Does it make sense to add `go mod vendor` to a pre-commit hook?

Question

Setup:

• Our project is using golang 1.12.14
• We are using go build -mod=vendor

Issue: When new dependencies are added to go.mod the vendor folder isn't updated and people are committing code and forgetting to run go mod vendor to update the folder. My understanding is that since -mod=vendor specifies to use packages from the vendor folder, the go.mod file will have discrepancies from what we are actually using when building the project.

Question: Should go mod vendor be added to a pre-commit hook?

Stultz

What would make more sense is git rm -rf vendor, and use go mod as intended. – Moneyer

"Should go mod vendor be added to a pre-commit hook?" Maybe, maybe not. You can if this is helping with your problem. – Heartsick

Sorry I should clarify: I am concerned with adding it because I didn't see anything related to mod here which makes me think I have the wrong idea github.com/dnephin/pre-commit-golang – Stultz

@Flimzy When we upgrade to 1.14 won't we need the vendor folder anyways When the main module contains a top-level vendor directory and its go.mod file specifies go 1.14 or higher, the go command now defaults to -mod=vendor golang.org/doc/go1.14 – Stultz

@DanielKobe: have you tried letting it use a proxy? If all modules are public (which I assume they are if a simple go mod vendor works) the default proxy is extremely fast, and sometimes faster than committing large dependency trees to git. – Kob

You don't need the vendor folder with Go 1.11 or newer, if you're using modules. The default for -mod is irrelevant. – Moneyer

Answer 1

As of Go 1.14, the go command automatically checks for consistency between the vendor directory and the go.mod file whenever the vendor directory is used. In addition, it uses the vendor directory by default if the module specifies go 1.14 or higher (see https://tip.golang.org/doc/go1.14#go-command).

As of today, the oldest supported version of the Go toolchain is Go 1.15.13.

So if you upgrade to a supported version of the Go toolchain, it should not be necessary to run go mod vendor as a pre-commit hook. The go command itself will flag inconsistencies whenever the vendor directory is used.

Significative