v0.12.0

Released: 2026-08-28 · full diff

Go 1.27 support, a framework-neutrality fix in the agents reference, and the repository hardening needed for the awesome-ai-plugins listing.

Nothing in this release changes an existing rule's meaning. The one correction — %w versus %v — landed in 0.11.0; here the changes are additive, plus one inverted drift signal that was quietly telling us the wrong thing.

---

Go 1.27

Go 1.27 shipped, and the version-gated catalog stopped at 1.26. For a skill whose first principle is "use every feature up to the project's go.mod version", that is a hole in the flagship mechanic, not a missing nice-to-have.

references/modern-go.md gains a Go 1.27+ section covering six features:

Feature	Use instead of
Generic methods (type parameters on methods)	a package-level generic helper, when the operation belongs to the type
encoding/json/v2 for new JSON code	encoding/json — existing code is left alone unless migration is asked for
Promoted embedded fields in composite literals	constructing the embedded struct explicitly
strings.CutLast / bytes.CutLast	LastIndex plus manual slicing
Standard-library uuid (RFC 9562, CSPRNG-backed)	a third-party package or a hand-rolled implementation
url.URL.Clone / url.Values.Clone	copying by hand

All six were verified by compiling against a real go1.27.0 toolchain rather than taken on trust from the upstream catalog.

Templates move with the policy. Per the skill's own go.mod rule (applications: latest, libraries: latest − 1):

• cli-simple, cli-cobra, game, mcp-server, webservice → go 1.27
• library → go 1.26

All six pass build, vet, test -race and golangci-lint with zero issues. Only go.mod changed — no dependency churn.

⚠️ If you copied the CI workflows, bump your linter pin. golangci-lint refuses to run when it is built with an older Go than the module's go directive, and go1.27 support landed in v2.13.0 — v2.12 cannot lint a go 1.27 module. Both .github/workflows/ci.yml and the shipped assets/ci/lint.yml now pin v2.13, and the stale comment claiming "v2.9.0+ is built with Go 1.26" was replaced with the actual rule plus a reminder to move the pin whenever the templates move.

references/repo-and-ci.md follows: the library CI matrix goes 1.25/1.26 → 1.26/1.27, the Dockerfile base golang:1.26 → golang:1.27, and the hardcoded-version counter-example is bumped so it stays one release behind the templates rather than two.

references/agents.md is now genuinely framework-neutral

The file declared itself "framework-agnostic by intent" and then spent its body presenting cloudwego/eino's API surface as universal — StatePreHandler[S], ProcessState, WithOutputKey, Graph[I, O], Compile(), CheckPointStore, SuperSteps (used as a plain noun, never defined), and a § Unified Agent interface shape that opened with "Every agent implements:" followed by eino ADK's exact interface, *AsyncIterator[*AgentEvent] and all.

Since SKILL.md routes any Go agent task here, a reader on Google ADK, LangChainGo or hand-written code was being told to implement types that exist in exactly one framework.

One checkable convention now runs through the file: principles live in the body, every eino identifier lives in a marked Eino spelling block or carries an inline eino: marker, and anything so marked is explicitly an illustration rather than a requirement.

Notable specifics:

• § Unified Agent interface shape → § Agent interface — what is actually required. What is mandatory is identity for discovery and event-driven, non-blocking return, each now justified concretely (a blocking call hides the trajectory and forecloses streaming UX). Eino's interface is shown as one realization, with three neutral alternatives named — iter.Seq2, a channel of events, a callback.
• "SuperSteps" is gone from the rule. The hazard is stated generally: agent runtimes execute nodes concurrently, so nodes in the same round can alias one Input. The term is defined once, in a marked block, with its Pregel provenance.
• MaxIterations → "an explicit iteration cap", keeping the warning that a framework's zero value often means unbounded.

The opinions did not soften. Type-aligned composition, bounded iterations and event-driven return are all still mandatory. This separates them from one vendor's spelling of them.

Closes #30. 247 → 336 lines.

Drift tracking: one signal was inverted

After JetBrains restructured go-modern-guidelines in August, this repo recorded that the per-version catalog "no longer exists upstream as readable markdown", concluded that modern-go.md owned it outright, and pinned the CLI-wrapper SKILL.md.

