Replies from 24 September 2024

Yeah not sure where that came from but as you say, you can pin to a tag/commit, and Go's module proxy stops you from having someone re-push the value of a tag, once it's had someone download a dependency.

You also only pin, as there's no way to do a range, so IMO that makes it nicer and more explicit than other languages / toolchains with respect to pinning

Yeah I'm very much looking forward to // tool landing as that'll push more folks to using a tools.go style approach.

I'm seeing some folks who'll use a tools.go in a separate Go module so then it doesn't impact the top-level dependency tree, on top of Go' s inbuilt module graph pruning

Also as much as I recommend tools.go, there's still some things it can be awkward with ie golangci-lint tracked as a source dependency can lead to issues (dependency version clashes, Go version incompatibility), as well as it not being the recommended use case