Maintain go.mod and go.sum as part of continuous intergration.

[Sriep]

go.mod and go.sum are essentially generated files, and as such maintaining them is best left up to the continuous integration process.

Suggestion: Add a Github pull request / merge action that automatically updates these files.
There is a go-mod component to the makefile which might prove useful.

[shravanshetty1]

In case of go.mod, I dont think we should do this - we want to use dependencies at a specific commit however if we were to generate go.mod file it will always use dependencies from latest commit. This can introduce breaking changes.

[Sriep]

Why do we want to use dependencies from a specific commit?

[shravanshetty1]

Why do we want to use dependencies from a specific commit?

What if a dependency makes a breaking change? we will inherit the breaking change and our software will stop working. This is the reason why go.mod forces you to manually update dependencies. When you add a new dependency it adds the dependency from the last stable commit available at the time of adding the dependency. If new stable releases are available - you must manually update due to the above issue.

[Sriep]

We can write a script to merge the go mod tidy result with a manual set of exceptions. Maybe run a sequence of

go get github.com/<some commit we want>

or just have the CI directly edit the go.mod file.

The key is to minimise developer involvement.

[ma2b0043]

@Sriep @mohsenno1 when can we expect to close this issue?

[dabasov]

agree with @shravanshetty1 this process better left for developers