Introducing the tidied tool, to more easily check whether go mod tidy has been run

If you're working with Go projects that use Go modules, you may be aware of the format of the go.mod and go.sum, which are used to track dependencies and their checksums respectfully.

For instance, if we take the following go.mod, you'll notice there are two sections for dependencies:

module jvt.me/dotfiles/shorten

go 1.18

require (
	github.com/deepmap/oapi-codegen v1.11.1-0.20220629212257-2cf7fcf5b26d
	github.com/spf13/viper v1.10.1
)

require (
	github.com/fsnotify/fsnotify v1.5.1 // indirect
	github.com/google/uuid v1.3.0 // indirect
  // ...
)

The split here is directly used dependencies, and indirectly used dependencies which are also known as transitive dependencies. To avoid developers hand-writing this file and moving things about, we can rely on the go mod tidy command to automate reformatting and management of the go.mod, as well as updating the go.sum if checksums are outdated.

One of the problems of not running it regularly is that it can bloat your exposed list of dependencies, making it a requirement that consumers pull all of the dependencies every time they pull your project.

For instance, if we go get a new dependency, but don't run go mod tidy, we'll end up leaving that as a direct dependency, so all consumers will be expected to depend on that, too.

This is the case even though newer versions trim the downloaded list of dependencies.

The bloating of dependencies may not be as noticeable in your project, but if you're using go mod vendor, it can be very noticeable.

So how can we get around it? My initial solution has been running:

# via https://www.jvt.me/posts/2022/04/29/git-uncommitted-changes/ and https://www.jvt.me/posts/2022/05/23/git-diff-index-0-changed/
go mod tidy && git status; git diff-index --quiet HEAD --

However, this little incantation everywhere is a little awkward to copy-paste and explain to folks, and I feel it's common enough to need something easier.

Until support is native in the Go toolchain, I've created a new tool tidied, which can be found on GitLab, and can be run like so:

$ go install gitlab.com/jamietanna/tidied@latest
$ tidied && echo $?
1
# alternatively, make it verbose
$ tidied -verbose && echo $?
Detected untracked changes after running `go mod tidy`:
...
1

This should make it a slightly easier way to test everything is aligned, and I'm looking forward to use it across all my projects.