Using Private Go Modules with golangci-lint in GitHub Actions

Intro

We're at a point in the software development evolution when everybody recognizes the importance of Continuous Integration (CI) in the Software Development Life Cycle - or at least I hope. To be honest, I can't remember a project I've worked on that didn't have at least a basic CI pipeline in place.

golangci-lint is an amazing open-source tool for CI in Go projects. Basically, it's an aggregator and a Go linters runner that makes life easier for developers. It includes all the well-known liners by default but also provides an easy way to integrate new ones.

============

Steps

In the following, we will go through the steps required for running golangci-lint via GitHub Actions for projects with private modules.

1. Setup personal access tokens in GitHub

That can be done in both, personal accounts and organizations - depending on where the code is.

You have to go to Settings -> Developer Settings and click on Generate new token button

In the page opened you can choose between a personal or an organisation account. Here depends on your use case. Is it the project inside your account or inside of an organization account?

Select the repository/repositories or even all the repositories (again, depending on your use case)

and grant Read-only access for Actions.

The access token will be shown. Copy it and keep it somewhere for the next step.

Now, let's go back to the repository where the GH Action should run. Go to Settings -> Security -> Secrets and variables

click on New repository secret, fill in the secret name, and paste the access token from the previous step

2. Setup GitHub Actions workflow

2.1. Add golangci-lint.yml to your workflows

If it is not already exists.

# source: https://github.com/golangci/golangci-lint-action?tab=readme-ov-file#how-to-use

name: golangci-lint
on:
  push:
    branches:
      - master
      - main
  pull_request:

permissions:
  contents: read
  # Optional: allow read access to pull request. Use with `only-new-issues` option.
  # pull-requests: read

jobs:
  golangci:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v4
        with:
          go-version: '1.21'
          cache: false
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
        with:
          # Require: The version of golangci-lint to use.
          # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.
          # When `install-mode` is `goinstall` the value can be v1.2.3, `latest`, or the hash of a commit.
          version: v1.54

          # Optional: working directory, useful for monorepos
          # working-directory: somedir

          # Optional: golangci-lint command line arguments.
          #
          # Note: By default, the `.golangci.yml` file should be at the root of the repository.
          # The location of the configuration file can be changed by using `--config=`
          # args: --timeout=30m --config=/my/path/.golangci.yml --issues-exit-code=0 

          # Optional: show only new issues if it's a pull request. The default value is `false`.
          # only-new-issues: true

          # Optional: if set to true, then all caching functionality will be completely disabled,
          #           takes precedence over all other caching options.
          # skip-cache: true

          # Optional: if set to true, then the action won't cache or restore ~/go/pkg.
          # skip-pkg-cache: true

          # Optional: if set to true, then the action won't cache or restore ~/.cache/go-build.
          # skip-build-cache: true

          # Optional: The mode to install golangci-lint. It can be 'binary' or 'goinstall'.
          # install-mode: "goinstall"

2.2. Add GOPRIVATE and GH_ACCESS_TOKEN environment variables.

The first one is to let the workflow know the private dependencies and the second one is to specify the access token created above.

...
jobs:
  golangci:
    name: lint
    runs-on: ubuntu-latest
    env:
+     GOPRIVATE: github.com/claudiunicolaa
+     GH_ACCESS_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v4
        with:
          go-version: "1.21"
          cache: false
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
...

2.3. Automatically include a GitHub access token in the URL when interacting with GitHub repositories

jobs:
  golangci:
    name: lint
    runs-on: ubuntu-latest
    env:
      GOPRIVATE: github.com/claudiunicolaa
      GH_ACCESS_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v4
        with:
          go-version: "1.21"
          cache: false
+     - run: git config --global url.https://$[e-mail]/.insteadOf https://github.com/
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3

============

Wrap-up

In this article, we learned how to use golangci-lint in GitHub Actions for projects with private modules. We went through the steps required to set up personal access tokens in GitHub and then used them to create repository secrets. We also added the required environment variables and created a workflow to run golangci-lint via GitHub Actions. By following these steps, you can now use golangci-lint to automatically check your Go projects for common coding mistakes and ensure that your code is consistent and maintainable.

Thank you for reading this article. I hope that the information provided here will help you use golangci-lint in GitHub Actions for your Go projects with private modules.

All the examples can be found in this repository

Good luck with your software development journey!