mir-backend-go
SolidMake It Right (Go runtime tier). Go 1.25/1.26 runtime reliability footguns shared across every Go backend framework (Gin, Fiber, Echo, chi, stdlib net/http) — distinct from the generic backend gates and from any one framework's mechanics. Covers: goroutine leaks (the #1 Go reliability bug) and the runtime goroutineleak profile, context propagation and cancellation, data races and `go test -race`, channel ownership rules, goroutine-level panic recovery, the nil-interface/nil-pointer trap, defer-in-loop resource buildup, slice aliasing, error wrapping with errors.Is/As/AsType, sync.WaitGroup.Go, the Go 1.22 per-iteration loop-variable change and its go.mod gating, deterministic concurrency tests with testing/synctest, container-aware GOMAXPROCS, log/slog structured logging, and Go-level security mechanics (http.Server timeouts, net/http CrossOriginProtection, os.Root path containment, SSRF dialer control, module checksum verification, govulncheck). TRIGGER when the backend runtime is Go — sits between mir-backe
Install
Quality Score: 81/100
Skill Content
Details
- Author
- anantbhandarkar
- Repository
- anantbhandarkar/make-it-right
- Created
- 3 months ago
- Last Updated
- 1 weeks ago
- Language
- Python
- License
- Apache-2.0
Integrates with
Similar Skills
Semantically similar based on skill content — not just same category
mir-backend-go-gin
Make It Right (Gin module). Gin web framework reliability augmentation for Go backends. Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Gin library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: *gin.Context is request-scoped and pooled, so it must be copied with c.Copy() before any spawned goroutine touches it; passing *gin.Context as a context.Context silently drops cancellation unless engine.ContextWithFallback is set; binding and validation discipline (ShouldBindJSON, binding tags, a separate request struct, EnableDecoderDisallowUnknownFields); middleware ordering and graceful shutdown wiring (http.Server.Shutdown on SIGTERM); and Gin's insecure defaults - SetTrustedProxies defaults to 0.0.0.0/0 so c.ClientIP() is attacker-controlled, and gin-contrib/cors will emit credentials with a reflected origin. TRIGGER only when the Go backend uses the Gin framework - building, reviewing, or debugging a Gin handler, middleware, or router. SKIP for Fiber (mir-ba
mir-backend-go-echo
Make It Right (Echo module). Echo web framework reliability augmentation for Go backends, covering Echo v5 (current) and v4 (maintained). Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Echo library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: echo.Context comes from a sync.Pool and must never be retained past the handler or handed to a goroutine; the v4->v5 rewrite that AI mixes up (Context became a *echo.Context struct, Logger became *slog.Logger, HTTPErrorHandler's arguments swapped, e.Shutdown and e.Close removed in favour of StartConfig); Bind never validates, so a missing c.Validate ships unchecked input, and Bind merges path and query values into one struct, a mass-assignment path; middleware ordering and graceful shutdown; and Echo's insecure defaults - c.RealIP() trusts X-Forwarded-For unless IPExtractor is set, and middleware.Secure sends no HSTS or CSP. TRIGGER only when the Go backend uses the Echo framework - building, reviewing, or debuggi
mir-backend-python
Make It Right (Python runtime tier). CPython runtime reliability footguns that are shared across EVERY Python backend framework (FastAPI, Django, Flask, Celery) — distinct from the generic backend gates and from any one framework's mechanics. Covers: the GIL and the free-threaded build (PEP 703/779, officially supported since 3.14 but not the default), async-vs-sync 'coloring', blocking the event loop, choosing asyncio vs threads vs multiprocessing vs subinterpreters vs a worker queue, fork-safety of connection pools and the 3.14 forkserver default change, lazy annotations (PEP 649/749), serverless cold starts, dropped-task exceptions, and runtime-level security (unsafe deserialization, archive extraction, shell arguments, SSRF, packaging supply chain). TRIGGER when the backend runtime is Python — sits between mir-backend (generic) and the framework module (e.g. mir-backend-python-fastapi). SKIP for Node/JVM/Go/Rust/.NET/Ruby/PHP/BEAM runtimes (each has its own mir-backend-<runtime> tier), and for framework-l