Skip to content

Commit 31a74e6

Browse files
dzarlaxdzarlax
committed
Stop vendoring Go modules
1 parent 70fa00a commit 31a74e6

393 files changed

Lines changed: 187 additions & 131198 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.git
2+
.gocache
3+
bin
4+
docs/ai-plans
5+
vendor

‎.github/workflows/ci.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,13 @@ jobs:
3030
- uses: actions/setup-go@v6
3131
with:
3232
go-version-file: go.mod
33-
cache: false
33+
cache: true
3434

3535
- name: Build all binaries
36-
run: CGO_ENABLED=0 go build -mod=vendor ./...
36+
run: CGO_ENABLED=0 go build ./...
3737

3838
- name: Vet
39-
run: CGO_ENABLED=0 go vet -mod=vendor ./...
39+
run: CGO_ENABLED=0 go vet ./...
4040

4141
# Unit tests. All current test files are pure (no DATABASE_URL,
4242
# no network) — verified by grepping *_test.go for DATABASE_URL,
@@ -50,7 +50,7 @@ jobs:
5050
# CGO=1, so we skip it; the test set today is mostly
5151
# math-kernel pure functions where -race adds little.
5252
- name: Test
53-
run: CGO_ENABLED=0 go test -mod=vendor ./...
53+
run: CGO_ENABLED=0 go test ./...
5454

5555
docker-amd64:
5656
name: Docker Build & Push (amd64)

‎AGENTS.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ make test # send a test POST to localhost:8080/health
1919
DATABASE_URL=postgres://... make import FILE=export.zip # import Apple Health export
2020
```
2121

22-
Build is pure Go (no CGO). Uses `jackc/pgx/v5` for PostgreSQL. Docker images built via GitHub Actions.
22+
Build is pure Go (no CGO). Uses `jackc/pgx/v5` for PostgreSQL. Dependencies resolve from `go.mod` / `go.sum`; `vendor/` is intentionally not committed. Docker images built via GitHub Actions.
2323

2424
**Time zones:** the binary builds with `CGO_ENABLED=0` and the alpine runtime image has no system tzdata. `cmd/server/main.go` imports `_ "time/tzdata"` to embed the IANA database (~450KB). **Don't remove this import** — every TZ-aware feature (report scheduler, smart-retry timing, freshness banners, `energy_snapshots.date`) silently coerces to UTC without it, and most callers fall back to UTC on `LoadLocation` error so the breakage is invisible until you query a specific time-of-day-sensitive output.
2525

‎CLAUDE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ make test # send a test POST to localhost:8080/health
1919
DATABASE_URL=postgres://... make import FILE=export.zip # import Apple Health export
2020
```
2121

22-
Build is pure Go (no CGO). Uses `jackc/pgx/v5` for PostgreSQL. Docker images built via GitHub Actions.
22+
Build is pure Go (no CGO). Uses `jackc/pgx/v5` for PostgreSQL. Dependencies resolve from `go.mod` / `go.sum`; `vendor/` is intentionally not committed. Docker images built via GitHub Actions.
2323

2424
**Time zones:** the binary builds with `CGO_ENABLED=0` and the alpine runtime image has no system tzdata. `cmd/server/main.go` imports `_ "time/tzdata"` to embed the IANA database (~450KB). **Don't remove this import** — every TZ-aware feature (report scheduler, smart-retry timing, freshness banners, `energy_snapshots.date`) silently coerces to UTC without it, and most callers fall back to UTC on `LoadLocation` error so the breakage is invisible until you query a specific time-of-day-sensitive output.
2525

‎CONTRIBUTING.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,13 @@ This project is a self-hosted health-data system. Changes should preserve the co
1616
Use Go 1.24+ and PostgreSQL.
1717

1818
```bash
19+
go mod tidy
1920
go test ./...
2021
go vet ./...
2122
```
2223

24+
Dependencies are managed through normal Go module resolution. Review dependency changes in `go.mod` and `go.sum`; the repository does not commit a `vendor/` tree.
25+
2326
DB-backed integration tests skip when no Postgres connection is configured. To run them, provide libpq environment variables or `READINESS_TEST_DSN`. Tests create throwaway schemas and drop them during cleanup.
2427

2528
## Pull Request Guidelines

‎Dockerfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
FROM golang:1.25-alpine AS builder
22
WORKDIR /src
3+
COPY go.mod go.sum ./
4+
RUN go mod download
35
COPY . .
4-
RUN CGO_ENABLED=0 go build -mod=vendor -ldflags="-w -s" -o /app/server ./cmd/server
6+
RUN CGO_ENABLED=0 go build -ldflags="-w -s" -o /app/server ./cmd/server
57

68
FROM alpine:latest
79

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -490,6 +490,8 @@ make docker-down # stop all services
490490

491491
Cache tables are rebuilt automatically on server startup (incremental, last 48h) and after each sync (debounced, 2-minute delay). Use `make backfill-force` only after code changes to aggregation logic.
492492

