the tag in a trailing comment — a moved tag can never change what runs. Dependabot keeps the pins fresh.
permissions: contents: read — the default token does nothing else.

4. Release workflow

Copy templates/release.yaml to .github/workflows/release.yaml. It triggers on v* tags, checks out with fetch-depth: 0 (GoReleaser needs full history for the changelog), sets up QEMU + buildx for multi-arch images, logs into GHCR with the built-in GITHUB_TOKEN, and runs goreleaser release --clean — SBOMs come from the pinned syft via go tool, so there is no separate syft install step. Cutting a release is exactly: push a semver tag.

5. Dependabot

Copy templates/dependabot.yaml to .github/dependabot.yaml: daily checks with a 7-day cooldown, minor + patch bumps grouped into one PR per ecosystem (majors arrive as individual PRs). tools/go.mod gets its own gomod entry — Dependabot does not descend into nested modules — so developer-tool bumps never ride along with application dependency PRs, and the github-actions entry keeps the workflow SHA pins fresh. For the rationale behind each knob and the full ecosystem matrix (docker, docker-compose, uv, …), see reference.md.