Renovate does not handle golang workspace correctly

[jankaluza]

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

Hi,

We are using Renovate in the https://github.com/containers/container-libs repository to keep the go.mod dependencies and the "vendor" directory up to date.

This repository uses https://go.dev/doc/tutorial/workspaces and therefore there is the go.work file in the top-level directory. The particular go.mod files are in the sub-directories mentioned by this go.work file.

Problem description

The issue is that the gomod Renovate manager expects that the vendor directory is next to the go.mod. This can be seen in the code here. This is afaik not how go works - if you run go work vendor, it creates the vendor directory in the top-level directory above the go modules (next to the go.work file). This leads to Renovate ignoring the changes done to the vendor directory and pushing only go.mod and go.sum changes. This can be seen in the https://github.com/containers/container-libs/pull/19/files.

There is a similar issue with go.work.sum file. Renovate tries to search for it in the goModDir while it afaik always exists next to the go.work file which does not have to live next to the go.mod.

Expected behaviour

Renovate should find out the vendor directory even if it's next to the go.work file one level above the go.mod files and include the changes done to this directory by go work vendor in the PR. Same for go.mod.sum.

Proposed solution

The vendorDir should probably be based on the goWorkFile in case it is found in the directory tree. There can be fall-back to the vendorDir based on the original goModDir.

That way would ensure, that the vendor dir next to the go.work is always included in the PR if it exists.

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[jankaluza]

Following is the PR which should fix this issue: #37910