dep check passes locally but fails on CI

[bogdanpetrea]

What version of dep are you using (dep version)?

dep:
 version     : v0.5.0
 build date  : 2018-07-26
 git hash    : 224a564
 go version  : go1.10.3
 go compiler : gc
 platform    : linux/amd64
 features    : ImportDuringSolve=false

What dep command did you run?

dep check

What did you expect to see?

Expected dep check to pass locally and on CI as well.

What did you see instead?

dep check passes locally but not on CI.

This is what happens in Drone (the first step after cloning my project repo):

+ make dependencies
test -d /go/bin || mkdir /go/bin
curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  5110  100  5110    0     0   141k      0 --:--:-- --:--:-- --:--:--  142k
ARCH = amd64
OS = linux
Will install into /go/bin
Fetching https://github.com/golang/dep/releases/latest..
Release Tag = v0.5.0
Fetching https://github.com/golang/dep/releases/tag/v0.5.0..
Fetching https://github.com/golang/dep/releases/download/v0.5.0/dep-linux-amd64..
Setting executable permissions.
Moving executable to /go/bin/dep
+ make vendor-integrity
dep check
# vendor is out of sync:
github.com/coreos/prometheus-operator: hash of vendored tree not equal to digest in Gopkg.lock
sigs.k8s.io/testing_frameworks: hash of vendored tree not equal to digest in Gopkg.lock
Makefile:98: recipe for target 'vendor-integrity' failed
make: *** [vendor-integrity] Error 1

Additional information

• I made it so that nothing from the vendor/ directory is git-ignored by adding !vendor/** to .gitignore and even tried with an empty .gitignore file as well. This solved out of sync errors for 2 other packages that included some .out files.

• I have tried running:

  • dep ensure
  • rm -rf vendor/ && dep ensure
  • dep ensure -update

• It's always these 2 packages: github.com/coreos/prometheus-operator and sigs.k8s.io/testing_frameworks

[tariq1890]

Yup. We face the same issue. Check #1990.

[bogdanpetrea]

I saw that issue and I don't think it's the same, since I even tried with an empty .gitignore file.
You can add !vendor/** to .gitignore and it will not ignore anything in the vendor directory.

[AlekSi]

I'm pretty sure it is the same issue. Please try this: #1990 (comment)

[bogdanpetrea]

You are right. I initially misread what .gitignore file @tariq1890 was talking about in his issue. My
!vendor/** rule probably gets overridden by the dependencies .gitignore files.