Go Dependencies via govendor

Last updated 23 June 2020

This guide outlines how to fully use Heroku’s support for deploying Go applications that use govendor to manage the vendoring of dependencies.

The govendor FAQ covers the most common usage of the tool. We’ll cover the most common activities below.

Build configuration

When pushing code that uses govendor, Heroku will use several entries in the vendor/vendor.json file created by govendor to configure your build. These entries are:

• rootPath (String): the root package name of the packages you are pushing to Heroku. You can find this locally with go list -e .. There is no default for this and it must be specified. Recent versions of govendor automatically fill in this field for you. You can re-run govendor init after upgrading to have this field filled in automatically, or it will be filled the next time you use govendor to modify a dependency.

• heroku.goVersion (String): the major version of Go you would like Heroku to use when compiling your code. If not specified, Heroku defaults to the most recent supported version of Go.

• heroku.install (Array of Strings): a list of the packages you want Heroku to install. If not specified, this defaults to ["."]. Other common choices are: ["./cmd/..."] (all packages and sub packages in the cmd directory) and ["./..."] (all packages and sub packages of the current directory). The exact choice depends on the layout of your repository. Please note that ./... includes any packages in your vendor directory.

• heroku.sync (Boolean): By default Heroku runs govendor sync to ensure that the contents of vendor are what is specified in vendor.json. Sometimes there are reasons to not do this. Setting heroku.sync to false disables govendor sync.

Here is an example of these fields for a project using go1.6, located on your local machine at $GOPATH/src/github.com/heroku/go-getting-started and requiring a single package spec of ./... to install.

{
    ...
    "rootPath": "github.com/heroku/go-getting-started",
    "heroku": {
        "install" : [ "./..." ],
        "goVersion": "go1.6"
         },
    ...
}

You will need to use a text editor or a tool like jq to edit the vendor/vendor.json file if you need to configure the heroku.install or heroku.goVersion entries.

Ignored vendor/ sub directories

As specified in the govendor FAQ, vendor/*/ can be added to your .gitignore file, excluding any vendored code from being included in git.

Heroku runs govendor sync before running go install whenever govendor is detected. This is done to ensure that all dependencies specified in vendor.json are installed in your application’s vendor/ directory.

Install or update govendor

$ go get -u github.com/kardianos/govendor

That command downloads or updates the package containing the tool, placing the source code in $GOPATH/src/github.com/kardianos/govendor and then compiles the package, placing the govendor binary in $GOPATh/bin.

Getting started

1. govendor init
2. Inspect the changes with git diff (or similar).
3. Commit the changes with git add -A vendor; git commit -am "Setup Vendor"

This creates a vendor/ directory and a vendor.json file in that directory.

Adding dependencies

1. govendor fetch <package>
2. Inspect the changes with git diff (or similar).
3. Commit the changes with git add -A vendor; git commit -am "Add dependency <package>"

The package spec that govendor takes can also contain a version spec consisting of a tag or commit SHA of the specific revision of packages that you want to install to vendor/. For example, if you want to install v0.9.0 of the package github.com/Sirupsen/logrus you would run govendor fetch github.com/Sirupsen/logrus@v0.9.0. When a version spec is not supplied, the most recent commit is used.

Dependency status

$ govendor list
 v  github.com/gin-gonic/gin
 v  github.com/gin-gonic/gin/binding
 v  github.com/gin-gonic/gin/render
 v  github.com/manucorporat/sse
 v  github.com/mattn/go-colorable
 v  github.com/mattn/go-isatty
 v  golang.org/x/net/context
 v  gopkg.in/bluesuncorp/validator.v5
pl  github.com/heroku/go-getting-started/cmd/go-getting-started

This shows the different packages in use for the current project. See the govendor -h section named Status Types for a full description of what each letter means.

Updating an existing dependency

1. govendor fetch <package>@<version>
2. Inspect the changes with git diff (or similar).
3. Commit the changes with git add -A vendor; git commit -m "Update <dependency>".

Just like when adding a new dependency, fetch can be used to update an existing dependency by fetching it and recording the update to vendor/vendor.json.

Removing unused dependencies

1. govendor remove +u
2. Inspect the changes with git diff (or similar).
3. Commit the changes with git add -A vendor; git commit -m "Remove unused dependencies".

This removes all unused dependencies. You may want to check the output of govendor list +u first to see what govendor sees as being unused.