Development and Contribution

Relevant source files

• .github/workflows/codeql-analysis.yml
• .github/workflows/dependency-review.yml
• .github/workflows/tests.yml

This page provides guidance for developers who want to contribute to the go-dota2 project. It covers the development workflow, testing procedures, continuous integration infrastructure, security practices, and dependency management. Contributors should familiarize themselves with these processes to ensure code quality and maintain project standards.

For detailed information about specific subsystems, see:

• Building and Testing — Explain the test workflow, Makefile targets, vendoring strategy, linting configuration, and running tests locally
• Security and Quality Workflows — Document CodeQL analysis, dependency review workflow, SHA-pinned actions, and security best practices
• Dependency Management — Explain the module dependency structure, go.sum integrity verification, and key dependencies like go-steam and protobuf libraries

Contribution Overview

The go-dota2 project follows a standard GitHub workflow with automated quality gates. All contributions must pass through continuous integration checks including linting, testing, security scanning, and dependency review before being merged.

The project is licensed under the MIT License, which permits modification, distribution, and commercial use with attribution.

Key Contribution Requirements:

Requirement	Description	Automated Check
Go Version	Go 1.26 or later	tests.yml
Code Formatting	Must pass golangci-lint	make lint
Test Coverage	All tests must pass	make test
Vendored Dependencies	Dependencies must be vendored	go mod vendor
Security Scanning	No CodeQL vulnerabilities	codeql-analysis.yml
Dependency Review	No vulnerable packages introduced	dependency-review.yml

Sources: .github/workflows/tests.yml19-20 .github/workflows/codeql-analysis.yml1-10 .github/workflows/dependency-review.yml19-20

Development Workflow

The typical contribution workflow involves:

1. Fork the repository and create a feature branch.
2. Set up the development environment with Go 1.26+ [.github/workflows/tests.yml:19-19].
3. Make changes and test locally using make lint and make test [.github/workflows/tests.yml:47-49].
4. Ensure dependencies are vendored with go mod vendor [.github/workflows/tests.yml:45-45].
5. Submit a pull request against the master branch [.github/workflows/tests.yml:8-8].
6. Address any CI/CD failures or review feedback.
7. Wait for automated checks to pass before merge.

Continuous Integration Workflow

When code is pushed or a pull request is created, the automated testing pipeline executes to validate the changes.

CI/CD Pipeline Execution Flow

Sources: .github/workflows/tests.yml1-50

Test Workflow Configuration

The primary testing workflow is defined in .github/workflows/tests.yml and executes on every push to master and every pull request [.github/workflows/tests.yml:4-8].

Workflow Characteristics:

• Runs on: ubuntu-latest [.github/workflows/tests.yml:16-16]
• Go Version Matrix: Go 1.26 [.github/workflows/tests.yml:19-19]
• Timeout: 10 minutes [.github/workflows/tests.yml:20-20]
• Permissions: Read-only contents [.github/workflows/tests.yml:11-12]
• Actions Pinned: All actions use SHA-based version pinning for security.

Caching Strategy:

The workflow implements aggressive caching to speed up builds by identifying GOCACHE and GOMODCACHE paths [.github/workflows/tests.yml:29-32]:

1. Go Build Cache: Keyed by go.sum hash [.github/workflows/tests.yml:33-37].
2. Go Module Cache: Keyed by go.sum hash [.github/workflows/tests.yml:39-43].

Sources: .github/workflows/tests.yml22-49

Security Infrastructure

The project implements automated security scanning to detect vulnerabilities and maintain supply chain integrity.

Security and Supply Chain Scanning

Sources: .github/workflows/codeql-analysis.yml1-65 .github/workflows/dependency-review.yml1-21 .github/workflows/tests.yml22-43

SHA-Pinned Actions

All GitHub Actions are pinned to specific commit SHAs rather than version tags to prevent supply chain attacks:

• actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd [.github/workflows/tests.yml:22-22]
• actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c [.github/workflows/tests.yml:24-24]
• actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae [.github/workflows/tests.yml:34-34]
• github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 [.github/workflows/codeql-analysis.yml:37-37]
• actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 [.github/workflows/dependency-review.yml:20-20]

Sources: .github/workflows/tests.yml22-43 .github/workflows/codeql-analysis.yml37-64 .github/workflows/dependency-review.yml20

Code Quality and Analysis

The project uses CodeQL for deep static analysis and vulnerability detection.

CodeQL Configuration:

• Trigger: Pushes to master, PRs, and a weekly schedule (Saturdays at 13:41 UTC) [.github/workflows/codeql-analysis.yml:4-10].
• Languages: Go [.github/workflows/codeql-analysis.yml:27-27].
• Permissions: Requires security-events: write to upload analysis results [.github/workflows/codeql-analysis.yml:22-22].

The analysis includes an Autobuild step that attempts to compile the Go source [.github/workflows/codeql-analysis.yml:50-51]. If autobuild fails, manual build steps can be configured [.github/workflows/codeql-analysis.yml:56-61].

Sources: .github/workflows/codeql-analysis.yml1-65

Dependency Management

Dependencies are managed through Go modules and validated during the CI process.

Key Aspects:

• Dependency Review: Pull requests trigger a scan of manifest files to surface known-vulnerable package versions [.github/workflows/dependency-review.yml:1-21].
• Vendoring: Dependencies are vendored via go mod vendor during tests to ensure build reproducibility [.github/workflows/tests.yml:45-45].
• Integrity: The go.sum file is used as a cache key for both build and module caches [.github/workflows/tests.yml:37-43].

For details, see Dependency Management.

Sources: .github/workflows/tests.yml33-45 .github/workflows/dependency-review.yml1-21