Half right. The catalog did not disappear — it changed format. It lives at internal/guidelines/guidelines.json (54 structured records; the repository is Apache-2.0), so it is still diffable, just not prose.

The consequence was worse than an inaccurate note: the pin fired on a plugin version bump and would have stayed silent had the guidelines themselves changed — which is exactly how Go 1.27 went unnoticed. The pin now tracks guidelines.json, so drift fires on content and stays quiet on version bumps. Notes in source-versions.json, SKILL.md's source-notes and modern-go.md's § Source are corrected to match.

Also reviewed and cleared this cycle:

• cloudwego/eino v0.9.15 → v0.9.17 — two internal compose bugfixes for checkpoint stream converters. agents.md teaches the Interrupt/Resume principle, not eino's checkpoint internals; nothing to fold in.
• README's donor list said go-sdk was pinned at v1.6.1; it has been v1.7.0 since 0.11.0.

The drift checker reports no drift across every tracked source.

Repository hardening

Work to meet the awesome-ai-plugins listing gate, which requires running hashgraph-online/ai-plugin-scanner-action and scoring ≥ 80/142 with no high or critical findings. It scored 79 with one critical; it now scores 94/142, verify 12/12, no high or critical findings.

• SECURITY.md — supported versions, private advisory reporting, and scope. Deliberately link-free: the links CI job runs lychee over **/*.md, and GitHub's advisory URLs 404 for anonymous requests.
• .github/workflows/plugin-scan.yml — runs on push, PR and dispatch; pinned to a commit SHA, needs no secrets, grants only contents: read.
• .github/dependabot.yml — tracks GitHub Actions and all six template go.mod files.
• All eight action references pinned to commit SHAs, each at the tip of the major already in use.
• .codexignore — keeps build output, local state and secret paths out of the bundle and out of a host agent's context.

One amusing side effect: the scanner's YARA rule for coercive prompt injection matched the literal phrase "hidden input" in engineering-policy.md and flagged it critical. A mutable global is now described as "an implicit, undeclared dependency" — which is better prose anyway.

Two finding classes are left unaddressed on purpose: the five unset optional interface asset URLs are worth zero points and break verify if filled in.

Dependencies

Dependency	Change
actions/checkout	4.4.0 → 7.0.1
actions/setup-go	5.6.0 → 7.0.0
golangci/golangci-lint-action	7.0.1 → 9.3.0
golangci-lint (pinned version)	v2.12 → v2.13 (required for go 1.27)
hajimehoshi/ebiten/v2 (game template)	→ 2.9.10
hashgraph-online/ai-plugin-scanner-action	1.2.522 → 1.2.530

Positioning

README now describes go-ultimate as an AI agent skill, not a Claude Code skill — it has shipped manifests for Codex, Cursor, Grok Build, Copilot CLI, OpenCode and ZCode for several releases.

---

Upgrading

Nothing to do for most users; installs pull the new version automatically.

Two things worth checking if you vendored parts of the skill:

1. If you copied assets/ci/lint.yml and your modules are on Go 1.27, bump the golangci-lint pin to v2.13 or the lint job fails with "language version used to build golangci-lint is lower than the targeted Go version".
2. If you scaffolded from a template and pinned an older Go, nothing breaks — the skill gates features on your go.mod, not on the template's.

No rules were removed or reversed, so guidance you have already applied stays correct.

v0.11.0

Harvest metalagman/agent-skills + Google/Uber style guides → v0.11.0 …

v0.10.0

go-ultimate v0.10.0

First release whose git tag matches the skill's declared version.

Changes

• Version bump 0.4.1 → 0.10.0 across all seven version-bearing locations (SKILL.md, README.md, and the five plugin manifests).
• Author metadata fixed: SKILL.md metadata.author is now Djarvur (was the placeholder go-ultimate-skill), aligning with the MIT copyright holder and the publishing entity named in every plugin manifest.
• Maintainers listed: metadata.maintainers now names Daniel Podolsky (@onokonem) and Olga Pichuzhkina (@vyhuholl).

Install

Claude Code, Codex, Cursor, Grok, Copilot CLI, OpenCode — pin to this tag (v0.10.0) or track main.

Full diff: #26

v0.1.1

Fill the coverage gaps in testing, policy and the modern-Go catalog (…

v0.1.0

Fill the coverage gaps in testing, policy and the modern-Go catalog (…