Skip to content
Snippets Groups Projects

Add Go guidelines to developer docs

Merged Philippe Lafoucrière requested to merge docs/go-standards into master
All threads resolved!
@@ -44,7 +44,7 @@ Remember to run
**[ULTIMATE]** on your project (or at least the [gosec
analyzer](https://gitlab.com/gitlab-org/security-products/analyzers/gosec)),
and to follow our [Security
requirements](https://docs.gitlab.com/ee/development/code_review.html#security-requirements).
requirements](../code_review.md#security-requirements).
Web servers can take advantages of middlewares like [Secure](https://github.com/unrolled/secure).
@@ -86,31 +86,34 @@ go lint:
```
Once [recursive includes](https://gitlab.com/gitlab-org/gitlab-ce/issues/56836)
will be available, we will be able to share job templates like this
become available, you will be able to share job templates like this
[analyzer](https://gitlab.com/gitlab-org/security-products/ci-templates/raw/master/includes-dev/analyzer.yml).
## Dependencies
Dependencies should be kept to the minimum. The introduction of a new
dependency should be argued in the Merge Request, as per our [Approval
Guidelines](https://docs.gitlab.com/ee/development/code_review.html#approval-guidelines).
Both License Management and Dependency Scanning should be activated on all
projects to ensure new dependencies security status and licence compatibility.
dependency should be argued in the merge request, as per our [Approval
Guidelines](../code_review.html#approval-guidelines). Both [License
Management](https://docs.gitlab.com/ee/user/project/merge_requests/license_management.html)
**[ULTIMATE]** and [Dependency
Scanning](https://docs.gitlab.com/ee/user/project/merge_requests/dependency_scanning.html)
**[ULTIMATE]** should be activated on all projects to ensure new dependencies
security status and licence compatibility.
### Modules
Since Go 1.11, a standard Dependency system is available behind the name [Go
Since Go 1.11, a standard dependency system is available behind the name [Go
Modules](https://github.com/golang/go/wiki/Modules). It provides a way to
define and lock dependencies for reproducible builds. It should be used
whenever possible.
There was a [bug on Modules
There was a [bug on modules
checksums](https://github.com/golang/go/issues/29278) in Go < v1.11.4, so make
sure to use at least this version to avoid `checksum mismatch` errors.
### ORM
We don't use Object-relational mapping libraries (ORMs) at GitLab (except
We don't use object-relational mapping libraries (ORMs) at GitLab (except
[ActiveRecord](https://guides.rubyonrails.org/active_record_basics.html) in
Ruby on Rails). Projects can be structured with services to avoid them.
[PQ](https://github.com/lib/pq) should be enough to interact with PostgreSQL
@@ -171,10 +174,10 @@ libraries for Go services. Currently it's vendored into two projects:
Workhorse and Gitaly, and it exports two main (but related) pieces of
functionality:
* [`gitlab.com/gitlab-org/labkit/correlation`](https://gitlab.com/gitlab-org/labkit/tree/master/correlation)
- for propagating and extracting correlation ids between services.
* [`gitlab.com/gitlab-org/labkit/tracing`](https://gitlab.com/gitlab-org/labkit/tree/master/tracing)
- for instrumenting Go libraries for distributed tracing.
* [`gitlab.com/gitlab-org/labkit/correlation`](https://gitlab.com/gitlab-org/labkit/tree/master/correlation):
for propagating and extracting correlation ids between services.
* [`gitlab.com/gitlab-org/labkit/tracing`](https://gitlab.com/gitlab-org/labkit/tree/master/tracing):
for instrumenting Go libraries for distributed tracing.
This gives us a thin abstraction over underlying implementations that is
consistent across Workhorse, Gitaly, and, in future, other Go servers. For
Loading