Pin golang CLI packages
Open
area/continuous integration
kind/task
- Dominant language
- Go
- Stars
- 927
- Forks
- 387
- Avg merge
- 15h 5m
- Merged PRs (30d)
- 36
Description
We are using several golang CLI (gotestfmt/deadcode/goimports/govulncheck/yq) with `@latest`. We should move them to a pinned version instead for security reasons.
Contributor guide
No contributing guide indexed for this repository
Research direction
Search the repository for gotestfmt, deadcode, goimports, govulncheck, yq, and their @latest references to find the CLI package declarations. Pin each package to an explicit version, then run the relevant build or dependency checks; done means none of these CLI tools still resolves from @latest.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security, tooling
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100