feat: add Go framework support#945
Open
sarahxsanders wants to merge 2 commits into
Open
Conversation
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Results will be posted here when complete. |
This was referenced Jul 22, 2026
sarahxsanders
force-pushed
the
posthog-code/go-framework-support
branch
from
July 22, 2026 20:41
6e5076c to
57700c0
Compare
Adds Go as a supported framework following the backend-framework pattern (Rails): - Integration.go enum entry at the end of the frameworks block, before the language fallbacks - GO_AGENT_CONFIG in src/frameworks/go/ — claims a go.mod with a module directive, gathers the go directive version as agent context, installs via go get github.com/posthog/posthog-go - goModulesPackageManager helper + FRAMEWORK_REGISTRY entry - bash-fence grammar for the go binary: get/build/vet/fmt/version/list plus go mod tidy/download/verify/graph/why; run/test/generate stay denied (arbitrary code execution), go mod edit stays denied (rewrites module requirements) - Pins framework: go on integration-go in the variant-resolution contract test, matching context-mill PR #267 which must release before this merges - Marks go.mod as a real framework target in the agentic manifest comment Generated-By: PostHog Code Task-Id: 9c949855-7611-48f2-b8b5-7aa4112543e5
sarahxsanders
force-pushed
the
posthog-code/go-framework-support
branch
from
July 22, 2026 20:43
57700c0 to
5b9202e
Compare
go build/vet were allowed by subcommand without inspecting flags, so `go build -toolexec=/tmp/x.sh` would run an arbitrary program on every build. Deny the -toolexec flag explicitly (both = and space forms) and add attack-corpus tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sarahxsanders
marked this pull request as ready for review
July 24, 2026 15:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related PRs:
mainand can merge on its own, in any order relative to the sibling Go/Elixir/Rust/Java framework PRs.Adds Go as a supported framework, following the backend-framework pattern (Rails):
Integration.goenum entry at the end of the frameworks block, before the language fallbacks — a Go repo with an embedded frontendpackage.jsonstill resolves to Go (covered by a new detection test)GO_AGENT_CONFIGinsrc/frameworks/go/— claims ago.modwith amoduledirective (a bare directory of.gofiles falls through); gathers thego 1.xdirective as agent context; installs viago get github.com/posthog/posthog-gogoModulesPackageManagerhelper +FRAMEWORK_REGISTRYentrygo: allowsget|build|vet|fmt|version|listandgo mod tidy/download/verify/graph/why;go run/test/generatestay denied (arbitrary code execution) andgo mod editstays denied (can rewrite module requirements to arbitrary sources)framework: goonintegration-goin the variant-resolution contract test, matching the context-mill PR aboveWhy: the wizard docs page lists Go as "Coming soon"; instead of removing the label (posthog.com#18797), we're making the wizard actually support it.
Verification:
pnpm build✅,pnpm test✅ (1536 tests, incl. new go detect + fence tests),pnpm fix✅Created with PostHog Code