The checks

care runs one check per gradable feature. Each runs only where it applies and skips itself otherwise, so a repo with no benchmarks skips the benchmark check and a non-Go repo skips the Go checks. This page describes each check, the feature key that disables it, and any options it reads. All keys go under care.yml, documented in full on the config file page.

Version control

Reports uncommitted files as a worklog, with a per-file line delta and relative age, ordered most-recently-touched. Disable it with the version_control feature key.

Build

Runs go build ./..., parses the compiler diagnostics, and locates each one. Any error fails the check. It carries no cap, so a transient non-compiling module in active development is weighted, not graded as a hard failure. Disable it with the build key.

Lint

Runs golangci-lint when a .golangci.* file governs the repo, and falls back to go vet plus gofmt -l otherwise. Pin the linter version through the tools.golangci-lint key. Disable the check with the lint key.

Dependencies

Checks the go mod tidy delta, flags replace directives, and runs go mod verify. It also reports the runtime floor the dependency graph forces. --fix runs a go mod tidy before checking. Disable it with the dependencies key.

Runtime

Compares the declared Go version against what the code needs and what the dependencies force. It is informational and never moves the grade. Disable it with the runtime key.

Docs

Measures exported-symbol doc-comment coverage through go/ast and warns below a threshold. Set the threshold with the docs check option min, a percentage such as "80". Disable the check with the docs key.

checks:
  docs:
    options:
      min: "80"

Tests

Runs go test ./... -json once per profile and reports per-package, file, and function coverage, untested packages, and the slowest tests. --coverage collects coverage and --race adds -race. Configure additional profiles under profiles.tests. Disable the check with the tests key.

Benchmarks

Runs go test -bench and is skipped instantly when the repo has no func Benchmark. It is informational by default (weight 0). Configure profiles under profiles.bench. Disable it with the benchmarks key.

Secrets

Scans for committed secrets with betterleaks over the working tree. The sec.secrets option history set to "true" also scans git history. A committed secret caps the grade, since it is a live exposure. Disable the check with the secrets key.

checks:
  sec.secrets:
    options:
      history: "true"

Vulnerabilities

Scans dependencies with govulncheck, keeps only called findings, and categorizes them so a CVE in the Go toolchain is shown but never fails the grade. Point at a specific database with the sec.vuln option db. A reachable vulnerability caps the grade. Disable the check with the vulnerabilities key.

checks:
  sec.vuln:
    options:
      db: "https://vuln.go.dev"