71 pages

go-tool-base

The underpinnings for any Go command-line tool, and (as a few of my projects now prove) for comprehensive web services too. It standardises the boilerplate and wiring you end up writing in every Go project, and puts config, logging, self-update, a DI container and the rest straight at your fingertips. Highly opinionated, and it makes some calls people will disagree with, but it works, and it works really well. The CLI it ships with is a big part of that: keeping a Go app built, updated and maintained becomes almost trivial.

Repository: gitlab.com/phpboyscout/go-tool-base Docs: gtb.phpboyscout.uk

Which CLI library should you start with?

You’ve decided to build a command-line tool. Good. And before you’ve written a single line of the thing it’s actually meant to do, you hit a decision that feels far more permanent than it should: which library parses the …

House rules

I’ve had a Gemini Pro subscription for about eighteen months. In that time it has researched a leisure battery and a diesel heater for the campervan conversion, generated a truly stupid number of pictures of my pets in …

The secret that wasn't on my branch

My CI went red on a secret I’d never committed. Not a close call, not a near-miss I’d half-forgotten about. gitleaks, the secret scanner, failed a merge request of mine on a private key that was not on my branch, was not …

I filed a feature request into my own framework

I’m building a tool called keryx, and the part of it that matters here is its studio: a browser app where the work happens, which saves everything you do into a git repository behind the scenes, the way a developer’s …

A stack trace is not an error message

The repair agent I’ve been building into go-tool-base narrates what it’s doing as it goes. It builds, it tests, it lints, it fixes, and it logs each step so I can watch it think. Mostly that log is a calm, readable …

The agent said SUCCESS. The linter disagreed.

There’s a repair agent inside go-tool-base now. When you run gtb generate command, it doesn’t just spit out a file and wish you luck. An agent takes the generated code, builds it, runs the tests, and fixes whatever it …

The cobra hook I was sure I'd enabled

It came out of an audit. I’d recently pointed a small army of review agents at the whole go-tool-base codebase, back before that became a political problem, and one of the findings was that a subcommand could quietly …

Sign your own binaries with go-tool-base, part 7: rotation and break-glass

Most signing guides stop the moment the first release goes out the door, which is a shame, because the question that keeps you up at night comes later: what do you do when the key has to change? Keys get rotated on a …

Sign your own binaries with go-tool-base, part 6: sign every release with GoReleaser

By now you’ve got all the pieces lying on the bench. A KMS key that signs but never hands over its private half (Part 2). A CI role you can assume over OIDC with no stored credentials (Part 3). A public key you’ve minted …

Sign your own binaries with go-tool-base, part 5: embed the key and require verification

By now you’ve got a public key your tool can publish off-platform: minted from a KMS-held private key in Part 4 and served over WKD. That’s half the trust loop. The other half lives inside the binary itself: the tool has …