filosottile/vendorcheck

Check that all your Go dependencies are properly vendored

vendorcheck

Deprecated: use go mod vendor, which starting in Go 1.14 will automatically check that the vendor folder is complete.

Check that all your Go dependencies are properly vendored

$ vendorcheck ./...
[!] dependency not vendored: golang.org/x/tools/go/buildutil
[!] dependency not vendored: github.com/kisielk/gotool
[!] dependency not vendored: golang.org/x/tools/go/loader
[!] dependency not vendored: golang.org/x/tools/go/ast/astutil

Run vendorcheck -u to list unused vendored packages instead.

vendorcheck's Issues

Reporting possible false positive

Either the tool actually found a problem with one of my projects or it's a false positive:

I run

$ vendorcheck ./...
[!] dependency not vendored: golang.org/x/text/transform
[!] dependency not vendored: golang.org/x/text/encoding/charmap
[!] dependency not vendored: golang.org/x/text/language
[!] dependency not vendored: golang.org/x/text/encoding/internal/identifier
[!] dependency not vendored: golang.org/x/text/encoding
[!] dependency not vendored: golang.org/x/text/encoding/simplifiedchinese
[!] dependency not vendored: golang.org/x/text/internal/utf8internal
[!] dependency not vendored: golang.org/x/text/encoding/korean
[!] dependency not vendored: golang.org/x/text/encoding/unicode
[!] dependency not vendored: golang.org/x/text/encoding/japanese
[!] dependency not vendored: golang.org/x/text/encoding/traditionalchinese
[!] dependency not vendored: golang.org/x/text/runes
[!] dependency not vendored: golang.org/x/text/encoding/htmlindex
[!] dependency not vendored: golang.org/x/text/encoding/internal
[!] dependency not vendored: golang.org/x/text/internal/tag

However, I don't use these packages. They are referenced from vendor/golang.org/x/net/html/charset of which I vendor vendor/golang.org/x/net (but only need vendor/golang.org/x/net/context there), which I can't vendor more fine-grained as I use git submodules and I assume Go compiler would complain as well):

vendor/golang.org/x/net
|- vendor/golang.org/x/net/context
+- vendor/golang.org/x/net/html/charset
    +- vendor/golang.org/x/text

Also, could you change the log output from [!] to Error: or Warn:? Then I think it's easier to integrate the tool into go-metalinter.

I already fetch the package, but why this happen

vendorcheck ./... not reporting missing package

I've only seen this happen once (with Caddy):

$ vendorcheck ./...

$ vendorcheck -u ./...
(bunch of unused vendored packages; not relevant but I'm reporting my full command sequence)

$ go test ./...
caddytls/config.go:12:2: cannot find package "github.com/codahale/aesnicheck" in any of:
	/Users/matt/Dev/src/github.com/mholt/caddy/vendor/github.com/codahale/aesnicheck (vendor tree)
	/usr/local/go/src/github.com/codahale/aesnicheck (from $GOROOT)
	/Users/matt/Dev/src/github.com/codahale/aesnicheck (from $GOPATH)

$ vendorcheck ./...

$ gvt fetch github.com/codahale/aesnicheck
2017/05/27 10:35:09 Fetching: github.com/codahale/aesnicheck

$ vendorcheck ./...

$ go test ./...
(test results; no build errors)

So here go test ./... noticed that a package was missing but vendorcheck ./... didn't report it.

Add a flag to get only the dependency package name

This would help piping the output to other tools like govendor or go get

Reports internal package as dependency to vendor

 $ go list ./...
github.com/mvdan/interfacer
github.com/mvdan/interfacer/cmd/interfacer
github.com/mvdan/interfacer/generate/std
github.com/mvdan/interfacer/internal/util
github.com/mvdan/interfacer/vendor/github.com/kisielk/gotool
github.com/mvdan/interfacer/vendor/golang.org/x/tools/go/ast/astutil
github.com/mvdan/interfacer/vendor/golang.org/x/tools/go/buildutil
github.com/mvdan/interfacer/vendor/golang.org/x/tools/go/loader
 $ vendorcheck
[!] dependency not vendored: github.com/mvdan/interfacer/internal/util

Unless there is something obvious I'm missing here, this sounds like a false positive.

If you have trouble reproducing this, let me know :)