Best practice for provisioning the mod tool for gomodUpdateImportPaths on self-hosted (non-containerbase) Renovate?

[aglees]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub Enterprise Server

Which version of Renovate are you using?

v43

Please tell us more about your question or problem

We self-host Renovate (v43) as a global npm install on our own image (not renovate/renovate, so effectively binarySource=global, non-containerbase) and recently enabled gomodUpdateImportPaths (with gomodTidy) so Go major bumps come through with import paths rewritten rather than as incomplete PRs.

From reading gomod/artifacts.ts and a real run, we see Renovate unconditionally prepends go install github.com/marwan-at-work/mod/cmd/mod@ then mod upgrade …. It sets GOPATH but not GOBIN, so the install targets our image's inherited GOBIN (/usr/local/bin, root-owned); as a non-root runner that failed with permission denied. We fixed it by pointing GOBIN at a writable dir that's also on PATH.

A few best-practice questions:

1. For non-containerbase / binarySource=global setups, is the runtime go install …/mod the intended provisioning path? If so, what environment assumptions should we meet — i.e. a writable GOBIN on PATH and Go module-proxy egress at PR time — or is pre-installing mod (or a different binarySource) recommended?
2. Supply chain: the install defaults to @latest, and mod runs with access to the repo (and, in many self-hosted setups, secrets in the env). Is constraints.gomodMod the canonical way to pin it, and would you recommend pinning as a best practice? Any appetite for pinning/vendoring the tool by default?
3. If this provisioning/supply-chain guidance isn't documented, would a short addition to golang.md be welcome? Happy to open a PR.

(We've read the Go-modules docs and #20125 / #20996 / #19601 — those cover feature behaviour rather than self-hosted provisioning, hence this question.)

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[jamietanna]

Re 1, I'd happened to see renovatebot/base-image#193 yesterday which talks about the same issue - I think that preinstalling mod in the -full image is reasonable. PR welcome :)

Re 2 that's fair - and something I've thought about in the past but never got around to solving. Given we have the constraints.gomodMod for this, I think we could:

• Set the default constraints.gomodMod to be the current latest SemVer tag for mod
• Set Renovate to update that version as new releases are made

That'd mean that it'd definitely be a pinned version, and folks who wish to explicitly change the version can continue using constraints.gomodMod, but we'd no longer use @latest

[jamietanna]

in many self-hosted setups, secrets in the env

Via and a read of lib/modules/manager/gomod/artifacts.ts, I guess the "only" secret that would be there by default would be if there are any private modules you're needing to authenticate with, which is fair to call out

[jamietanna]

Related: #41817