cmd/go: go.mod should not be changed when building

[Nightapes]

What version of Go are you using (go version)?

$ go version go1.12.1 windows/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\Nightapes\AppData\Local\go-build
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOOS=windows
set GOPATH=D:\go
set GOPROXY=
set GORACE=
set GOROOT=C:\Go
set GOTMPDIR=
set GOTOOLDIR=C:\Go\pkg\tool\windows_amd64
set GCCGO=gccgo
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=D:\go-repo\example-go\go.mod
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=c:\Temp\go-build447595058=/tmp/go-build -gno-record-gcc-switches

What did you do?

go.mod

module example-go

go 1.12

require k8s.io/api kubernetes-1.14.2

main.go

package main

import (
	v1Core "k8s.io/api/core/v1"
	"fmt"
)

func main() {
	service := v1Core.Service{}
	fmt.Printf("%+v", service)
}

Run go build

What did you expect to see?

go.mod should not be changed

What did you see instead?

module example-go

go 1.12

require (
	github.com/gogo/protobuf v1.2.1 // indirect
	k8s.io/api v0.0.0-20190516230258-a675ac48af67
	k8s.io/apimachinery v0.0.0-20190515023456-b74e4c97951f // indirect
)

go.mod was changed, the version from k8s.io/api changed from k8s.io/api kubernetes-1.14.2 to
k8s.io/api v0.0.0-20190516230258-a675ac48af67 which is bad. You don't see the version anymore.
Also the indirect dependencies are added, they should be only in go.sum.

go build should be in read only mode for go.mod and error if a dependency is missing

[mvdan]

See https://github.com/golang/go/wiki/Modules#can-i-control-when-gomod-gets-updated-and-when-the-go-tools-use-the-network-to-satisfy-dependencies, in particular -mod=readonly.

[Nightapes]

When using -mod=readonly the following error appears:

go: updates to go.mod needed, disabled by -mod=readonly

So i need to run without readonly and this changes the version from k8s.io/api kubernetes-1.14.2 to
k8s.io/api v0.0.0-20190516230258-a675ac48af67

IMHO readonly should be the default behavior

[mvdan]

Have you tried searching the issue tracker before filing an issue? For example, see #29118.

[thepudds]

@Nightapes if you haven't already, probably worth reading https://golang.org/cmd/go/#hdr-Maintaining_module_requirements for an overview of how it works today, which includes:

The go.mod file is meant to be readable and editable by both programmers and tools. The go command itself automatically updates the go.mod file to maintain a standard formatting and the accuracy of require statements.

Any go command that finds an unfamiliar import will look up the module containing that import and add the latest version of that module to go.mod automatically. In most cases, therefore, it suffices to add an import to source code and run 'go build', 'go test', or even 'go list': as part of analyzing the package, the go command will discover and resolve the import and update the go.mod file.

[thepudds]

IMHO readonly should be the default behavior

One option for you might be export GOFLAGS=-mod=readonly or similar. The ability to customize the default modules behavior was one of the main reasons GOFLAGS was added during the initial modules development effort in Go 1.11.

From the documentation:

GOFLAGS
	A space-separated list of -flag=value settings to apply
	to go commands by default, when the given flag is known by
	the current command. Flags listed on the command-line
	are applied after this list and therefore override it.

[Nightapes]

@thepudds Thanks, i will try it with the GOFLAGS