cmd/go: support -mod=vendor and -mod=readonly together

[reefbarman]

What version of Go are you using (go version)?

$ go version
go version go1.11.5 windows/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\\AppData\Local\go-build
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOOS=windows
set GOPATH=C:\\Go
set GOPROXY=
set GORACE=
set GOROOT=C:\Go
set GOTMPDIR=
set GOTOOLDIR=C:\Go\pkg\tool\windows_amd64
set GCCGO=gccgo
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=C:\\\services\\go.mod
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=C:\Users\\AppData\Local\Temp\go-build195410922=/tmp/go-build -gno-record-gcc-switches

What did you do?

$ go build -mod=vendor -mod=readonly

What did you expect to see?

go build both using the vendor directory and respecting the readonly aspect of not modifying the go.mod file

What did you see instead?

go build not using vendoring

Basically in a CI pipeline I want the build to ensure the go.mod file is correct are represent the right dependencies while also download dependencies to the vendor directory so the CI pipeline can cache the download for the next run

[mvdan]

#30240 will allow automatic vendoring in module mode, so I presume you'll be able to drop -mod=vendor and still use the vendor folder. /cc @bcmills

[bcmills]

Semantically, -mod=readonly means “resolve module imports, but fail if they must be reconfigured”, while -mod=vendor means “resolve module imports only from the vendor directory”. There is no well-defined combination of those two meanings, since -mod=vendor already implies that we cannot modify the build list.

#30240, if accepted, will make -mod=readonly by itself use the vendor directory if present. I suspect that it will address your entire use-case, so I'm going to close this issue as a duplicate of that one.