goLint: add a check that go.mod is tidied

[marten-seemann]

Name of feature:

Check that go.mod is tidied.

Pain or issue this feature alleviates:

There's no reason to commit a go.mod that is not tidied.

Why is this important to the project (if not answered above):

Best case an untidy go.mod pulls in dependencies that are not needed, worst case it leads to build failures due to incorrect module hashes.

Is there documentation on how to use this feature? If so, where?

https://go.dev/ref/mod#go-mod-tidy

In what environments or workflows is this feature supported?

All of them.

In what environments or workflows is this feature explicitly NOT supported (if any)?

None.

Supporting links/other PRs/issues:

I've been running this logic in quic-go for a long time.

💔Thank you!

[CLAassistant]

All committers have signed the CLA.

[dopey]

I'm actually worried about this one because recently go mod tidy has been adding gotoolchain to all our go.mod files, as well as modifying the selected version to be of the format x.y.z, rather than x.y (which is what we currently use). We should probably agree to this change as a team before merging, as this check may start failing for a large proportion of our repos.

[dopey]

Worried that this may cause linting errors for most of our repos.

[marten-seemann]

as well as modifying the selected version to be of the format x.y.z, rather than x.y (which is what we currently use).

I don't think that's a valid value for >= Go 1.21. This is because they recently changed the naming of the initial Go releases. The documentation states:

The standard Go toolchains are named goV where V is a Go version denoting a beta release, release candidate, or release. For example, go1.21rc1 and go1.21.0 are toolchain names; go1.21 and go1.22 are not (the initial releases are go1.21.0 and go1.22.0), but go1.20 and go1.19 are.

---

I'm actually worried about this one because recently go mod tidy has been adding gotoolchain to all our go.mod files

It shouldn't add a gotoolchain if none is present (I've been running it in quic-go for years, it never once added a toolchain line).

---

Worried that this may cause linting errors for most of our repos.

I ran go mod tidy for the following repos:

• agent
• autocert
• bouncer
• certificates
• cli
• cli-utils
• crypto
• guardian
• inventory
• step-issuer

In none of these repos did it introduce any changes.