The Agent Skills Directory

[SAFE]: The skill provides templates for Go CI/CD pipelines that follow industry-standard security practices. It includes guidance on using tools like govulncheck, CodeQL, and Trivy for vulnerability scanning and SAST.
[SAFE]: The documentation explicitly warns against hardcoding credentials and provides instructions for using GitHub Actions Secrets and Environments.
[SAFE]: The skill advocates for the principle of least privilege, recommending that the default GITHUB_TOKEN be set to read-only and that elevated permissions (like contents: write) be explicitly scoped to specific jobs.
[SAFE]: The external tools and actions referenced (e.g., GoReleaser, GitHub Actions, golangci-lint) are well-known and trusted in the software development community.
[SAFE]: Repository security settings are thoroughly documented, providing users with the necessary information to secure their development workflows beyond just the CI files.

golang-continuous-integration