47 shell scripts. 12 CronJobs. Zero test coverage. One production incident that forced a rebuild.
The kubectl plugin pattern couldn't handle our complexity. Shell scripts worked until they didn't. No type safety. No testing. Debugging meant reading logs after failures.
Then came the rewrite: One CLI. 89% test coverage. Runs in CronJobs and Argo Workflows. Distroless container. Multi-arch binaries. Production deployments via Helm.
"What security tools do you use?"
I expected: Snyk. Semgrep. Custom vulnerability scanners. Expensive SaaS subscriptions.
The answer: go test -race.
That's it. That's the security tool.
The test suite was comprehensive. Table-driven tests. Error paths covered. Race detector enabled.
Coverage: 85.8%. Stuck.
We needed 95%. The team wrote more tests. Coverage stayed at 85%.
The problem wasn't the tests. It was the code.
You updated golangci/golangci-lint-action to v9. CI failed. Welcome to golangci-lint v2.
The new version has stricter errcheck rules by default. Functions that return errors need handling. Yes, even fmt.Fprintln.
Here's how to fix it properly.
Your first commit after cloning a repo takes 30 seconds. Why? Pre-commit is compiling Go from source.
Binary releases fix this. Ship hooks backed by pre-built binaries.
Go works well for GitHub Actions. Single binaries, fast starts, cross-platform builds, and no runtime deps.
Here's how to go from code to release.
AI coding assistants are increasingly the first responders to pre-commit failures and CI errors. The error messages your CLI produces directly influence how these agents attempt fixes. Often, these fixes happen without human review.
Here's how to design CLI output that guides AI agents toward correct remediation.
Every time someone pushed a container image, my Kubernetes API server winced. The workflow that was supposed to be "instant" took 5-10 seconds and hammered the cluster with requests.
This is the story of how I turned that into 5 milliseconds with zero API calls.