Could gomodguard be made to enforce 'go mod tidy' ?

[edwarnicke]

It is often helpful to insure that your go.mod and go.sum have been 'tidied' prior to commit upstream, is that something
gomodguard could be made to do?

[dpritchett]

I’d recommend that as a separate CI step. Not sure you want tools sneakily tidying your mods for you locally. I don’t know how else you could implement this without a delicate dance between git and go mod to verify that nothing has changed after rerunning go mod tidy on the CI server. Would love to be wrong on that though.

…

On Mon, Sep 28, 2020 at 1:43 PM Ed Warnicke ***@***.***> wrote: It is often helpful to insure that your go.mod and go.sum have been 'tidied' prior to commit upstream, is that something gomodguard could be made to do? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#3>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABEEDKKUR4U3OFPWVUQYODSIDKNZANCNFSM4R43F3WA> . --

___________________________ Daniel Pritchett 📨 daniel@dpritchett.net |📱 901-871-0139 | ✍🏻 dpritchett.net | 🐦 @dpritchett <https://dpritchett.net/>

[edwarnicke]

I... wasn't suggesting it do the go tidying (I agree... sneaky tools mucking with what you pushed in your PR is no good).

I was thinking about checking to make sure the go.mod was tidy (ie, matched what you would have if you ran go mod tidy.

As to approach... I have an existing shell based job here:
https://github.com/edwarnicke/exechelper/blob/master/.github/workflows/ci.yaml#L41

that does roughly what I'm describing.

If you still don't think it fits in gomodguard, that's cool :) But being able to check that you go.mod and go.sum are tidy does sort of feel like the kind of thing you'd want to guard in your go.mod ;)

[ryancurrah]

I'm not sure how this would work with -mod=readonly mode set which all CI should enable as good practice.

[ryancurrah]

Gave this request a bit of thought. This won't work due to how this linter works. It uses the go.mod file and checks if source files are importing blocked modules. It's not possible to bubble the results of a go mod tidy here on the same way especially since go mod tidy may change for indirect dependencies which we do not lint.