go get -mod=readonly updates go.mod

[davecheney]

What version of Go are you using (go version)?

% go version
go version devel +964fe4b80f Thu Apr 4 00:26:24 2019 +0000 darwin/amd64

Does this issue reproduce with the latest release?

yes

What did you do?

As part of my make test target I run

go get -mod=readonly honnef.co/go/tools/cmd/staticcheck

What did you expect to see?

go.mod is not modified

What did you see instead?

go.mod is modified.

This is a problem because I do not want to record the version of honnef.co/go/tools/cmd/staticcheck that was used in my go.mod file. I explicitly want to leave this version floating so that i automatically receive updates to that tool. I want to do this because this tool is not part of my project, its part of the tools I use to test my project, when they are updated, I want to receive those updates without go get dirtying go.mod every time I run my make check target

[cuonglm]

it's expected, as go get still be allowed to update go.mod, even with -mod=readonly, from go help modules:

If invoked with -mod=readonly, the go command is disallowed from the implicit
automatic updating of go.mod described above. Instead, it fails when any changes
to go.mod are needed. This setting is most useful to check that go.mod does
not need updates, such as in a continuous integration and testing system.
The "go get" command remains permitted to update go.mod even with -mod=readonly,
and the "go mod" commands do not take the -mod flag (or any other build flags).

[davecheney]

@cuonglm thank you for your reply.

1. go get -mod=readonly does not appear to exit as you described above. The command completes without error.
2. Please consider my use case

This is a problem because I do not want to record the version of honnef.co/go/tools/cmd/staticcheck that was used in my go.mod file. I explicitly want to leave this version floating so that i automatically receive updates to that tool. I want to do this because this tool is not part of my project, its part of the tools I use to test my project, when they are updated, I want to receive those updates without go get dirtying go.mod every time I run my make check target

Is there a way to achieve this without dirtying my local copy of go.mod ?

[cuonglm]

@davecheney

go get -mod=readonly does not appear to exit as you described above. The command completes without error.

It does if you use go build instead of go get. As the doc said, go command is disallowed, but go get is allowed.

Is there a way to achieve this without dirtying my local copy of go.mod ?

I don't know anyway in current version. Maybe you just run that go get, after doing your check, do:

git checkout go.mod go.sum

[davecheney]

Thank you for your reply

Doing a checkout of go.mod as part of my development workflow will make it impossible to run make check when I have updated other dependant modules. Is there a way to say "don't update go.mod"? Can I change permissions on the file? Will that work?

[cuonglm]

@davecheney how about disable go modules for that check only:

GO111MODULE=off go get honnef.co/go/tools/cmd/staticcheck

[davecheney]

Thank you. I think that will work, I'll try that.

…

On Fri, 5 Apr 2019 at 19:41, Cuong Manh Le ***@***.***> wrote: @davecheney <https://github.com/davecheney> how about disable go modules for that check only: GO111MODULE=off go get -mod=readonly honnef.co/go/tools/cmd/staticcheck — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#31273 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAcA7eZXyVpoC5nxF5IhJ0MxmvpcC65ks5vdww-gaJpZM4ceRLC> .

[bcmills]

The behavior of go get is intentional (see @rsc's comment in #26850 (comment)).

An option specifically for installing tools without affecting go.mod is discussed in #30515. If I understand correctly, that is exactly the use-case you describe here, so I'm closing this as a duplicate of #30515, but please do let me know if I've missed something.