493+
Dependencies are managed through Go modules (`go.mod` / `go.sum`). The repository does not commit `vendor/`; CI and Docker builds download modules using the normal Go module cache/proxy path.
494+
493495
Schema migrations (new columns on `daily_scores`, etc.) auto-apply on startup via `EnsureIndexes()` — uses `ADD COLUMN IF NOT EXISTS`, so existing deployments pick them up without manual SQL. Fresh installs get the full schema from `CREATE TABLE IF NOT EXISTS` paths in `internal/storage/db.go`.
494496

495497
### One-off: seed the persistent review tenant

‎docs/ai-plans/2026-06-06-issue-170-stop-vendoring-go-modules.html‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
<!doctype html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="utf-8">
5+
<title>Implementation Plan: Issue #170 Stop Vendoring Go Modules</title>
6+
<meta name="viewport" content="width=device-width, initial-scale=1">
7+
<style>
8+
body { margin: 0; font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: #f6f7f9; color: #1f2937; line-height: 1.5; }
9+
main { max-width: 1100px; margin: 0 auto; padding: 32px; }
10+
section { background: #fff; border: 1px solid #e5e7eb; border-radius: 8px; padding: 20px; margin: 16px 0; }
11+
h1, h2 { line-height: 1.2; margin-top: 0; }
12+
code { background: #f3f4f6; padding: 2px 5px; border-radius: 4px; }
13+
.badge { display: inline-block; padding: 4px 10px; border-radius: 999px; background: #dcfce7; color: #166534; font-size: 12px; font-weight: 700; }
14+
.risk { border-left: 4px solid #dc2626; }
15+
.approval { border-left: 4px solid #d97706; }
16+
</style>
17+
</head>
18+
<body>
19+
<main>
20+
<h1>Implementation Plan: Issue #170 Stop Vendoring Go Modules</h1>
21+
<p class="badge">Approved and implemented</p>
22+
23+
<section>
24+
<h2>Task Summary</h2>
25+
<p>Decide and implement the dependency workflow change from committed <code>vendor/</code> plus <code>-mod=vendor</code> to normal Go module resolution, if approved.</p>
26+
</section>
27+
28+
<section>
29+
<h2>Current Behavior</h2>
30+
<ul>
31+
<li>The repository contains a committed <code>vendor/</code> tree and <code>vendor/modules.txt</code>.</li>
32+
<li><code>.github/workflows/ci.yml</code> runs <code>go build -mod=vendor ./...</code>, <code>go vet -mod=vendor ./...</code>, and <code>go test -mod=vendor ./...</code>.</li>
33+
<li><code>actions/setup-go</code> has <code>cache: false</code>.</li>
34+
<li><code>Dockerfile</code> copies the full repository before building and runs <code>go build -mod=vendor</code>.</li>
35+
<li><code>go.mod</code> uses Go 1.25.0 and current dependencies are represented in <code>go.sum</code>.</li>
36+
</ul>
37+
</section>
38+
39+
<section>
40+
<h2>Desired Behavior</h2>
41+
<ul>
42+
<li><code>go.mod</code> and <code>go.sum</code> are the reviewable dependency boundary.</li>
43+
<li>CI builds, vets, and tests without <code>-mod=vendor</code>, with Go module caching enabled.</li>
44+
<li>Docker build has a stable module download layer: copy <code>go.mod</code>/<code>go.sum</code>, run <code>go mod download</code>, then copy source and build.</li>
45+
<li>Contributor docs describe normal Go module workflow.</li>
46+
<li>Implementation does not upgrade dependencies unless required by no-vendor build validation.</li>
47+
</ul>
48+
</section>
49+
50+
<section>
51+
<h2>Assumptions And Unknowns</h2>
52+
<ul>
53+
<li>Assumption: smaller PR diffs and OSS readability are more important than hermetic offline builds for this repository.</li>
54+
<li>Assumption: GitHub Actions and Docker builders may access the public Go module proxy.</li>
55+
<li>Unknown: whether any deployment environment requires offline Docker builds from a checked-in vendor tree.</li>
56+
<li>Unknown: whether branch protection currently requires the existing check name exactly; this can be handled in issue #152.</li>
57+
</ul>
58+
</section>
59+
60+
<section>
61+
<h2>Files Likely To Change</h2>
62+
<ul>
63+
<li><code>vendor/</code> - remove committed vendored dependencies if the decision is no-vendor.</li>
64+
<li><code>.github/workflows/ci.yml</code> - remove <code>-mod=vendor</code>, enable Go cache, and update comments.</li>
65+
<li><code>Dockerfile</code> - add module download layer and build without vendor mode.</li>
66+
<li><code>README.md</code>, <code>CONTRIBUTING.md</code>, <code>AGENTS.md</code>, <code>CLAUDE.md</code> - update build/dependency notes where relevant.</li>
67+
<li><code>.dockerignore</code> - add only if needed to keep Docker context clean after vendor removal.</li>
68+
</ul>
69+
</section>
70+
71+
<section>
72+
<h2>Implementation Steps</h2>
73+
<ol>
74+
<li>Confirm no explicit offline-build requirement exists in docs or deployment notes.</li>
75+
