Continuous Integration

Continuous integration means a machine runs the same checks on every push, so a broken change is found before a person deploys it. For a Go service the pipeline is short.

The steps

1. test -z "$(gofmt -l .)". gofmt -l lists files that are not formatted; an empty list is the pass condition. Formatting stops being an argument in review.
2. go vet ./... reports mistakes the compiler accepts, such as a %d placeholder handed a string. ./... means this package and every package beneath it.
3. go test -race ./... runs the tests with the race detector, which reports two goroutines touching the same memory with no synchronisation between them.
4. go build ./..., then build the image and push it tagged with the commit hash, so a running image can always be traced back to source.

Why vet separately when test already vets

go test runs a high-confidence subset of vet before building the test binary. That subset is atomic, bools, buildtag, directive, errorsas, ifaceassert, nilfunc, printf, stdversion, stringintconv and tests; stdversion, which reports standard library symbols newer than the version in your go.mod, was added to the subset in Go 1.27. go vet ./... runs the full default set, and it also covers packages that have no tests at all.

What trips people up

The race detector requires cgo enabled, and a C compiler on everything except macOS, so a pipeline that sets CGO_ENABLED=0 for every step cannot even build the test binary. Set it to 0 on the release build step only. Tests under -race are slower and use more memory. Results are also cached: go test ./... may print (cached) and run nothing, and -count=1 is the documented way to force a real run.

// This file compiles. `go vet ./...` rejects it, which is the point:
// the second step of the pipeline catches what the first one cannot.
package main

import "fmt"

type order struct {
	id    int
	total string // money as a string, to avoid binary floating point
}

func main() {
	o := order{id: 7, total: "19.99"}
	// %d asks for a number and total is a string. The compiler is happy.
	// go vet: fmt.Printf format %d has arg o.total of wrong type string
	fmt.Printf("order %d total %d\n", o.id, o.total)
}

// Output:
// order 7 total %!d(string=19.99)

name: ci
on: [push]

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod   # one source of truth for the Go version
      - run: test -z "$(gofmt -l .)"
      - run: go vet ./...
      - run: go test -race ./...
      - run: go build ./...

  image:
    needs: check                  # only runs if every check passed
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v7
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        with:
          platforms: linux/amd64
          push: true              # shorthand for --output=type=registry
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

.PHONY: check
check:
	test -z "$(shell gofmt -l .)"
	go vet ./...
	go test -race -count=1 ./...
	go build ./...

.PHONY: image
image: check
	docker build --platform linux/amd64 -t app:$(shell git rev-parse --short HEAD) .