No. The go command documentation says go generate is never run automatically by go build, go test and similar commands. It runs only when someone invokes it. A go:generate line can still run any local program, so read it before you run it, especially in code you did not write.
What a go:generate directive is
A directive is a comment line of the form //go:generate command argument.... The documentation describes the command as an executable that can be run locally. It must be in the shell path, a fully qualified path, or a command alias.
Typical uses are generating mocks, embedding assets, or producing code from a schema. The stated intent is to create or update Go source files. The mechanism itself is not limited to that. The documentation says the commands can run any process.
Why this is a safe default for dependencies
Because the tool is never run during a build, adding a module to your project does not execute its generate directives. A dependency's go:generate lines are only text in its source until a person runs go generate on that package.
That separates Go from ecosystems where install scripts run on download. We cover the related question in does go get run code from dependencies.
When it becomes a risk
The risk appears in your own workflow, not in the build.
- You clone a repository and run
go generate ./...to get it building. - A contributor's pull request adds a new directive and your CI job runs generate.
- A directive calls a tool installed with an unpinned version.
The documentation also notes that go generate does not parse the file. Lines that look like directives inside comments or multiline strings are treated as directives. A reviewer scanning only real code can miss one.
A review checklist
- Search for generate lines before running anything:
grep -rn "go:generate" . - For each one, name the program it runs and where that program comes from.
- Prefer tools pinned in go.mod or an exact version, as in is go install at latest safe.
- Run generate in a container or throwaway workspace when reviewing a repository you do not control.
- In CI, commit generated files and fail the job when a regeneration changes them, instead of regenerating with elevated credentials.
- Treat any pull request that edits a directive as a change to what runs on your machines.
Generated files and scanners
Generated Go source is ordinary source once committed, so it is built and scanned like the rest. Dependencies that a generator pulls in may appear only in a tool module, so check that those are recorded too.
Safeguard's dependency scanning reads go.mod, which keeps tool modules in the inventory. There is a free scan at gold.safeguard.sh/scan.
Quick check
If I add a dependency, will its go:generate lines run?
No. The Go documentation states go generate is never run automatically by go build, go test and so on. It must be run explicitly.
Can a go:generate line run something other than a code generator?
Yes. The documentation says the commands can run any process, although the intent is to create or update Go source files.
Sources
Last reviewed: 19 October 2026.
