Go

​

Code Analysis

​

.deepsource.toml

​

name

• Type: String
• Presence: mandatory
• Description: Shortcode of the analyzer.
• Example:

name = "go"

​

enabled

• Type: Boolean
• Presence: optional
• Description: Toggle whether this analyzer should be run.
• Example:

enabled = true

​

meta

• Type: Table
• Presence: mandatory
• Description: Any supported metadata to pass to the analyzer.
• Example:

[analyzers.meta]
  import_paths = ["github.com/deepsourcelabs/web-app/backend"]

import_paths

• Type: Array
• Presence: optional
• Description: The Go analyzer by default automatically populates import_paths by searching for any available package managers. To override this behavior, all the import paths in the repository should be mentioned in this array.
• Default Value: None
• Example:

import_paths = ["github.com/deepsourcelabs/web-app/backend"]

import_root

• Type: String
• Presence: mandatory
• Description: Repository source code will be placed in $GOPATH/src/{import_root}. If you haven’t yet migrated to Go Modules, you should configure import_root properly so that dependencies can be fetched for analysis.
• Default Value: None
• Example:

import_root = "github.com/deepsourcelabs/web-app"

skip_doc_coverage

• Type: Array
• Presence: optional
• Description: Specify which artifacts to skip when calculating documentation coverage.
• Available Value: file
  • file - Do not include file docs while calculating documentation coverage.
• Default Value: None
• Example:

skip_doc_coverage = ["file"]

dependencies_vendored

• Type: Boolean
• Presence: optional
• Description: If set to true the analyzer doesn’t install dependencies since they are already available in the vendor directory of the repository.
• Available Values: true, false
• Default Value: false
• Example:

[analyzers.meta]
dependencies_vendored = true

build_tags

• Type: Array
• Presence: optional
• Description: Specify the build tags with which the analyzer can determine whether a file should be included in the package. This prevents compilation-related issues due to the inclusion/exclusion of files based on tags (or constraints).
• Default Value: None
• Example:

build_tags = ["darwin"]

cgo_enabled

• Type: Boolean
• Presence: optional
• Description: Whether the analyzed packages will call C code using CGo. If the C code relies on external C libraries, they might not be present for analysis runs resulting in analysis failure. If your project does not use CGo, set the flag to false.
• Available Values: true, false
• Default Value: true
• Example:

cgo_enabled = false

import_path

• Type: String
• Presence: mandatory if import_paths is empty
• Description: The import path of the repository should be mentioned in this string.
• Default Value: None
• Example:

import_path = "github.com/deepsourcelabs/web-app/backend"

cyclomatic_complexity_threshold

• Type: String
• Presence: optional
• Description: Specify the acceptable risk category for your project as the threshold. All functions with complexity beyond this threshold will raise an issue. For example, setting the threshold to low will flag all functions that have a cyclomatic complexity of more than 5, while setting the threshold to critical will not flag any function.
• Available Values: low, medium, high, very-high and critical

• Default Value: medium
• Example:

[analyzers.meta]
cyclomatic_complexity_threshold = "high"

​

Sample config

version = 1

test_patterns = [
  "tests/*_test.go",
  "**/*_test.go"
]

[[analyzers]]
name = "go"
enabled = true

  [analyzers.meta]
  import_root = "github.com/deepsourcelabs/web-app"
  dependencies_vendored = false
  build_tags = ["darwin"]
  cgo_enabled = false

​

Dependency Installation

​

Code Coverage

​

go test

# Run your tests and generate coverage report
go test -coverprofile=cover.out

# Install 'deepsource CLI'
curl https://deepsource.io/cli | sh

# Set DEEPSOURCE_DSN env variable from repository settings page
export DEEPSOURCE_DSN=https://sampledsn@deepsource.io

# From the root directory, run the report coverage command
./bin/deepsource report --analyzer test-coverage --key go --value-file ./cover.out

# Run tests for a package
go test -coverprofile=cover.out ./somePackage

# Append coverage data in a separate file
cat cover.out >> coverage.out

# Run tests for another package
go test -coverprofile=cover.out ./someOtherPackage

# Combine the coverage data in the same way
cat cover.out >> coverage.out

# Install 'deepsource CLI'
curl https://deepsource.io/cli | sh

# Set DEEPSOURCE_DSN env variable from the repository settings page
export DEEPSOURCE_DSN=https://sampledsn@deepsource.io

# From the root directory, run the report coverage command
./bin/deepsource report --analyzer test-coverage --key go --value-file ./coverage.out

​

Code Formatter (Transformer)

​

gofmt

name

• Type: String
• Presence: mandatory
• Description: Shortcode of this transformer.
• Example:

name = "gofmt"

enabled

• Type: Boolean
• Presence: optional
• Description: Toggle whether this transformer should be run.
• Example:

enabled = true

​

gofumpt

name

• Type: String
• Presence: mandatory
• Description: Shortcode of this transformer.
• Example:

name = "gofumpt"

enabled

• Type: Boolean
• Presence: optional
• Description: Toggle whether this transformer should be run.
• Example:

enabled = true

​

Vulnerability Scanning

• go.mod
• go.sum