README
¶
Go Library Tools
golib provides a versioned repository contract for independently released Go
libraries. It validates canonical manifests, runs proportional quality gates
in task-owned environments, and owns generic service fixtures without copying
automation into every repository.
The prepared ecosystem-milestone release is v1.8.0; v1.7.2 remains the
current published release until the milestone tag is created. Consumer
repositories must use checksum-verified release binaries and immutable workflow
references.
Quick Start
go build -o ./bin/golib ./cmd/golib
./bin/golib config validate
./bin/golib repository check
make local-ci
A consumer keeps policy in .golib.yaml, module facts in modules.json,
package facts in packages.json, and source-specific evidence under
.verification/. Shared scripts and tool versions remain here.
Guarantees
- fast repository-local feedback with expensive checks selected by material risk;
- task-owned Go caches, temporary files, credentials, and service resources;
- no shell evaluation of repository configuration;
- strict schemas, deterministic ordering, bounded input, and fail-closed gates;
- central consumer catalogs and known-good compatibility selections without a fleet-wide dependency bundle; and
- immutable release and GitHub Actions consumption.
Start with the documentation index. See CONTRIBUTING.md for development, SECURITY.md for private reports, and SUPPORT.md for support channels.
Consumers composing independently released Golib modules should start at the Golib ecosystem index.
Compatibility
The required Go version is recorded in .go-version. Released
minor versions preserve documented CLI, configuration, workflow, and evidence
contracts according to DEPRECATION.md.
License
Go Library Tools is available under the MIT License.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
golib
command
Command golib validates and executes the shared Go library contract.
|
Command golib validates and executes the shared Go library contract. |
|
internal
|
|
|
buildinfo
Package buildinfo exposes immutable release identity injected at build time.
|
Package buildinfo exposes immutable release identity injected at build time. |
|
cli
Package cli implements the stable golib command-line contract.
|
Package cli implements the stable golib command-line contract. |
|
cohesion
Code generated by go generate; DO NOT EDIT.
|
Code generated by go generate; DO NOT EDIT. |
|
config
Package config loads and validates the repository-owned golib policy.
|
Package config loads and validates the repository-owned golib policy. |
|
consumers
Package consumers loads the maintained repository rollout inventory.
|
Package consumers loads the maintained repository rollout inventory. |
|
coverage
Package coverage validates Go coverage profiles against canonical production package inventory.
|
Package coverage validates Go coverage profiles against canonical production package inventory. |
|
docscheck
Package docscheck validates repository-owned Markdown navigation.
|
Package docscheck validates repository-owned Markdown navigation. |
|
evidence
Package evidence owns the durable, content-addressed verification record.
|
Package evidence owns the durable, content-addressed verification record. |
|
gates
Package gates orchestrates repository checks from canonical module policy.
|
Package gates orchestrates repository checks from canonical module policy. |
|
inventory
Package inventory loads and cross-validates canonical module and package manifests without deriving policy from the working tree.
|
Package inventory loads and cross-validates canonical module and package manifests without deriving policy from the working tree. |
|
mutation
Package mutation validates and executes exact mutation-testing campaigns.
|
Package mutation validates and executes exact mutation-testing campaigns. |
|
releasecheck
Package releasecheck validates immutable release metadata and required gates.
|
Package releasecheck validates immutable release metadata and required gates. |
|
repository
Package repository validates the standalone repository contract.
|
Package repository validates the standalone repository contract. |
|
repositoryfile
Package repositoryfile safely reads bounded repository-owned files.
|
Package repositoryfile safely reads bounded repository-owned files. |
|
services
Package services owns isolated lifecycle management for generic test services used by library verification.
|
Package services owns isolated lifecycle management for generic test services used by library verification. |
|
specification
Package specification validates specification decision registers and their executable conformance evidence.
|
Package specification validates specification decision registers and their executable conformance evidence. |
|
upgrade
Package upgrade plans and applies coordinated consumer tooling pin updates.
|
Package upgrade plans and applies coordinated consumer tooling pin updates. |