|
| 1 | +--- |
| 2 | +name: update |
| 3 | +description: Update Go dependencies, fix deprecations and security issues |
| 4 | +--- |
| 5 | + |
| 6 | +## Step 1: Check for Updates |
| 7 | + |
| 8 | +List all dependencies and check for available updates: |
| 9 | + |
| 10 | +``` |
| 11 | +go list -m -u all |
| 12 | +``` |
| 13 | + |
| 14 | +Review the output. Modules with `[v1.X.Y]` annotations have newer versions available. |
| 15 | + |
| 16 | +## Step 2: Update Dependencies |
| 17 | + |
| 18 | +Update all direct and indirect dependencies to their latest minor/patch versions: |
| 19 | + |
| 20 | +``` |
| 21 | +go get -u ./... |
| 22 | +go mod tidy |
| 23 | +go mod verify |
| 24 | +``` |
| 25 | + |
| 26 | +Then check for known vulnerabilities: |
| 27 | + |
| 28 | +``` |
| 29 | +go install golang.org/x/vuln/cmd/govulncheck@latest |
| 30 | +govulncheck ./... |
| 31 | +``` |
| 32 | + |
| 33 | +If govulncheck reports any findings, update the affected module to the fixed version it recommends and re-run until clean. |
| 34 | + |
| 35 | +## Step 3: Check for Deprecations & Warnings |
| 36 | + |
| 37 | +Run a full build and read ALL output carefully: |
| 38 | + |
| 39 | +``` |
| 40 | +go build ./... |
| 41 | +go vet ./... |
| 42 | +``` |
| 43 | + |
| 44 | +Look for: |
| 45 | +- Deprecated function/type usage (e.g. `io/ioutil`, `strings.Title`) |
| 46 | +- Vet warnings about incorrect format strings, unreachable code, struct tags |
| 47 | +- Build warnings about minimum Go version compatibility |
| 48 | + |
| 49 | +Also run staticcheck if available: |
| 50 | + |
| 51 | +``` |
| 52 | +go install honnef.co/go/tools/cmd/staticcheck@latest |
| 53 | +staticcheck ./... |
| 54 | +``` |
| 55 | + |
| 56 | +## Step 4: Fix Issues |
| 57 | + |
| 58 | +For each deprecation or warning found: |
| 59 | +1. Research the recommended replacement (e.g. `io/ioutil.ReadAll` → `io.ReadAll`) |
| 60 | +2. Update the code |
| 61 | +3. Re-run `go vet ./...` and `staticcheck ./...` |
| 62 | +4. Verify no warnings remain |
| 63 | + |
| 64 | +For security vulnerabilities: |
| 65 | +1. Update to the patched version `govulncheck` recommends |
| 66 | +2. If no patch exists, evaluate the risk and document it |
| 67 | +3. Re-run `govulncheck ./...` until clean |
| 68 | + |
| 69 | +## Step 5: Run Quality Checks |
| 70 | + |
| 71 | +Run the full project quality gate: |
| 72 | + |
| 73 | +``` |
| 74 | +go fmt ./... |
| 75 | +go vet ./... |
| 76 | +go test -race -cover ./... |
| 77 | +``` |
| 78 | + |
| 79 | +If golangci-lint is available: |
| 80 | + |
| 81 | +``` |
| 82 | +golangci-lint run ./... |
| 83 | +``` |
| 84 | + |
| 85 | +Fix all errors before completing. Coverage must remain at 100% on: |
| 86 | +- `pkg/output` |
| 87 | +- `internal/inngest` |
| 88 | +- `internal/common/config` |
| 89 | +- `internal/cli/commands` |
| 90 | + |
| 91 | +## Step 6: Verify Clean Build |
| 92 | + |
| 93 | +Clear module cache artifacts and verify everything resolves cleanly: |
| 94 | + |
| 95 | +``` |
| 96 | +go clean -cache -testcache |
| 97 | +go mod download |
| 98 | +go build ./... |
| 99 | +go test -count=1 ./... |
| 100 | +``` |
| 101 | + |
| 102 | +Confirm zero warnings and zero errors. Run `make build` to verify the final binary compiles. |
0 commit comments