Checking the relevance of go.mod and go.sum

It happens in practice that you have to review a merge request and see suspicious changes to go.mod and go.sum, perhaps only one file is changing, and a logical question arises: are these changes necessary, or did it accidentally end up in a commit, perhaps a colleague forgot to add another file to commit or run go mod tidy after removing the dependency? Or maybe you yourself added unnecessary changes in previous commits?

In general, questions arise, and to reduce them, you can automate checking the relevance of the go.mod and go.sum files.

Using Gitlab CI as an example, such a task might look like this:

image: golang:1.21.5
  
stages:
  - check

check-go-dependencies:
  stage: check
  script:
    - go mod tidy
    - git diff --exit-code

• go mod tidy is a command that will check the consistency of the module’s source code and the go.mod and go.sum files.

• git diff --exit-code — this command will show the differences in the files that were committed and those that were obtained after the previous command, producing a non-zero exit code if there are differences.

This task is easy to implement, but if it fails with an error, then it is not clear what to do about it, and it would be nice to add useful information for colleagues or yourself from the future about how this problem can be solved. Therefore, we will make some modifications to the check:

image: golang:1.21.5

stages:
  - check

check-go-dependencies:
  stage: check
  script:
    - go mod tidy
    - |
      git diff --exit-code && exit 0 || true
      echo -e "\033[0;31m"
      echo '######################################################################'
      echo 
      echo "ERROR: go.mod or go.sum is different from the committed version"
      echo "Try using 'go mod tidy' to fix the go.mod and go.sum files"
      echo "Also, don't forget to commit and push changes"
      echo 
      echo '######################################################################'
      exit 1

At the beginning everything is the same go mod tidyand then it’s more interesting, since the pipeline ends at the first error, it’s difficult to decompose the check into separate command calls, so due to the syntax - | We describe a multi-line script. Next, if git diff doesn’t find anything, then we exit with a zero code, but if the exit code is not zero, then we intercept and skip it using the command true. Next, set the message color to red, generate the desired message and exit with a non-zero code so that the task ends with an error.

In principle, this covers the basic needs of checking the relevance of go.mod and go.sum, and the output of a detailed error message will help us and our colleagues learn about the team’s option to fix the problem go mod tidy. And in turn, it should improve the user experience and reduce the number of questions that arise when such a task fails.

PS More of my articles and original article can be found on my personal blog.

PPS An image by the author macrovector / Freepik was used as an illustration for the article.