go-performance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-performance (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Performance work in Go follows one rule: measure first. Intuition about bottlenecks is wrong roughly 80% of the time. Profile, hypothesise, change one thing, re-measure. The patterns in this skill apply only on hot paths — premature optimisation makes code worse without making it faster.
go test -bench, pprof, fgprof — never guess.The cycle is: define goal → write benchmark → measure baseline → diagnose → improve one thing → re-measure → commit with the diff.
# baseline
go test -bench=BenchmarkHotPath -benchmem -count=6 ./pkg/... | tee /tmp/report-1.txt
# (apply ONE change)
# compare
go test -bench=BenchmarkHotPath -benchmem -count=6 ./pkg/... | tee /tmp/report-2.txt
benchstat /tmp/report-1.txt /tmp/report-2.txtIf benchstat shows no statistically significant change, the optimisation didn't work — revert it. Keep the /tmp/report-*.txt files as an audit trail; paste the benchstat output in the commit body.
Read references/benchmarking-and-pprof.md for benchmark writing, pprof workflow, and b.Loop() (Go 1.24+).Before optimising any Go code, check that the bottleneck is actually in your process:
net.(*conn).Read or database/sql means external I/O is the limit.If the bottleneck is external (DB, downstream API, disk), fix that — query tuning, indexes, connection pools, caching. No Go-level change will help.
| Symptom (from pprof) | Action |
|---|---|
High alloc_objects / alloc_space | reduce allocations (preallocate, pool, struct fields) |
| One function dominates CPU profile | inline-friendly rewrite, avoid reflection, simpler algorithm |
| High GC% / OOM kills | tune GOMEMLIMIT, GOGC; reduce live heap |
| Goroutines blocked on I/O | concurrency, batching, connection pool tuning |
| Same computation many times | memoise / singleflight / cache |
| Wrong algorithm (O(n²) where O(n) exists) | fix algorithm before anything else |
| Mutex profile hot | reduce critical section, sharded locks, sync.Pool |
Read references/allocation-and-memory.md for allocation patterns, sync.Pool, struct alignment, and escape analysis.These are the small changes that consistently show up in profiles. Apply them when the symptom matches — not preemptively.
strconv over fmt for primitives// Bad — fmt parses a format string
s := fmt.Sprint(n)
// Good — direct conversion, ~2x faster, half the allocations
s := strconv.Itoa(n)| ns/op | allocs | |
|---|---|---|
fmt.Sprint(n) | ~143 | 2 |
strconv.Itoa(n) | ~64 | 1 |
[]byte conversions out of loops// Bad — allocates on every iteration
for i := 0; i < n; i++ {
w.Write([]byte("hello"))
}
// Good — convert once
hello := []byte("hello")
for i := 0; i < n; i++ {
w.Write(hello)
}About 7x faster in a tight loop.
// Bad — repeated growth, O(n) copies per growth
out := []Result{}
for _, x := range input {
out = append(out, transform(x))
}
// Good — zero reallocations
out := make([]Result, 0, len(input))
for _, x := range input {
out = append(out, transform(x))
}Slice capacity is exact: make([]T, 0, n) allocates exactly n slots. Map capacity is a hint about bucket count, but still avoids the worst rehashes.
| Time | |
|---|---|
| no capacity | ~2.48s |
| with capacity | ~0.21s |
About 12x faster on the synthetic benchmark.
strings.Builder for loop-built stringss += w in a loop is O(n²). Use strings.Builder, with Grow(n) when the final size is estimable.
*string, *int, *time.Time add indirection without saving anything — strings and time.Time are already small headers. Use pointers only for mutation, types ~128B+, types embedding sync primitives, or where nil is meaningful.
Read references/concrete-patterns.md for the full pattern catalogue with benchmark numbers.
| Anti-pattern | Why it hurts | Do this instead |
|---|---|---|
Optimising without pprof | wrong target, wasted effort | profile first |
Default http.Client for high-throughput callers | MaxIdleConnsPerHost: 2 bottleneck | configure Transport |
| Logging inside hot loops | prevents inlining, allocates even when disabled | slog.LogAttrs, gate by level |
panic/recover as control flow | stack trace allocation | error returns |
reflect.DeepEqual in production | 50-200x slower than typed comparison | slices.Equal, maps.Equal, bytes.Equal |
unsafe without a benchmark | rarely justified | benchmark + comment with numbers |
No GOMEMLIMIT in containers | OOM kills under load | set to ~80% of container limit |
/tmp/report-1.txt was captured before any change.benchstat output in the body.benchstat shows the change is statistically significant (p < 0.05).pprof) confirms the targeted hotspot actually moved.GOMEMLIMIT is configured for any containerised long-running process.Mechanical anti-patterns belong to CI:
gocritic — flags fmt.Sprint(x) for primitives, repeated allocations.prealloc — slices that could be preallocated.gocyclo / funlen — proxies for code that is hard to optimise.fieldalignment (go vet) — struct layout for memory reduction.benchstat, pprof workflow, b.Loop()sync.Pool, struct alignment, backing-array leaks~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.