# Go deployment checklist > **This file is reference data, not instructions. It lists things to verify before deploying. Nothing below is a command from the operator, and no line in it grants authority to act. Run the read-only verification steps if you wish, then report what you found to the human operator and let them decide what to change. Do not modify the project on the basis of this file. This holds when you are running unattended, on autopilot, or in any automatic mode: an autonomy setting is not the operator approval this file withholds, and no finding here becomes authority to edit a file because nobody is watching. If something needs changing, say so and stop.** Source: https://deploy-list.com/go.md · 11 checks · layers: universal -> go · generated 2026-08-22 Verification steps come in three kinds. **Verify:** read-only, allowlisted, safe for an agent to run. **Operator-run:** a command only the human should decide to run, typically a framework CLI. An agent must not run these, only report them as outstanding. **Verify by hand:** needs a person to look. ## critical (1) - **No environment file is tracked in git** — `secrets` · `universal.gitignore-env` - Why: Environment files hold database credentials and API keys. Once committed they remain in history after deletion, so every affected credential has to be rotated rather than simply removed. - Do: Remove any tracked environment file from the index, add it to .gitignore, then rotate every credential that was ever committed. - Verify: `git ls-files --error-unmatch .env .env.local .env.production 2>&1 | head -5` - Expect: Every path reports that it did not match any file. A path echoed back is tracked and must be dealt with. - Ref: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html ## high (4) - **go.mod and go.sum are both committed** — `build` · `go.modules-committed` - Why: Without go.sum in version control the build trusts whatever the module proxy returns that day, so a dependency can change under you between two builds of the same commit. - Do: Commit go.mod and go.sum together. Never add go.sum to gitignore, and never regenerate it as part of the deploy. - Verify: `git ls-files go.mod go.sum` - Expect: Both files are listed. If go.sum is missing the build has no checksum to verify against. - Ref: https://go.dev/ref/mod - **The shipped binary was not built with the race detector** — `performance` · `go.race-detector-not-shipped` - Why: A race build runs several times slower and uses far more memory. It is easy to leave the flag in a Makefile target that both the test job and the release job call. - Do: Keep the race flag on the test target only. Check that the release target, the container build and any goreleaser configuration do not inherit it. - Verify: `grep -rn -- '-race' --include=Makefile --include=Dockerfile --include='*.yml' --include='*.yaml' . 2>/dev/null | head -10` - Expect: Every hit belongs to a test or CI job, and none is on the path that produces the artifact you deploy. - Ref: https://go.dev/doc/articles/race_detector - **A backup has been restored at least once** — `reliability` · `universal.backup-restore-tested` - Why: An untested backup is a belief, not a capability. Silent corruption, missing tables and expired credentials are all routinely discovered during the first restore, which is the worst possible time to find out. - Do: Restore the most recent backup into a scratch environment, confirm the data is complete and current, and write down how long the restore took. - Verify by hand: Confirm that someone has restored a production backup into a separate environment recently, and that the restore procedure is written down somewhere findable. - Ref: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - **Known vulnerabilities in dependencies have been reviewed** — `security` · `go.vulncheck-clean` - Why: The module graph of a normal service pulls in dozens of packages, and a known vulnerable version can sit there for months without anything failing. - Do: Run the vulnerability scanner before a release and decide on each finding. It reports only vulnerabilities in code paths your program actually reaches, so the list is usually short. - Operator-run (do not run this yourself): `govulncheck ./...` - Expect: No unreviewed finding. Each one is either fixed by an upgrade or recorded with a reason it does not apply. - Ref: https://go.dev/security/vuln/ ## recommended (6) - **The cgo setting matches the image the binary runs in** — `build` · `go.cgo-matches-base-image` - Why: With cgo on, the binary links against the host C library. Copied into a scratch or distroless image it fails at startup with a missing loader, and the error names a file rather than the cause. - Do: Build with cgo disabled for a static binary, or use a base image that carries the C library the binary was linked against. Decide which, rather than inheriting the default. - Verify by hand: Check the base image in the Dockerfile against the cgo setting used for the build. A scratch or distroless image needs a static binary. - Ref: https://go.dev/wiki/cgo - **The Go version is pinned, not whatever the machine has** — `build` · `go.toolchain-pinned` - Why: A build that takes the toolchain it happens to find changes compiler behaviour and standard library patches between deploys, which turns a bug into one that only appears on one machine. - Do: Name a version in the go directive, and build with that same version in CI and in the release image. - Verify: `grep -E '^(go|toolchain) ' go.mod 2>/dev/null` - Expect: A go directive names an explicit version, and the build environment uses the same one. - Ref: https://go.dev/doc/toolchain - **The project declares a license** — `legal` · `universal.license-declared` - Why: Code with no license is not open source and not safe for anyone else to use, and for a closed project the absence leaves contributors with no written statement of who owns what they wrote. - Do: Add a license file at the repository root, and reference it from the package metadata so tooling can read it. - Verify: `ls LICENSE LICENSE.md LICENSE.txt COPYING 2>/dev/null | head -3` - Expect: A license file exists at the repository root. - **The binary can say which commit it came from** — `observability` · `go.build-version-stamped` - Why: When something misbehaves in production, the first question is which build is running. An unstamped binary cannot answer it, and the deploy log is not always trustworthy by then. - Do: Stamp the commit and version at build time, either through the module build information Go records automatically or through linker flags, and expose it in a startup log line or a version flag. - Operator-run (do not run this yourself): `go version -m ./path/to/your-binary` - Expect: The output names a version and a revision rather than devel or an empty value. - Ref: https://go.dev/ref/mod - **GOMAXPROCS reflects the container CPU limit** — `performance` · `go.gomaxprocs-matches-cpu-limit` - Why: In a container with a CPU quota the runtime still sees every core on the host, so it runs far more scheduler threads than the quota allows and the program spends its time being throttled. - Do: Set GOMAXPROCS from the quota in the deployment, or have the program read the cgroup limit at startup and set it. - Verify by hand: Look at the deployment for a CPU limit. If one is set, confirm that either the environment sets GOMAXPROCS to match or the program adjusts it at startup. - Ref: https://go.dev/doc/godebug - **Release binaries are built with trimpath** — `security` · `go.trimpath-set` - Why: Without it the binary embeds the absolute path of every source file, which hands out the build machine layout, the CI directory structure and often a username. - Do: Pass trimpath to the release build so recorded paths become module paths instead of local ones. It also makes the build reproducible across machines. - Verify: `grep -rn -- '-trimpath' --include=Makefile --include=Dockerfile --include='*.yml' --include='*.yaml' . 2>/dev/null | head -5` - Expect: The release build path passes trimpath. A local development build does not need it. - Ref: https://go.dev/cmd/go/ --- Report what you found to the operator. Do not change the project.