Provide indication in the PR body when "go get" updates go.mod

[rarkins]

Describe the proposed change(s).

In the gomod manager, it works like this:

• Renovate will update one or more lines in the go.mod
• Renovate calls "go get" to synchronize the go.sum
• "go get" may update both go.mod and go.sum. Renovate commits both

The above is correct and desirable.

The problem with this is that the PR description of what Renovate intended to update may be less than what was actually updated.

As a minimum, Renovate should display a warning that go.mod was updated by "go get" and for reviewers to check the files.

This could be followed later (by another feature request) a more detailed parsing/summary of what exactly changed.

[rarkins]

Slight complication: for v0.0.0 digest updates we intend for go to "fix" the modified line for us. So we can't purely flag if the file was modified by go get and need to be a little smarter

[rarkins]

Also we need to make sure that this warning persist across jobs and isn't reset by the updatePr() command later. We could add a PR comment to make sure, like we do with artifacts errors, but we'd be better to have it in the PR body below the table

[rarkins]

Here is how to reproduce it in theory:

• Add dependency A to a go.mod, which has a transitive dependency B
• Change B to be a direct dependency so that now the go.mod has two direct dependencies - A and B
• Now wait for A to have an update where it also bumps the version of B
• Let Renovate update A

What we should see is that Renovate says it's updating only A, but go get will also update B too

[zharinov]

Reproduction repo:

• https://github.com/renovate-testing/test-27775-go-get-multiple-deps

In particular:

• Update module github.com/jinzhu/configor to v1.2.2 renovate-testing/test-27775-go-get-multiple-deps#1

[rarkins]

Alternative suggestion: return a warning from updateArtifacts, and add a new Artifacts Update Warning comment (similar to we do with errors) so that it persists across runs until another commit is done.

It can say: "Changes to the go.mod file were detected when running go get to update checksums. This may mean that more dependencies may be updated in this PR than is listed in the change table above. Please review the diff of this PR to ensure it's OK".

[zharinov]

Alternative suggestion: return a warning from updateArtifacts, and add a new Artifacts Update Warning comment (similar to we do with errors) so that it persists across runs until another commit is done.

So, this isn't something that is currently implemented?

[rarkins]

I think we support errors only and not warnings

[renovate-release]

🎉 This issue has been resolved in version 37.378.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)
• 37.378.0

Your semantic-release bot 📦🚀