go-testing-with-testify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-testing-with-testify (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a concrete behavior claim into useful Go test evidence. Preserve the repository's Go version, test framework, and supported execution environment.
production seam. A test request does not automatically authorize an unrelated production refactor, new dependency, or external service.
consequences. Do not edit files or require remediation to complete a review.
defect from a test-apparatus defect, then fix it when the request includes repair.
Use coding-guidance-go for production Go or non-testify tests. Preserve Ginkgo, Gomega, go-cmp-only, and other intentional stacks. Module bootstrap or test-tool installation is separate from test authoring.
Add tester-mindset when claims, oracles, or test strategy are still unclear. Add backend-guidance or backend-systems-guidance only when a service, repository, queue, or other backend boundary needs that design guidance. Use security first for a security-led review and add security-identity-access when its identity scope applies. Routine tests of an already-defined permission rule can remain here.
go.mod, fixtures, and relevantrepository instructions. Identify the Go and testify versions, local test command, helpers, and available dependencies.
Pure logic needs a unit check; protocol, query, serialization, or lifecycle behavior may need a real boundary. Passing checks support only their scope.
when cases share setup and assertions; use separate tests when they do not. Introduce helpers, fakes, mocks, or suites only for a concrete benefit.
claimed. For review, assess these choices without rewriting the tests.
go test ./path/to/pkg -run '^TestName$' -count=1. Add race checks, repetition, shuffle, or integration runs when the failure mode needs them.
Report the exact evidence and remaining uncertainty.
require for prerequisites whose failure makes later checks unsafe ormeaningless; use assert for independent checks. A fatal failure in a subtest stops that subtest, not its siblings.
require.*, t.Fatal, and t.FailNow only on the test goroutine.Return observations or errors from HTTP handlers and workers through a synchronized channel or result, then assert on the test goroutine.
ErrorIs or ErrorAs when error identity or type is the contract.Error presence alone is sufficient when that is all the contract promises. Assert text only when it is intended to be stable.
according to the contract. Exact float equality is valid for exact expected values; approximate computations need justified tolerances.
timestamps when relevant. Whole-struct equality is valid when the full value is the contract; do not discard meaningful fields merely to avoid failures.
protect required behavior; do not require every individual test to exercise both success and failure.
t.Helper() in helpers whose failures should identify their caller.Reject tautologies, mocks that replace the behavior being proved, and assertions that cannot detect a plausible defect in the stated claim. A no-error assertion can prove a narrow validation contract but does not prove that a user was stored or a file's contents are correct. Logs can be the oracle when logging itself is the requested behavior.
Prefer an existing cheap real harness when the risk is at that boundary:
httptest.NewServer;t.TempDir();virtual-time testing.
Use a fake for a simple owned collaborator; use testify/mock when argument, call-count, failure, or ordering expectations improve the test. Respect existing test seams. Do not introduce wrappers or containers solely to satisfy a generic mock rule, and do not contact live or metered services without authority.
Wire the double into the subject under test. Assert mock expectations after owned asynchronous calls finish, using cleanup when it must also run after a fatal test failure. Keep matchers specific to the promised interaction and avoid retaining mutable pointer arguments as if they were immutable snapshots.
t.Parallel() only after checking shared state, database schemas, ports,temporary paths, environment, current directory, and goroutine lifetimes. t.Setenv and t.Chdir cannot be used in parallel tests or with parallel ancestors; check helper availability against the supported Go version.
suite does not support parallel tests. Keep suites when theirscenario and lifecycle organization helps; do not migrate them for style alone.
variables where older semantics require it, not as mandatory modern boilerplate.
before test teardown; a deadline limits waiting but does not itself join work. t.Context() is available from Go 1.24 and cancels before cleanup.
Eventually only for agenuinely eventual observable state and synchronize shared reads.
testing/synctest for compatible in-process concurrentcode. Virtual time is not a replacement for real network or external-system evidence. Sleeps inside its virtual-time bubble differ from wall-clock delays.
outlive the assertion budget if its own I/O has no cancellation.
Reproduce one failing test with its original environment, then vary a relevant dimension: ordering, workers, parallelism, timing, or shared state. Use -race for suspected races and -count=N or -shuffle=on for repetition and order dependence; choose the package and run budget from the risk. A finite passing sample does not prove that a flake is impossible.
Distinguish a data race, product defect, fixture bug, resource leak, unsupported runtime, and external dependency failure. Fix causes without weakening the oracle. Quarantine only under the repo's accepted policy with a reason, owner, tracking reference, and revisit condition.
Stop when the changed claim has proportionate evidence and further similar tests would add little confidence. Report material untested behavior and the next useful check. A completed review may contain unresolved findings.
Return the claim, seam, cases, oracles, exact commands/results, and residual risk when they help assess the work; collapse these into a short note for a small edit.
Load only the detail relevant to the task:
async assertions, and helpers.
argument matching, pointer mutation, and ordering.
filesystem, clocks, and worker lifecycle examples.
subtests, Go-version constraints, and process-wide state.
review cases; distinguish static assessment from observed behavior.
source map, routing boundaries, and evidence limitations.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.