x/exp/cmd/gorelease: fetch base version from directory with -basedir flag

[jayconrod]

gorelease currently lets the user specify a base version to compare against using the -base flag. At the moment, this only accepts an existing version of the same module (retrievable using go mod download). #37410 would allow version queries like @latest, @master, or @01234abcdef

It may sometimes be useful to compare against code that isn't available to the proxy or pushed to the origin VCS server yet. A -basedir flag would help with this. It would let the user specify the base version as a directory tree.

gorelease -basedir=path/to/base -release=v1.0.0

cc @liggitt

[jadekler]

I'm a bit confused and would like to clarify :) Is the scenario here,

I have a new module, and it has no commits on it yet, or the commits are not pushed. I'd like to run gorelease on it in order to understand whether it flags anything non-diff-y, like "You're using retracted modules" or "Your go.mod/go.sum is missing stuff".

If so - makes sense! It does not seem to work today:

$ cd $(mktemp -d)
$ echo "package foo" > foo.go
$ go mod init github.com/jadekler/foobargaz
go: creating new go.mod: module github.com/jadekler/foobargaz
go: to add module requirements and sums:
	go mod tidy
$ ~/workspace/exp/cmd/gorelease/gorelease
gorelease: could not find base version: could not load versions for github.com/jadekler/foobargaz: go list -m: module github.com/jadekler/foobargaz: git ls-remote -q origin in /home/deklerk/go/pkg/mod/cache/vcs/e5d674986afe4c751e1356c78d65d9c8da2a418f31a17611d82b8064a993cbea: exit status 128:
	fatal: could not read Username for 'https://github.com': terminal prompts disabled
Confirm the import path was entered correctly.
If this is a private repository, see https://golang.org/doc/faq#git_https for additional information.

I imagine this means skipping a lot of logic that happens in gorelease (certainly the apidiff stuff, and whatever is doing the go list seen in the error above). Is that right?

If so: will be exciting pruning gorelease to see which things can be run when the module does not exist.

(I'm also wondering if we can somehow simulate the basedir as a module in the proxy so that we can prune less things: I imagine things like go list for retracted deps needs us to do that (I think there's still no way we can do apidiff, though))

[jayconrod]

If gorelease is being run to identify problems with the module in the current directory, the -base=none flag may already be used to skip comparison with any other version. The feature requested here probably isn't needed for that case.

This issue is one of the things that motivates #46371. gomoddiff could provide a CLI for comparing APIs in two module versions, possibly with different module paths, either remote or local. go mod vet should be more limited, only comparing with the previous semantic version.