<li>Run <code>go mod tidy</code> and inspect whether <code>go.mod</code>/<code>go.sum</code> change.</li>
76+
<li>Update CI commands to remove <code>-mod=vendor</code> and enable setup-go cache.</li>
77+
<li>Restructure Dockerfile around <code>go mod download</code> and normal <code>go build</code>.</li>
78+
<li>Remove <code>vendor/</code> in one commit so dependency deletion is easy to review separately from logic changes.</li>
79+
<li>Update contributor docs and project agent docs to remove vendor assumptions.</li>
80+
<li>Validate local Go commands and Docker build; then rely on GitHub CI for clean checkout verification.</li>
81+
</ol>
82+
</section>
83+
84+
<section>
85+
<h2>Impact</h2>
86+
<ul>
87+
<li><strong>Build:</strong> CI and Docker become network-dependent during module download.</li>
88+
<li><strong>Runtime:</strong> no intended runtime image behavior change except build-stage dependency resolution.</li>
89+
<li><strong>Security/review:</strong> dependency review moves to <code>go.mod</code>/<code>go.sum</code> instead of large vendor diffs.</li>
90+
<li><strong>Deployment:</strong> normal GHCR build path should continue, but needs CI and Docker validation.</li>
91+
</ul>
92+
</section>
93+
94+
<section>
95+
<h2>Test Plan</h2>
96+
<ul>
97+
<li><code>go mod tidy</code></li>
98+
<li><code>go test ./...</code></li>
99+
<li><code>go vet ./...</code></li>
100+
<li><code>go build ./...</code></li>
101+
<li><code>docker build .</code></li>
102+
<li>After PR: verify GitHub Actions <code>Build, Vet &amp; Test</code> and Docker build jobs pass from a clean checkout.</li>
103+
</ul>
104+
</section>
105+
106+
<section class="risk">
107+
<h2>Risks And Edge Cases</h2>
108+
<ul>
109+
<li>Network or Go proxy outage can break builds that previously used the committed vendor tree.</li>
110+
<li>Large vendor deletion can obscure other changes; keep the PR focused.</li>
111+
<li>Docker layer caching must be structured correctly or builds get slower.</li>
112+
<li>If existing branch protection keys off exact check names, preserve names or coordinate via issue #152.</li>
113+
</ul>
114+
</section>
115+
116+
<section>
117+
<h2>Rollback Plan</h2>
118+
<p>Restore <code>vendor/</code>, restore <code>-mod=vendor</code> in CI and Dockerfile, run <code>go mod vendor</code>, and revert docs to vendored dependency workflow.</p>
119+
</section>
120+
121+
<section>
122+
<h2>Open Questions</h2>
123+
<ul>
124+
<li>Do we accept network-dependent CI/Docker builds for this repository?</li>
125+
<li>Should Docker use default Go proxy or an explicitly configured <code>GOPROXY</code>?</li>
126+
<li>Should this PR be split into two commits: config/docs first, vendor deletion second?</li>
127+
</ul>
128+
</section>
129+
130+
<section class="approval">
131+
<h2>Approval Gate</h2>
132+
<p>Approved by the user on 2026-06-06.</p>
133+
</section>
134+
135+
<section>
136+
<h2>Implementation Result</h2>
137+
<ul>
138+
<li>Removed the committed <code>vendor/</code> tree and <code>vendor/modules.txt</code>.</li>
139+
<li>Updated CI to use normal Go module resolution with setup-go caching enabled.</li>
140+
<li>Updated Dockerfile to copy <code>go.mod</code>/<code>go.sum</code>, run <code>go mod download</code>, then copy source and build without <code>-mod=vendor</code>.</li>
141+
<li>Added <code>.dockerignore</code> so Docker context excludes <code>.git</code>, local caches, docs plans, build outputs, and any accidental <code>vendor</code> directory.</li>
142+
<li>Updated README, CONTRIBUTING, AGENTS, and CLAUDE dependency workflow notes.</li>
143+
<li><code>go mod tidy</code> produced no semantic <code>go.mod</code>/<code>go.sum</code> changes.</li>
144+
</ul>
145+
</section>
146+
147+
<section>
148+
<h2>Verification Run</h2>
149+
<ul>
150+
<li><code>go mod tidy</code> with workspace-independent temporary <code>GOCACHE</code>.</li>
151+
<li><code>go test ./...</code></li>
152+
<li><code>go vet ./...</code></li>
153+
<li><code>go build ./...</code></li>
154+
<li><code>docker build -t health-receiver:no-vendor-smoke .</code></li>
155+
<li>Docker build context dropped from about 362 MB before <code>.dockerignore</code> to about 420 KB after it.</li>
156+
</ul>
157+
</section>
158+
159+
<section>
160+
<h2>Known Limitations</h2>
161+
<ul>
162+
<li>CI and Docker builds now require network access to the Go module proxy or configured module source.</li>
163+
<li>Clean-checkout verification is still delegated to GitHub Actions after PR creation.</li>
164+
</ul>
165+
</section>
166+
</main>
167+
</body>
168+
</html>

‎vendor/github.com/bahlo/generic-list-go/LICENSE‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎vendor/github.com/bahlo/generic-list-go/README.md‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

0 commit comments

Comments
 (0)