GO111MODULE="on" go get breaks build

[mrsdizzie]

Currently Makefile tries to download swagger using go get if it is not already present:

gitea/Makefile

Lines 122 to 124 in d9545f9

	@hash swagger > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
	GO111MODULE="on" $(GO) get -u github.com/go-swagger/go-swagger/cmd/swagger@v0.20.1; \
	fi

However, the way go get works now with GO111MODULE=on is that it will modify go.mod if present in the current folder (which it is when a user or CI runs anything from the Makefile).

You can reproduce this locally by first removing swagger and then running that command from inside a clean checkout of master:

GO111MODULE="on" go get -u github.com/go-swagger/go-swagger/cmd/swagger@v0.20.1

You'll see something in there pulls in deps like:

go: finding golang.org/x/net latest
go: finding golang.org/x/sys latest

This updates go.mod to the latest commit of those, and then later on the build fails because of this:

gitea/Makefile

Lines 187 to 197 in d9545f9

	vendor:
	GO111MODULE=on $(GO) mod tidy && GO111MODULE=on $(GO) mod vendor
	.PHONY: test-vendor
	test-vendor: vendor
	@diff=$$(git diff vendor/); \
	if [ -n "$$diff" ]; then \
	echo "Please run 'make vendor' and commit the result:"; \
	echo "$${diff}"; \
	exit 1; \
	fi;

Which runs with the updated go.mod entires and downloads a newer copy than what is checked into /vendor. So right now it is broken because there was a commit to x/sys a few hours ago.

I'm not 100% familiar with go modules but it seems with modern go you can no longer expect to use go get without it modifying a go.mod file. See this upstream issue with many similar complaints/comments:

golang/go#27643

I think we should not be using go get for this (and running it at all with module support is expected to modify go.mod so we should probably get rid of its use elsewhere rather than add module support to those commands in the future).

This also seems like another instance where we shouldn't be downloading anything (a bunch of things really!). I think we should have a copy of the supported version of swagger already available to any build container if that is possible, same as git, git-lfs, and other things required for running the CI and test that the Makefile doesn't attempt to install each time.

We also download a specific version of swagger if none is available, but don't check if the currently installed version of swagger matches the one we try and download so if a user already has swagger installed it might not use the right version anyway. Perhaps we could vendor swagger? Or just suggest people install the currently supported version on their own (same as we do with go itself).

But I think in general this is another problem that wouldn't happen if we didn't try and download everything for each build. In any case, we should find a better way :)

[mrsdizzie]

Closed by #8087