Support vendored major upgrades for Go

[hugoboos]

What would you like Renovate to be able to do?

Update major versions in projects that have Go vendoring enabled.

Eg. github.com/google/go-github/v48 to github.com/google/go-github/v50

Reproduction repository: https://gitlab.com/hugoboos/renovate-go-update-import

Related discussion: https://github.com/renovatebot/renovate/discussions/20996

If you have any ideas on how this should be implemented, please tell us here.

At the moment Renovate updates go.mod. This should be done by the mod tool. This tool is already being used by Renovate. Only the order should be changed.

1. Run mod to change the import paths
2. Run go mod tidy, this will update go.mod. Possible that version is different from that Renovate selected.
3. Change the version in go.mod for the updated package.
4. Run go mod tidy
5. Run go mod vendor
6. Commit

Is this a feature you are interested in implementing yourself?

No

[rarkins]

Reproduction imported to https://github.com/renovate-reproductions/21010 (note: in future it would be appreciated if you can reproduction github.com to make it more easily forkable)

[rarkins]

This one will need someone to do some experimentation. Renovate usually:

• Updates a package file (e.g. go.mod) manually, then
• Runs one or more commands to update "artifacts" (go.sum, vendored files, etc)

In this case it's being asked to skip the go.mod update and go directly to running commands. We may not be able to easily skip the update but we may be able to reverse it prior to running commands.

[hugoboos]

If I can help to test something, let me know.

[nitrocode]

We see this half working in runatlantis/atlantis. It updates almost every single go-github major version except for one import in a single file.

File to manually update: https://github.com/runatlantis/atlantis/blob/main/server/events/vcs/testdata/fixtures.go

Original renovate PR that updates all but one file https://github.com/runatlantis/atlantis/pull/3495

Subsequent PR to manually update the file https://github.com/runatlantis/atlantis/pull/3498

[dolmen]

Upgrading major versions should be left to maitainers.

Or if you are insisting to do it, do it right:

• do not edit the go.mod file directly but instead use the go mod command (ex: go mod edit -require=module@version && go mod tidy)
• upgrade imports in *.go files
• if a go file that would be modified has the standard header that tells this is generated code (see https://golang.org/s/generatedcode), the upgrade should fail and just suggest the upgrade to the maintainers (open an issue instead of a PR).
• run go mod tidy to check that the upgrade did happen (cucumber/gherkin#120 is an example of such failure)

Here is an example of how it goes wrong (cucumber/gherkin#120) and my manual upgrade (cucumber/gherkin#133).

[rarkins]

Supporting major updates of Go was a requested feature, and appreciated by many, so we won't be removing it. It's quite simple to disable major updates for the go manager for those who don't want.

[dolmen]

@rarkins Should I open separate issues for the things I reported above in https://github.com/renovatebot/renovate/issues/21010#issuecomment-1634377616 ? Do you have suggestions on how to split them?

[mpkorstanje]

@dolmen I do see a significant overlap between the items you reported and the original issue. I don't think badgering rarkins will get you much.

I do see the issue is labeled as help wanted. Perhaps you can create a fix that does major upgrades correctly.

[rarkins]

@dolmen please start your own Discussion in this repo putting together all of your suggestions for major upgrades, then we can decide how many separate issues to divide them into. Thanks!