Buildkite Agent — Dependencies#

Module info#

• Module: github.com/buildkite/agent/v3
• Go version: 1.25.0 (toolchain go1.25.8)
• Direct dependencies: 65
• Indirect dependencies: ~240 unique modules (go.sum has 613 lines; each entry has two hash lines)

Dependency categories#

Core infrastructure#

• github.com/urfave/cli v1.22.17 — CLI framework for all agent subcommands (agent start, artifact upload, etc.)
• github.com/buildkite/roko v1.4.0 — Buildkite-owned retry/backoff library; used heavily in agent_worker.go for API polling and job retry logic
• github.com/buildkite/interpolate v0.1.5 — Pipeline environment variable interpolation (e.g. ${BUILDKITE_BRANCH})
• github.com/buildkite/shellwords v1.0.1 — Shell word splitting for command parsing
• github.com/buildkite/go-pipeline v0.16.0 — Pipeline YAML parsing and step graph modelling; defines the pipeline DSL
• github.com/buildkite/go-buildkite/v4 v4.17.0 — Buildkite REST API client (used for management operations, not job polling)
• github.com/buildkite/zstash v0.8.0 — Buildkite-owned zstd-compressed artifact stash library
• gopkg.in/yaml.v3 v3.0.1 — YAML parsing for pipeline files
• github.com/google/uuid v1.6.0 — UUID generation for job/session IDs
• github.com/denisbrodbeck/machineid v1.0.1 — Machine fingerprinting for agent registration
• github.com/dustin/go-humanize v1.0.1 — Human-readable sizes (artifact file sizes)
• github.com/dustinkirkland/golang-petname v0.0.0-20260215035315-f0c533e9ce9b — Random agent name generation (e.g. “silly-salamander”)
• github.com/puzpuzpuz/xsync/v2 v2.5.1 — High-performance concurrent map (agent state tracking)
• github.com/gofrs/flock v0.13.0 — File locking for the lock package (prevent duplicate agents)
• drjosh.dev/zzglob v0.4.2 — Glob pattern matching for artifact path patterns

Networking/HTTP#

• connectrpc.com/connect v1.19.1 — Connect RPC for the streaming ping/job dispatch protocol (bidirectional HTTP/2 streams replacing REST polling)
• github.com/go-chi/chi/v5 v5.2.5 — HTTP router for the Job API (local Unix socket HTTP server)
• golang.org/x/net v0.52.0 — Extended networking (HTTP/2 internals, proxy handling)
• golang.org/x/crypto v0.49.0 — SSH and TLS primitives
• github.com/gliderlabs/ssh v0.3.8 — Embedded SSH server (used in clicommand/bootstrap-server.go for debug shell access)
• golang.org/x/oauth2 v0.36.0 — OAuth2 token handling for GCP/GCS and Google APIs
• google.golang.org/api v0.273.0 — Google Cloud APIs (GCS artifact storage, GCP KMS signing)
• github.com/google/go-querystring v1.2.0 — URL query string encoding for Buildkite API requests
• github.com/creack/pty v1.1.24 — Pseudo-terminal allocation for process execution (log streaming, interactive jobs)

Cloud storage / artifact backends#

• github.com/aws/aws-sdk-go-v2 + config + s3 + kms + ec2 + imds + feature/s3/manager — AWS artifact storage (S3), artifact signing (KMS), EC2 instance metadata and tags for agent registration
• github.com/Azure/azure-sdk-for-go/sdk/azidentity + azblob — Azure Blob Storage artifact backend and Azure AD identity
• cloud.google.com/go/compute/metadata + kms — GCP compute metadata and Cloud KMS for artifact signing
• github.com/brunoscheufler/aws-ecs-metadata-go — ECS task metadata for container-based agent registration
• github.com/gowebpki/jcs v1.0.1 — JSON Canonicalization Scheme (used in artifact signature verification)
• github.com/lestrrat-go/jwx/v2 v2.1.6 — JOSE/JWT for OIDC token generation and artifact signing
• github.com/qri-io/jsonschema v0.2.1 — JSON Schema validation (pipeline step validation)
• github.com/Khan/genqlient v0.8.1 — Strongly-typed GraphQL client generator (tool dependency for Buildkite GraphQL API)
• google.golang.org/protobuf v1.36.11 — Protobuf runtime for Connect RPC messages
• buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go — Protobuf validation

