cmd/go: mitigate merge conflicts when modules are updated

[vcabbage]

I expect merge conflicts in go.mod and go.sum to be a relatively common occurrence.

Quoting from @bcmills in the Go Slack:

If you have a merge conflict no go.mod or go.sum, you can usually just remove the conflict markers (taking the union of the requirements) and then run go mod tidyto get back into a consistent state.

https://gophers.slack.com/archives/C9BMAAFFB/p1559923453042900?thread_ts=1559922004.041700&cid=C9BMAAFFB

This doesn't appear terribly burdensome but it does introduce friction in the development process. I'm opening this as an exploratory issue to investigate whether there's anything the tooling can/should do to mitigate the conflict.

My off the cuff question was whether go mod tidy could be updated to understand conflicts and automatically resolve them in go.mod and go.sum. My summary of the resulting conversation is that it's likely possible but it's unclear whether it's desirable.

Some of the reasons against that were brought up:

• Both parsing of the conflicts and resolving them is VCS specific.
• This may be expanding the scope of what tidy is responsible for farther than it should be.

It's possible there's a less invasive approach to mitigating conflicts so I'm including the above suggestion only as one potential option to explore.

[bcmills]

CC @jayconrod

[wizardishungry]

I'd be interested in writing git specific merge driver for go.sum, if anyone else is thinking of the same thing.

[bcmills]

Thinking about this some more... if the area under the merge tokens contains a replace, require, or exclude token, then it isn't correct to just combine the contents. So the merge tool will at least need to know when to call for human intervention.

[rbUUbr]

what about just deleting go.sum and running go mod download?

[bcmills]

@rbUUbr, the point of the go.sum file is to ensure that the checksums do not change once a given version is downloaded. Especially for private dependencies that are not present in the global checksum database, it is important not to discard the originally-recorded checksums.

[yobert]

It seems to me like the algorithm should be:
go.sum: Always merge contents together, deduplicating exact row matches
go.mod: Whenever conflicting part does not include replace/require/exclude, use MVS algorithm to resolve to the oldest version that satisfies both (in effect, choose the newest version). Any other conflicts, leave be for manual intervention.

Also I think a nice interface would be something like "go mod git-merge" or something like that. It could return an error exit code when it wasn't able to safely auto-merge everything. I think this could be plugged into .git/config so that doing a huge rebase with hundreds of commits would be mostly automatic.

[kpruden]

Hasn't been much movement on this issue, but I thought I'd throw in my vote for this feature.

For what it's worth, I think this would be useful even if it only handled go.sum conflicts and left conflicts in go.mod alone for manual intervention. This ensures a human reviews conflicts in the semantic dependencies (and sidesteps the more tricky conflict scenarios), but lets go mod maintain responsibility for go.sum.

In this case, the workflow would be: resolve conflicts in go.mod then run go mod tidy, which is pretty consistent with other workflows involving manual edits to go.mod..