Dependabot-core: Support vendoring for Go

[greysteil]

Moved from https://github.com/dependabot/feedback/issues/187.

This needs a general strategy for supporting vendoring, but is also probably a sensible first language to look at (since vendoring in Go is so common).

[saschagrunert]

I would love to see this feature in! I would go for a simple configuration variable to check if vendoring is enabled and then do something like this afterwards:

export GO111MODULE=on \
    go mod tidy && \
    go mod vendor && \
    go mod verify

What do you think?

[emirb]

@greysteil Any ETA?

[greysteil]

I'm going to leave this one for @hmarr, but hopefully soon. We've done a bunch of the required background work here already, and GitHub themselves vendor their dependencies, so we're feeling it as an acute pain internally!

[saschagrunert]

I guess we also have to take indirect dependencies into account. Dependabot should check them for updates, too.

[hmarr]

This is our top priority for Go, but unfortunately we can't dedicate much time to Go right now. I'm hoping we'll be able to build our much more solid Go support (including vendoring) over the next few months.

Related: https://github.com/dependabot/feedback/issues/215

[greysteil]

A workaround function we've seen for Circle CI users, that vendors dependencies in an additional commit:

update-vendor:
  <<: *docker_build_image
  steps: 
    - checkout
    - run: GO111MODULE=on go mod vendor
    - run: |
      git config --global user.email "[email protected]"
      git config --global user.name "Friendly Robot"

      git diff --quiet || ( \
        git commit -am "vendor: go mod vendor" && \
        git push origin "$(git rev-parse --abbrev-ref HEAD)" \
      )

[ndeloof]

Any update on this feature request ?
This clearly is a blocker for my team to adopt dependabot :'(

[ggilley]

Another vote for this. Makes it impossible to use otherwise.

[jan-xyz]

This breaks using dependabot with go1.14 and vendording. go1.14 does not allow an inconsistent vendor directory, so without automatic vendoring, we have to manually checkout each branch and do go mod vendor.

[scothis]

I was able to work around this limitation with a custom Workflow. The downside is that since we're adding a new commit Dependabot will no longer manage the PR. Proper upstream support is still desirable.

name: dependabot-gomod
on:
  push:
    branches:
    - dependabot/go_modules/**

jobs:
  go_mod_vendor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-go@v2
        with:
          go-version: 1.14.x
      - uses: actions/checkout@v2
        with:
          # use a personal access token so that the push will trigger new actions
          token: ${{ secrets.PAT_TOKEN }}
      - name: vendor
        run: |
          go mod vendor
      - name: tidy
        run: |
          go mod tidy
      - name: commit changes
        uses: stefanzweifel/[email protected]
        with:
          commit_message: Vendor and tidy go modules
          commit_options: '--no-verify --signoff'

[rmasclef]

hi 😄 Any chances I can help with this feature ?

[jurre]

Hi all, we're gradually rolling out support for this on the GitHub native version of Dependabot, please let me know if you'd like to get early access to the feature and I'd be happy to enable it on your repo/account.

[rmasclef]

ho yeah 👍

I'll be glad to be part of this early access program, is it possible to do it on a organisation level ?

[jurre]

ho yeah 👍

I'll be glad to be part of this early access program, is it possible to do it on a organisation level ?

Yep, for sure

[hallabro]

Hi all, we're gradually rolling out support for this on the GitHub native version of Dependabot, please let me know if you'd like to get early access to the feature and I'd be happy to enable it on your repo/account.

Nice, excited to see this feature! :tada:

We'd be happy to test this in one of our repositories over at @form3tech. How can I contact you regarding the repository name?

[rmasclef]

ho yeah 👍
I'll be glad to be part of this early access program, is it possible to do it on a organisation level ?

Yep, for sure

great ! So I have the same question as @hallabro 👍

[jurre]

I'll reach out to you both via your public email, thanks for helping us verify this 👍

[suever]

I'll reach out to you both via your public email, thanks for helping us verify this 👍

would be happy to assist as well

[jurre]

I'll reach out to you both via your public email, thanks for helping us verify this 👍

would be happy to assist as well

Sweet, reaching out via email

[iwarapter]

Id love to get on the early access!

[davidsbond]

Saw this work on one of my repos that had a github action set up to run go mod vendor on any dependabot PRs. It worked perfect, my extra action did nothing since there were no changes, many thanks!

[jurre]

Id love to get on the early access!

Apologies I missed this, but it's fully rolled out now

[rmasclef]

just a quick note to say that this works pretty well (using it on >20 repos)

we are just missing the availability to update private vendors which, as I understand, is available on dependabot.com but not in github integration yet 👍

[jurre]

just a quick note to say that this works pretty well (using it on >20 repos)

we are just missing the availability to update private vendors which, as I understand, is available on dependabot.com but not in github integration yet 👍

Happy to hear it, private repo's are definitely coming in the GH integration, we'll also support tidy and vendoring on dependabot.com soon-ish, as we get it for free now that it's available in dependabot-core

[jurre]

https://github.blog/changelog/2020-10-19-dependabot-go-mod-tidy-and-vendor-support/ 🎉