README
¶
Go Library Tools
golib provides one strict, versioned repository contract for independently
released Go libraries. It validates canonical manifests, runs quality gates in
task-owned environments, preserves content-addressed verification evidence,
and owns generic service fixtures without copying automation into every
repository.
The current stable release is v1.5.5. Consumer repositories must use
checksum-verified release binaries and immutable workflow references.
Quick Start
go build -o ./bin/golib ./cmd/golib
./bin/golib config validate
./bin/golib repository check
./bin/golib check --all
A consumer keeps policy in .golib.yaml, module facts in modules.json,
package facts in packages.json, and source-specific evidence under
.verification/. Shared scripts and tool versions remain here.
Guarantees
- exact production-package coverage and mutation requirements;
- task-owned Go caches, temporary files, credentials, and service resources;
- no shell evaluation of repository configuration;
- evidence keyed by behavior-affecting content rather than Git history;
- strict schemas, deterministic ordering, bounded input, and fail-closed gates;
- auditable specification decisions with executable evidence and monitored authoritative errata or release feeds;
- immutable release and GitHub Actions consumption.
Start with the documentation index. See CONTRIBUTING.md for development, SECURITY.md for private reports, and SUPPORT.md for support channels.
Consumers composing independently released Golib modules should also read the versioned Golib ecosystem design language.
Compatibility
The required Go version is recorded in .go-version. Released
minor versions preserve documented CLI, configuration, workflow, and evidence
contracts according to DEPRECATION.md.
License
Go Library Tools is available under the MIT License.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
golib
command
Command golib validates and executes the shared Go library contract.
|
Command golib validates and executes the shared Go library contract. |
|
internal
|
|
|
buildinfo
Package buildinfo exposes immutable release identity injected at build time.
|
Package buildinfo exposes immutable release identity injected at build time. |
|
cli
Package cli implements the stable golib command-line contract.
|
Package cli implements the stable golib command-line contract. |
|
cohesion
Code generated by go generate; DO NOT EDIT.
|
Code generated by go generate; DO NOT EDIT. |
|
config
Package config loads and validates the repository-owned golib policy.
|
Package config loads and validates the repository-owned golib policy. |
|
consumers
Package consumers loads the maintained repository rollout inventory.
|
Package consumers loads the maintained repository rollout inventory. |
|
coverage
Package coverage validates Go coverage profiles against canonical production package inventory.
|
Package coverage validates Go coverage profiles against canonical production package inventory. |
|
docscheck
Package docscheck validates repository-owned Markdown navigation.
|
Package docscheck validates repository-owned Markdown navigation. |
|
evidence
Package evidence owns the durable, content-addressed verification record.
|
Package evidence owns the durable, content-addressed verification record. |
|
gates
Package gates orchestrates repository checks from canonical module policy.
|
Package gates orchestrates repository checks from canonical module policy. |
|
inventory
Package inventory loads and cross-validates canonical module and package manifests without deriving policy from the working tree.
|
Package inventory loads and cross-validates canonical module and package manifests without deriving policy from the working tree. |
|
mutation
Package mutation validates and executes exact mutation-testing campaigns.
|
Package mutation validates and executes exact mutation-testing campaigns. |
|
releasecheck
Package releasecheck validates immutable release metadata and required gates.
|
Package releasecheck validates immutable release metadata and required gates. |
|
repository
Package repository validates the standalone repository contract.
|
Package repository validates the standalone repository contract. |
|
repositoryfile
Package repositoryfile safely reads bounded repository-owned files.
|
Package repositoryfile safely reads bounded repository-owned files. |
|
services
Package services owns isolated lifecycle management for generic test services used by library verification.
|
Package services owns isolated lifecycle management for generic test services used by library verification. |
|
specification
Package specification validates specification decision registers and their executable conformance evidence.
|
Package specification validates specification decision registers and their executable conformance evidence. |
|
upgrade
Package upgrade plans and applies coordinated consumer tooling pin updates.
|
Package upgrade plans and applies coordinated consumer tooling pin updates. |