golangci-lint Integration Guide

Integrate golangci-lint with Vulnetix. Run 100+ Go linters in parallel with native SARIF output for centralized vulnerability management.

Install & scan

$ go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
$ golangci-lint run --output.sarif.path=golangci-lint.sarif

Run golangci-lint in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install golangci-lint
  run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
- name: Run golangci-lint
  run: golangci-lint run --output.sarif.path=golangci-lint.sarif
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: golangci-lint
    path: golangci-lint.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under golangci-lint's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace golangci-lint. Keep running it. Vulnetix sits on top of golangci-lint (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

golangci-lint is strongest at its core category and also carries features in Secret Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What golangci-lint does well

• Go-native meta-linter that runs 100+ analyzers (staticcheck, govet, gosec, revive) in one parallel, cached pass with very low false positives
• Bundles gosec, which does AST/SSA security analysis for 50+ Go weakness classes mapped to CWE (hardcoded creds, weak crypto, SQL injection, command injection)
• First-class CI/editor integration and machine-readable output including native SARIF, JSON, Checkstyle, Code-Climate and JUnit-XML
• Deep Go type-aware analysis and autofix for many linters, tuned as the de-facto standard gate for Go repos

Where Vulnetix adds to it: Vulnetix ingests golangci-lint/gosec SARIF into its cross-scanner queue, dedups Go findings against SCA/container results, and layers EPSS/KEV/LEV exploit-intel prioritisation, reachability, versioned VEX and SSVC on top. It does not replace golangci-lint as the language-native Go linter; it consolidates and prioritises what golangci-lint produces alongside every other scanner.

No migration, no rip-and-replace. golangci-lint keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise golangci-lint results in Vulnetix

Upload golangci-lint SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

golangci-lint documentation ↗  ·  Source repository ↗

Wire golangci-lint into your CI/CD pipeline →