# marmot check (/docs/commands/check) Check the workspace (every module of go.work, or the current module) the way gofmt, goimports, go vet, golangci-lint (with .golangci.yml when present), go fix, govulncheck, go mod tidy, cross builds and deadcode would, on one package graph in one process. Results are cached per package, so an unchanged tree is answered at once and an edit reanalyzes only what it affects. Prints one line per finding and one line per check; exits 1 when a gating check fails (modernize and deadcode only report). ```text title="Usage" marmot check [packages] [flags] ``` ## Examples [#examples] ```sh marmot check marmot check -changed marmot check -changed main -only vet,lint marmot check -json ./internal/... ``` `marmot check` runs the checks a project usually runs one by one in CI, in one process over one package graph. With no packages it checks every module of the `go.work`, or the current module. | Check | Reports | Fails the run | | --- | --- | --- | | `fmt` | files gofmt or goimports would change | yes | | `vet` | the analyzers of the installed `go vet` | yes | | `lint` | the golangci-lint standard set (staticcheck, errcheck, govet, ineffassign, unused) and the gosec file permission rules; reads a v2 `.golangci.yml` | yes | | `gopls` | what `gopls check` reports | yes | | `vuln` | vulnerabilities the code calls, as govulncheck finds them | yes | | `tidy` | a `go.mod` or `go.sum` that `go mod tidy` would change | yes | | `cross` | type errors on other targets: `-targets`, `scripts/platforms.txt` or `platforms.txt`, else linux, darwin and windows on amd64 and arm64 | yes | | `modernize` | what the `go fix` modernizers would change | no | | `exhaustive` | switches that miss values of an enum or types of a sealed interface; runs only when `-only` names it or `.golangci.yml` enables it | no | | `nil` | dereferences of pointers and writes to maps that can be nil | no | | `deadcode` | functions no program or test reaches | no | `-only` picks checks; `-changed [REF]` checks only the packages whose files changed since REF (by default `origin/main`, else `main`): ```sh marmot check -changed -only vet,lint ``` ## Caching [#caching] Results are cached per package, keyed by its files and what its dependencies export, so an unchanged tree answers at once and an edit reanalyzes only what it affects (`-nocache` turns this off). On a workspace of 10 modules and 204 packages, the full set takes 46 s from an empty cache (251 s for the same tools run one by one), 0.7 s when nothing changed and about 1 s after an edit, and stays under 2 GB of memory. ## JSON [#json] In JSON mode each finding is a `diagnostic` object with `check` and `analyzer` fields (codes [M0100](/docs/diagnostics/codes/m0100) to [M0110](/docs/diagnostics/codes/m0110)), then one `{"kind":"check","check":"lint","status":"failed","findings":3,...}` object per check, then the `result` line. ## Flags [#flags] Flags take one dash or two: `-release` and `--release` are the same. | Flag | Meaning | | --- | --- | | `-changed string` | check only what changed against a git ref (-changed alone: origin/main, else main) | | `-color string` | color in human output: auto, always or never (NO_COLOR turns auto off) (default "auto") | | `-details` | show every finding with its source and suggested fix | | `-j string` | parallel analysis jobs (default: the number of CPUs) (default "0") | | `-json` | machine readable output: JSON Lines on stderr (also $MARMOT_OUTPUT=json, and the default under coding agents) | | `-nocache` | analyze everything again, ignoring cached results | | `-offline` | no network: the vulnerability check is skipped | | `-only string` | run only these checks, comma separated: fmt,vet,lint,modernize,gopls,exhaustive,nil,vuln,tidy,cross,deadcode | | `-staged` | check exactly what git has staged (for a pre-commit hook), not the working tree | | `-tags string` | comma separated build tags | | `-targets string` | cross build targets, comma separated goos/goarch (default: scripts/platforms.txt, else linux, darwin and windows on amd64 and arm64) | | `-v` | print timing and cache statistics | | `-watch` | run again after every change to the files and report only new and resolved findings | ## Full help [#full-help] ```text title="marmot check --help" Check the workspace (every module of go.work, or the current module) the way gofmt, goimports, go vet, golangci-lint (with .golangci.yml when present), go fix, govulncheck, go mod tidy, cross builds and deadcode would, on one package graph in one process. Results are cached per package, so an unchanged tree is answered at once and an edit reanalyzes only what it affects. Prints one line per finding and one line per check; exits 1 when a gating check fails (modernize and deadcode only report). Usage: marmot check [packages] [flags] Examples: marmot check marmot check -changed marmot check -changed main -only vet,lint marmot check -json ./internal/... Flags: --changed string check only what changed against a git ref (-changed alone: origin/main, else main) --color string color in human output: auto, always or never (NO_COLOR turns auto off) (default "auto") --details show every finding with its source and suggested fix -h, --help help for check --j string parallel analysis jobs (default: the number of CPUs) (default "0") --json machine readable output: JSON Lines on stderr (also $MARMOT_OUTPUT=json, and the default under coding agents) --nocache analyze everything again, ignoring cached results --offline no network: the vulnerability check is skipped --only string run only these checks, comma separated: fmt,vet,lint,modernize,gopls,exhaustive,nil,vuln,tidy,cross,deadcode --staged check exactly what git has staged (for a pre-commit hook), not the working tree --tags string comma separated build tags --targets string cross build targets, comma separated goos/goarch (default: scripts/platforms.txt, else linux, darwin and windows on amd64 and arm64) --v print timing and cache statistics --watch run again after every change to the files and report only new and resolved findings ```