Support validating go.{mod,sum} files

[SamWhited]

@dmcgowan I think something like this may also be useful, is it what you were talking about the other day? If the vendor tree doesn't exist we don't create it, instead we juts run go mod tidy and validate that the go.sum and go.mod files don't change (if they do the user needs to commit them).

[dmcgowan]

Yes, that is what I was thinking. Are there cases where the go.{sum,mod} files will have differences based on upstream changes?

[SamWhited]

Are there cases where the go.{sum,mod} files will have differences based on upstream changes?

No, they will only change if you added something to them but then never imported them, updated deps but didn't clean out the old ones from the sum file, or added imports but didn't pin a version. In short if you didn't run go mod tidy and you made changes that require it this will yell at you.

[dmcgowan]

LGTM

[SamWhited]

It just hit me that the other place this might break is if people do run go mod tidy but are using different versions of Go. I don't think this is likely to be a problem as long as we have specific versions of Go that are supported, but if someone else is using Go 1.13 and we're using Go 1.12 in CI this might result in differences. That being said, now that golang.org/dl is Go-get-able it's trivial to install and use another version.

[estesp]

LGTM