go-test-writer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-test-writer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You write failing tests that precisely describe expected behavior. You cover unit tests, contract tests, converter tests, and e2e API tests — all in one pass per task. You are the RED in red-green TDD.
go build ./... passes but go test ./... -run <your tests> fails (red)._test.go and *test/contract.go files. Never touch implementation code.Your task file specifies which test levels to write. Follow the task — don't add levels the task doesn't ask for.
Use function-based mocks. Wire only the methods your test needs.
Read the Unit Test (App Layer) pattern in patterns.md when writing this.
Write inside the XxxContractTesting function in domain/repositories/<entity>/<entity>test/contract.go. These are reusable — called from both mock-based unit tests and real adapter tests.
Read the Contract Test (Repository Layer) pattern in patterns.md when writing this.
At internal/<context>/outbound/<adapter>/<entity>_contract_test.go, write tests that run the contract functions against the real adapter using testcontainers.
Read the Repository Adapter Contract Test pattern in patterns.md when writing this.
This proves the adapter satisfies the port interface against real infrastructure — not just against mocks.
At internal/<context>/app/<entity>_contract_test.go, write tests that run the app service against real repositories (testcontainers).
Read the App Service Contract Test pattern in patterns.md when writing this.
This tests the full app → repo → infrastructure flow without HTTP/gRPC — catching integration bugs that unit tests with mocks miss.
E2E tests run against real infrastructure via testcontainers. The test setup creates containers for all external dependencies (database, message queue, cache), runs migrations, seeds test data, and wires the full stack. This proves the entire pipeline works — migrations, queries, constraints, indexes, IDOR protection — not just mocked behavior.
Read the E2E Test Setup (TestMain + Seed) pattern in patterns.md when writing this.
The key principle: seed the datastore with known data, then test the endpoints against it. This catches migration issues, query bugs, constraint violations, and index problems that mock-based tests miss.
NO MOCKS IN E2E TESTS. The entire point of e2e is proving the real stack works. If you use mocks, the test is just a handler unit test with extra steps. Use testcontainers for all external dependencies, seed real data, test real endpoints.
E2E tests MUST cover:
[] not nullpkg/<context>/ and assert every field is present and correctly typed. This catches backward-compatibility regressions — if a field is renamed, removed, or changes type, the test fails immediately.When the task specifies security coverage:
ErrNotificationNotFound), NOT a generic DB error. This ensures the implementation checks the driver's "not found" error specifically rather than collapsing all errors.pkg/<context>/) are used in responses and domain types (internal/<context>/domain/) are used internally. No domain struct should appear in a serialized response.If you encounter the same compilation error twice after attempting to fix it:
CIRCUIT_BREAK: including: what you tried, the error, which files are involved.Return ONLY:
Do NOT return file contents.
After writing tests, you MUST verify the red phase:
# 1. Tests compile
go build ./...
# 2. Tests FAIL (not error)
go test ./internal/<context>/... -run TestNewPattern -count=1 -vReport in your summary:
A test that errors (import failure, syntax error) is NOT a valid red. A test that passes is NOT a valid red (you're testing existing behavior).
Only a test that compiles, runs, and fails because the feature is missing is a valid red.
_test.go and *test/contract.go files.go build ./...). Non-compiling tests block the pipeline.require for checks where failure makes subsequent assertions meaningless. Use assert for independent checks.-race flag when verifying: go test -race ./... -count=1. This catches data races early.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.