go-code-review by existential-birds/beagle
npx skills add https://github.com/existential-birds/beagle --skill go-code-review遵循以下顺序以避免误报并捕获版本特定的问题:
go.mod — 注意 Go 版本。这决定了哪些模式适用(循环变量捕获仅在 1.22 之前是问题,slog 从 1.21 开始可用,errors.Join 从 1.20 开始)。跳过不适用版本限制的检查。按以下格式报告发现的问题:
[文件:行号] 问题标题
严重性:严重 | 主要 | 次要 | 提示性
问题描述及其重要性说明。
| 问题类型 | 参考链接 |
|---|---|
| 缺失错误检查、包装、errors.Join |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 竞态条件、通道误用、goroutine 生命周期 | references/concurrency.md |
| 接口污染、命名、泛型 | references/interfaces.md |
| 资源泄漏、defer 误用、slog、命名 | references/common-mistakes.md |
_ = err)fmt.Errorf("...: %w", err))errors.Is/errors.As 而不是字符串匹配errors.Join 聚合多个错误(Go 1.20+)-er 约定any 而非 interface{}(Go 1.18+)any 或代码生成defer 关闭deferinit() 函数,采用显式初始化user.UserService → user.Service)slog 而非 log 进行结构化日志记录(Go 1.21+)return err)panicinterface{} 而非 any以下是可接受的 Go 模式 — 报告它们会浪费开发人员时间:
_ = err — 有解释地故意忽略错误any — 用于真正的泛型代码或与非类型化 API 的互操作//nolint 指令 — 当附有解释时可接受type Option func(*T) 与 With* 构造函数是惯用的sync.Pool — 在性能关键代码中减少分配压力时可接受context.Background() — 顶级调用的有效根上下文default 的 select — 非阻塞通道操作,故意的模式i、err、ctx、ok 是惯用的 Go仅在特定条件适用时标记这些问题:
| 问题 | 仅当以下情况时标记 |
|---|---|
| 缺失错误检查 | 返回的错误是可操作的(可以重试、记录或传播) |
| Goroutine 泄漏 | 该 goroutine 不存在上下文取消路径 |
| 缺失 defer | 资源在下一次获取或返回前未显式关闭 |
| 接口污染 | 接口有 > 1 个方法且仅有一个消费者 |
| 循环变量捕获 | go.mod 指定 Go 版本 < 1.22 |
| 缺失 slog | go.mod 指定 Go 版本 >= 1.21 且代码使用 log 包进行结构化输出 |
在报告任何问题之前,加载并遵循 review-verification-protocol。
每周安装数
101
代码仓库
GitHub 星标数
45
首次出现
2026年1月20日
安全审计
安装于
gemini-cli79
opencode79
codex77
claude-code76
github-copilot69
cursor68
Follow this sequence to avoid false positives and catch version-specific issues:
go.mod — Note the Go version. This determines which patterns apply (loop variable capture is only an issue pre-1.22, slog is available from 1.21, errors.Join from 1.20). Skip version-gated checks that don't apply.Report findings as:
[FILE:LINE] ISSUE_TITLE
Severity: Critical | Major | Minor | Informational
Description of the issue and why it matters.
| Issue Type | Reference |
|---|---|
| Missing error checks, wrapping, errors.Join | references/error-handling.md |
| Race conditions, channel misuse, goroutine lifecycle | references/concurrency.md |
| Interface pollution, naming, generics | references/interfaces.md |
| Resource leaks, defer misuse, slog, naming | references/common-mistakes.md |
_ = err without justifying comment)fmt.Errorf("...: %w", err))errors.Is/errors.As used instead of string matchingerrors.Join used for aggregating multiple errors (Go 1.20+)-er conventionany preferred over interface{} (Go 1.18+)any or code generationdefer immediately after creationdefer in loops without closure wrappinginit() functions avoided in favor of explicit initializationuser.UserService → user.Service)slog used over log for structured logging (Go 1.21+)return err)panic for recoverable errorsinterface{} instead of any in Go 1.18+ codebasesThese are acceptable Go patterns — reporting them wastes developer time:
_ = err with reason comment — Intentionally ignored errors with explanationany — For truly generic code or interop with untyped APIs//nolint directives with reason — Acceptable when accompanied by explanationtype Option func(*T) with With* constructors is idiomaticsync.Pool for hot paths — Acceptable for reducing allocation pressure in performance-critical codeOnly flag these issues when the specific conditions apply:
| Issue | Flag ONLY IF |
|---|---|
| Missing error check | Error return is actionable (can retry, log, or propagate) |
| Goroutine leak | No context cancellation path exists for the goroutine |
| Missing defer | Resource isn't explicitly closed before next acquisition or return |
| Interface pollution | Interface has > 1 method AND only one consumer exists |
| Loop variable capture | go.mod specifies Go < 1.22 |
| Missing slog | go.mod specifies Go >= 1.21 AND code uses log package for structured output |
Load and follow review-verification-protocol before reporting any issue.
Weekly Installs
101
Repository
GitHub Stars
45
First Seen
Jan 20, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
gemini-cli79
opencode79
codex77
claude-code76
github-copilot69
cursor68
代码安全审查清单:最佳实践与漏洞防范指南(含密钥管理、SQL注入防护)
1,700 周安装
context.Background() in main/tests — Valid root context for top-level callsselect with default — Non-blocking channel operation, intentional patterni, err, ctx, ok are idiomatic Go