If a go.mod file and vendor directory is present vendor is not used

[jasinner]

In Go 1.14 the default for go list was changed to detect the presence of a vendor directory automatically and use it for resolving dependencies. This library fails to do that for such a module.

We could detect the presence of go.mod and vendor/ and set GOFLAGS=-mod=vendor when both a present forcing go list to use the dependencies in the vendor/ directory to solve modules in go.mod. Eg cfg.Env = append(os.Environ(), "GOFLAGS=-mod=vendor") from go/packages#Config

[mcoops]

"This library fails to do that for such a module." Well I'm not convinced this is the behaviour we want here.

While yeah, it's quicker if we go off the vendor folder and in theory that's what we should be looking at but until 1.14 there's no checks to see if it's in sync with the go.mod file. For 1.13 what happens if there's a discrepancy between go.mod and the vendor directory? We go off the vendor directory and the go.mod specifies something completely differently?

As that is essentially the source of truth I think I'd be leaning towards keeping the default behaviour. Or shift to 1.14 where it's handled.

Thoughts?

[jasinner]

Keeping the default (current) behaviour means that we fail to capture any dependencies for a project where the go.mod has a dependency which doesn't actually resolve without the vendor directory. There a quite a few of them in OpenShift 4, and the culprit library was added to my PR as a testcase (openshift/api).
I guess another way we could go is first try without '-mod=vendor', and it is fails retry with '-mod=vendor'. But we need to take some action here as using this library on OpenShift 4 is causing many of the components to have no dependencies listed.