marmot check
Run vet, lint, format and the other code checks in one pass.
Check the workspace (every module of go.work, or the current module) the way gofmt, goimports, go vet, golangci-lint (with .golangci.yml when present), go fix, govulncheck, go mod tidy, cross builds and deadcode would, on one package graph in one process. Results are cached per package, so an unchanged tree is answered at once and an edit reanalyzes only what it affects. Prints one line per finding and one line per check; exits 1 when a gating check fails (modernize and deadcode only report).
marmot check [packages] [flags]Examples
marmot check
marmot check -changed
marmot check -changed main -only vet,lint
marmot check -json ./internal/...marmot check runs the checks a project usually runs one by one in CI, in one process over
one package graph. With no packages it checks every module of the go.work, or the current
module.
| Check | Reports | Fails the run |
|---|---|---|
fmt | files gofmt or goimports would change | yes |
vet | the analyzers of the installed go vet | yes |
lint | the golangci-lint standard set (staticcheck, errcheck, govet, ineffassign, unused) and the gosec file permission rules; reads a v2 .golangci.yml | yes |
gopls | what gopls check reports | yes |
vuln | vulnerabilities the code calls, as govulncheck finds them | yes |
tidy | a go.mod or go.sum that go mod tidy would change | yes |
cross | type errors on other targets: -targets, scripts/platforms.txt or platforms.txt, else linux, darwin and windows on amd64 and arm64 | yes |
modernize | what the go fix modernizers would change | no |
exhaustive | switches that miss values of an enum or types of a sealed interface; runs only when -only names it or .golangci.yml enables it | no |
nil | dereferences of pointers and writes to maps that can be nil | no |
deadcode | functions no program or test reaches | no |
-only picks checks; -changed [REF] checks only the packages whose files changed since REF
(by default origin/main, else main):
marmot check -changed -only vet,lintCaching
Results are cached per package, keyed by its files and what its dependencies export, so an
unchanged tree answers at once and an edit reanalyzes only what it affects (-nocache turns
this off). On a workspace of 10 modules and 204 packages, the full set takes 46 s from an empty
cache (251 s for the same tools run one by one), 0.7 s when nothing changed and about 1 s after
an edit, and stays under 2 GB of memory.
JSON
In JSON mode each finding is a diagnostic object with check and analyzer fields (codes
M0100 to M0110), then one
{"kind":"check","check":"lint","status":"failed","findings":3,...} object per check, then the
result line.
Flags
Flags take one dash or two: -release and --release are the same.
| Flag | Meaning |
|---|---|
-changed string | check only what changed against a git ref (-changed alone: origin/main, else main) |
-color string | color in human output: auto, always or never (NO_COLOR turns auto off) (default "auto") |
-details | show every finding with its source and suggested fix |
-j string | parallel analysis jobs (default: the number of CPUs) (default "0") |
-json | machine readable output: JSON Lines on stderr (also $MARMOT_OUTPUT=json, and the default under coding agents) |
-nocache | analyze everything again, ignoring cached results |
-offline | no network: the vulnerability check is skipped |
-only string | run only these checks, comma separated: fmt,vet,lint,modernize,gopls,exhaustive,nil,vuln,tidy,cross,deadcode |
-staged | check exactly what git has staged (for a pre-commit hook), not the working tree |
-tags string | comma separated build tags |
-targets string | cross build targets, comma separated goos/goarch (default: scripts/platforms.txt, else linux, darwin and windows on amd64 and arm64) |
-v | print timing and cache statistics |
-watch | run again after every change to the files and report only new and resolved findings |
Full help
Check the workspace (every module of go.work, or the current module) the way gofmt, goimports, go vet, golangci-lint (with .golangci.yml when present), go fix, govulncheck, go mod tidy, cross builds and deadcode would, on one package graph in one process. Results are cached per package, so an unchanged tree is answered at once and an edit reanalyzes only what it affects. Prints one line per finding and one line per check; exits 1 when a gating check fails (modernize and deadcode only report).
Usage:
marmot check [packages] [flags]
Examples:
marmot check
marmot check -changed
marmot check -changed main -only vet,lint
marmot check -json ./internal/...
Flags:
--changed string check only what changed against a git ref (-changed alone: origin/main, else main)
--color string color in human output: auto, always or never (NO_COLOR turns auto off) (default "auto")
--details show every finding with its source and suggested fix
-h, --help help for check
--j string parallel analysis jobs (default: the number of CPUs) (default "0")
--json machine readable output: JSON Lines on stderr (also $MARMOT_OUTPUT=json, and the default under coding agents)
--nocache analyze everything again, ignoring cached results
--offline no network: the vulnerability check is skipped
--only string run only these checks, comma separated: fmt,vet,lint,modernize,gopls,exhaustive,nil,vuln,tidy,cross,deadcode
--staged check exactly what git has staged (for a pre-commit hook), not the working tree
--tags string comma separated build tags
--targets string cross build targets, comma separated goos/goarch (default: scripts/platforms.txt, else linux, darwin and windows on amd64 and arm64)
--v print timing and cache statistics
--watch run again after every change to the files and report only new and resolved findings