Skip to content

Commit fc0f13b

Browse files
monch1962monch1962
committed
feat: implement Phase 3 technical improvements
- Add comprehensive error handler with 12 error categories and user-friendly messages - Update Go, Elixir, and Python command runners with enhanced error handling - Implement security scanning for dependencies (gosec/govulncheck, safety/pip-audit, hex.audit) - Add integration tests and error handler test suite - Maintain backward compatibility while improving error reporting and security
1 parent ff6e6fb commit fc0f13b

14 files changed

Lines changed: 3872 additions & 424 deletions

‎commands/go-deps.md‎

Lines changed: 283 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,283 @@
1+
# /go-deps
2+
3+
Manage Go dependencies with Go-specific improvements.
4+
5+
## Description
6+
7+
The `/go-deps` command manages Go project dependencies including downloading, updating, tidying, and auditing. It provides intelligent dependency management with security scanning, dependency graph visualization, and Go module support.
8+
9+
## Usage
10+
11+
```bash
12+
/go-deps [action] [options]
13+
```
14+
15+
## Actions
16+
17+
| Action | Description |
18+
| ---------- | --------------------------------------------- |
19+
| `tidy` | Tidy go.mod file (add missing, remove unused) |
20+
| `download` | Download dependencies to module cache |
21+
| `vendor` | Vendor dependencies to vendor/ directory |
22+
| `verify` | Verify dependency integrity |
23+
| `graph` | Show dependency graph |
24+
| `why` | Explain why a package or module is needed |
25+
| `audit` | Security audit of dependencies |
26+
27+
## Options
28+
29+
| Option | Description |
30+
| ------------------------- | ---------------------------------------------- |
31+
| `--tidy`, `-t` | Run go mod tidy (default action) |
32+
| `--download`, `-d` | Download dependencies |
33+
| `--vendor`, `-v` | Vendor dependencies |
34+
| `--verify` | Verify dependencies |
35+
| `--graph` | Show dependency graph |
36+
| `--why` | Explain why package is needed |
37+
| `--package`, `-p PACKAGE` | Package for why/graph actions |
38+
| `--update` | Update to latest minor/patch versions |
39+
| `--update-all` | Update all dependencies |
40+
| `--dry-run` | Show what would be done without making changes |
41+
| `--verbose` | Verbose output |
42+
| `--security` | Security audit of dependencies |
43+
| `--audit` | Alias for --security |
44+
| `--help`, `-h` | Show help message |
45+
46+
## Examples
47+
48+
```bash
49+
# Tidy dependencies (default)
50+
/go-deps
51+
52+
# Download dependencies
53+
/go-deps download
54+
55+
# Vendor dependencies
56+
/go-deps vendor
57+
58+
# Show dependency graph
59+
/go-deps --graph
60+
61+
# Explain why a package is needed
62+
/go-deps why --package github.com/gorilla/mux
63+
64+
# Update dependencies
65+
/go-deps --update
66+
67+
# Security audit
68+
/go-deps --security
69+
70+
# Verbose tidy
71+
/go-deps tidy --verbose
72+
73+
# Dry run update
74+
/go-deps --update --dry-run
75+
```
76+
77+
## Dependency Management
78+
79+
### Go Modules
80+
81+
The command uses Go modules (`go.mod`) for dependency management. Key features:
82+
83+
- **Automatic version selection**: Go selects appropriate versions
84+
- **Minimal version selection**: Uses lowest compatible version
85+
- **Semantic versioning**: Supports v0, v1, v2+ modules
86+
- **Replace directives**: Local development overrides
87+
- **Exclude directives**: Exclude specific versions
88+
89+
### Common Operations
90+
91+
#### Tidy Dependencies
92+
93+
```bash
94+
/go-deps tidy
95+
```
96+
97+
- Adds missing dependencies
98+
- Removes unused dependencies
99+
- Updates go.mod and go.sum
100+
- Ensures consistent module state
101+
102+
#### Download Dependencies
103+
104+
```bash
105+
/go-deps download
106+
```
107+
108+
- Downloads to module cache
109+
- Verifies checksums
110+
- Caches for offline use
111+
- Supports proxy servers
112+
113+
#### Vendor Dependencies
114+
115+
```bash
116+
/go-deps vendor
117+
```
118+
119+
- Copies to vendor/ directory
120+
- Enables reproducible builds
121+
- Useful for CI/CD pipelines
122+
