Afraid of being unable to build historical versions of your Go program?
go mod vendor lets you check in your dependencies to git, but that's
both bloaty (for developers) and tedious (remembering to update it).
It's nicer to work day-to-day with only go.mod (and no vendor folder), trusting that
https://proxy.golang.org/ can give you any module version in the future.
Except https://proxy.golang.org/ doesn't necessarily retain everything forever.
Hence this project. go-mod-archiver is meant to run as a GitHub
Actions workflow and whenever your go.mod changes, it runs go mod vendor and commits it into a git tag so you can get your dependent
code in the future if you really need to. (by syncing back to some old
point in time, looking at the SHA-256 of your go.mod, and fetching
that tag's vendor directory)
To use go-mod-archiver, see https://github.com/bradfitz/go-mod-archiver-test for:
-
how to depend on this tool: https://github.com/bradfitz/go-mod-archiver-test/blob/main/tools.go (using the trick from https://github.com/golang/go/wiki/Modules#how-can-i-track-tool-dependencies-for-a-module)
-
an example GitHub workflow: https://github.com/bradfitz/go-mod-archiver-test/blob/main/.github/workflows/go-mod-archive.yml
This is an example tag created by this tool: