A Go tool, pinned like a dependency
go get -tool github.com/spin-stack/go-tools/cmd/<name>, then go tool <name>. The version
is in go.mod, so every developer and every CI run uses the same one.
Checks for what a green build doesn't prove.
Small Go tools the spin-stack repositories run from their go.mod. Each one fails CI with a specific finding and says how to resolve it.
Tests that would notice
Section titled “Tests that would notice”Passing tests and high coverage show that code ran. These tools check whether anything would fail if it were wrong.
mutateBreaks the code your change touched, one small edit at a time, and fails when the tests still pass. Coverage says a line ran; mutate says whether anything checks it.
testqualityFails on a test that cannot fail: no assertion, no t.Error, nothing that reaches the test. It counts as covered and proves nothing.
ctxlifeFails on a goroutine that uses its caller's context and outlives the call: its work is cancelled the moment the function returns.
refsFails when AGENTS.md or CLAUDE.md names a path, a task or a package the tree no longer has, so instructions don't point at things that are gone.
vulngategovulncheck as a gate: fails only on a vulnerability the code calls and that has a fix, the standard library included.
taskgateFails on a workflow step that is not one task. What CI does is written once, in the Taskfile, and a developer runs exactly the same thing.
What a build takes in, and what it ships
Section titled “What a build takes in, and what it ships”versionsEvery image digest, tarball checksum and commit a repository depends on, written once in versions.yaml. It says what is out of date, bumps it, and a test fails on a pin written anywhere else.
sfwpnpm as the one package manager, and every install through Socket Firewall Free, which refuses confirmed malware before it lands. A gate fails on npm, yarn, or an install that skips the firewall.
exposureWhat a repository would show the world if it were made public: every ref's commits, a pull request's head included, and its issues, comments and releases - read for secrets and for what is private without being one.
Provenance and SBOMsSLSA provenance and CycloneDX SBOMs from what a build actually read, a gate that fails on a workflow publishing without attesting, and Sigstore's trusted root for verifying offline.
How they fit in
Section titled “How they fit in”A finding says what to do
Each failure names the file and line, why it matters, and the fix. Where there are exceptions, they’re a comment with a reason, and a reason nothing needs any more fails too.
Held to themselves
This repository runs every gate on its own code. The example on the mutate page is a test here: if the output changes, CI fails before the page goes out of date.