- Requires go mod vendor
123+
124+
#### Security Audit
125+
126+
```bash
127+
/go-deps --security
128+
```
129+
130+
- Checks for known vulnerabilities
131+
- Uses Go vulnerability database
132+
- Provides remediation advice
133+
- Can be integrated with CI/CD
134+
135+
## Security Features
136+
137+
### Vulnerability Scanning
138+
139+
- Checks against Go vulnerability database
140+
- Identifies affected versions
141+
- Suggests fixed versions
142+
- Provides CVE information
143+
144+
### Dependency Verification
145+
146+
- Verifies module checksums
147+
- Checks for tampered modules
148+
- Validates digital signatures
149+
- Ensures reproducible builds
150+
151+
### Best Practices
152+
153+
- Regular security audits
154+
- Keep dependencies updated
155+
- Use trusted modules
156+
- Review dependency changes
157+
158+
## Performance Tips
159+
160+
### Module Cache
161+
162+
- Dependencies cached in `$GOPATH/pkg/mod`
163+
- Shared across projects
164+
- Can be cleared with `go clean -modcache`
165+
- Proxy servers can accelerate downloads
166+
167+
### Vendor Directory
168+
169+
- Use for reproducible builds
170+
- Commit to version control for CI/CD
171+
- Update regularly with `go mod vendor`
172+
- Can be large for many dependencies
173+
174+
### Proxy Configuration
175+
176+
- Set `GOPROXY` environment variable
177+
- Use multiple proxies for reliability
178+
- Consider private proxies for internal modules
179+
- Offline mode with `GOPROXY=direct`
180+
181+
## Common Issues
182+
183+
### Version Conflicts
184+
185+
```bash
186+
# Check for conflicts
187+
/go-deps graph
188+
189+
# Update conflicting dependencies
190+
/go-deps --update
191+
192+
# Use replace directive in go.mod
193+
replace old/module => new/module v1.2.3
194+
```
195+
196+
### Missing Dependencies
197+
198+
```bash
199+
# Add missing dependencies
200+
/go-deps tidy
201+
202+
# Download specific version
203+
go get module@version
204+
205+
# Check why module is needed
206+
/go-deps why --package module
207+
```
208+
209+
### Build Failures
210+
211+
```bash
212+
# Verify dependencies
213+
/go-deps verify
214+
215+
# Clean module cache
216+
go clean -modcache
217+
218+
# Vendor dependencies
219+
/go-deps vendor
220+
```
221+
222+
## Integration
223+
224+
### CI/CD Pipelines
225+
226+
```yaml
227+
# GitHub Actions example
228+
- name: Manage Dependencies
229+
run: |
230+
/go-deps tidy
231+
/go-deps --security
232+
git diff --exit-code go.mod go.sum
233+
```
234+
235+
### Pre-commit Hooks
236+
237+
```bash
238+
#!/bin/bash
239+
# .git/hooks/pre-commit
240+
241+
# Check for uncommitted go.mod changes
242+
if ! git diff --cached --name-only | grep -q 'go.mod\|go.sum'; then
243+
/go-deps tidy --dry-run
244+
if [ $? -ne 0 ]; then
245+
echo "go.mod needs tidying. Run: /go-deps tidy"
246+
exit 1
247+
fi
248+
fi
249+
```
250+
251+
### Development Workflow
252+
253+
1. Add import to Go file
254+
2. Run `/go-deps tidy` to add dependency
255+
3. Run `/go-deps --security` to check safety
256+
4. Test with updated dependencies
257+
5. Commit go.mod and go.sum
258+
259+
## Related Commands
260+
261+
- `/go-build` - Build with dependencies
262+
- `/go-test` - Test with dependencies
263+
- `/go-fmt` - Format code (includes dependency-aware formatting)
264+
- `/go-lint` - Lint code (checks dependency usage)
265+
- `/go-setup` - Configure dependency management
266+
267+
## Environment Variables
268+
269+
- `GOPROXY` - Go module proxy (default: `https://proxy.golang.org,direct`)
270+
- `GONOPROXY` - Modules to not proxy
271+
- `GOSUMDB` - Checksum database (default: `sum.golang.org`)
272+
- `GONOSUMDB` - Modules to not checksum
273+
- `GOPRIVATE` - Private modules
274+
- `GOVCS` - Version control system settings
275+
276+
## Notes
277+
278+
- Requires Go 1.11+ for module support
279+
- go.mod and go.sum should be committed to version control
280+
- Security auditing requires network access
281+
- Vendor directory is optional but recommended for CI/CD
282+
- Regular dependency updates improve security
283+
- Consider using dependabot or similar for automated updates

0 commit comments

Comments
 (0)