Observability#

• go.opentelemetry.io/otel + sdk + trace + exporters/otlp/otlptracegrpc + otlptracehttp — OpenTelemetry tracing, OTLP gRPC and HTTP exporters
• go.opentelemetry.io/contrib/propagators/aws + b3 + jaeger + ot — Four trace context propagation formats (AWS X-Ray, Zipkin B3, Jaeger, OpenTracing)
• github.com/opentracing/opentracing-go v1.2.0 — Legacy OpenTracing API (compatibility layer alongside OTEL)
• gopkg.in/DataDog/dd-trace-go.v1 v1.74.8 — DataDog APM agent tracing
• github.com/DataDog/datadog-go/v5 v5.8.3 — DataDog StatsD metrics client
• github.com/prometheus/client_golang v1.23.2 — Prometheus metrics endpoint
• golang.org/x/term v0.41.0 — Terminal detection for log formatting
• github.com/fatih/color (indirect) — Colorized terminal log output

Testing#

• github.com/stretchr/testify v1.11.1 — Standard assertions and require package
• gotest.tools/v3 v3.5.2 — Additional assertions (assert.DeepEqual, golden file tests)
• github.com/buildkite/bintest/v3 v3.3.0 — Buildkite-owned binary test mock framework (replaces real executables in integration tests)
• github.com/google/go-cmp v0.7.0 — Deep comparison for complex struct diffing in tests

Other#

• github.com/oleiade/reflections v1.1.0 — Reflection-based struct field access (used in cliconfig to populate agent config from environment variables)
• github.com/pborman/uuid v1.2.1 — Legacy UUID library (likely preserved for API compatibility alongside google/uuid)
• golang.org/x/sync v0.20.0 — errgroup, singleflight for coordinated goroutine lifecycle
• golang.org/x/sys v0.42.0 — System calls (signals, process management on Linux/macOS/Windows)
• github.com/aws/smithy-go v1.24.2 — AWS SDK v2 transport and error types

Stdlib reliance#

The agent relies heavily on the standard library for its core loops. The most-used stdlib packages across the agent/, clicommand/, and api/ packages:

The project uses stdlib-first for process management (os/exec), file operations, and HTTP. Third-party deps fill gaps: retries (roko), cloud SDKs, and observability stacks that have no stdlib equivalent.

Shared dependencies#

Dependencies likely shared with other projects in the 50-repo set:

• github.com/stretchr/testify — Near-universal in Go projects
• github.com/prometheus/client_golang — Very common in infrastructure tools (Vault, Nomad, Consul, etc.)
• go.opentelemetry.io/otel — Increasingly standard; also in Dapr, k3s-era projects
• golang.org/x/sync — Common for errgroup and coordinated concurrency
• golang.org/x/crypto — Common for TLS and SSH handling
• golang.org/x/sys — Standard for OS-level syscall access
• github.com/google/uuid — Common identifier generation
• gopkg.in/yaml.v3 — Standard YAML library; used by Helm, k3s, etc.
• github.com/aws/aws-sdk-go-v2 — Shared with Vault, Terraform, Nomad for AWS backends
• connectrpc.com/connect — Newer; may be shared with other modern RPC projects

Vendoring#

Not vendored. No vendor/ directory exists. The project relies on the module proxy (sum.db, proxy.golang.org) for reproducibility. This is appropriate for a binary distribution project where Go modules provide sufficient reproducibility via go.sum verification. The go.sum file is committed and contains 613 lines (≈306 modules × 2 hash entries).

Notable dependency decisions#

1. In-house OSS ecosystem: Buildkite has published and maintains several of its own libraries — roko, shellwords, interpolate, go-pipeline, go-buildkite, bintest, zstash. This is unusual for a CI vendor and signals a mature Go team that prefers owning critical path libraries over accepting external dependencies.

2. Four observability stacks in one binary: The agent simultaneously ships OpenTelemetry (OTLP gRPC + HTTP), OpenTracing (legacy), DataDog dd-trace-go (APM), and DataDog statsd (metrics) + Prometheus. This is a conscious portability decision — different customers use different APM vendors — but results in significant binary size inflation and an unusually heavy transitive dependency tree from the DataDog agent packages alone.

3. Connect RPC over raw gRPC: Uses connectrpc.com/connect rather than google.golang.org/grpc directly for the streaming ping protocol. Connect supports HTTP/1.1 fallback, which is important for agents deployed behind corporate proxies that don’t support HTTP/2.

4. AWS SDK v2 modular packages: Takes fine-grained AWS SDK v2 modules (service/s3, service/kms, feature/s3/manager) rather than a monolithic SDK import, reducing binary size for deployments that don’t use all backends.

5. lestrrat-go/jwx for OIDC: Chose a dedicated JOSE/JWT library for OIDC token operations rather than the simpler golang-jwt/jwt, likely because OIDC requires full JWK support (key sets, key rotation) beyond basic JWT signing.

6. pborman/uuid legacy: Carries both pborman/uuid (older v1 UUIDs) and google/uuid — the former is likely a legacy dep from before the Google library was available or widely adopted, retained for API stability.