[Feature] bzlmod & go.work

[stefanpenner]

What type of PR is this?
Feature

What package or component does this PR mostly affect?
language/go

What does this PR do? Why is it needed?

Explores a possible approach for adding go.work support to the go bzlmod extension.

1. adds go_deps.from_file(go_work = "//:go.work")
2. adds ability to op-out of version conflict failures go_deps.from_file(go_work = "//:go.work, fail_on_version_conflict = False)
3. parses go.work files to discover used go modules and replace statements
4. generates repos for all deps specified in go.mod's referenced by the //:go.work
5. handle replace statements (both at the go.work and the go.mod level)
6. Errors with actionable error message if duplicate dependencies with differing versions arise (Question: can we do better?)

Which issues(s) does this PR fix?

Fixes #1720 #1549

Other notes for review

Although this does work, it should be considered a prototype intended for discussion and feedback. If we decide to pursue this or something similar, expect this PR to evolve rapidly. Although it has some tests, it will require more. Additionally, some architectural changes may improve readability.

---

An additional consideration, a complementary PR to teach gazelle about go.work + go.mods would help mitigate the dependency bleed problem this PR has. We should discuss this as well.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[stefanpenner]

Although I have signed the CLA already, I have two user accounts in the commits. Let me fix that...

[stefanpenner]

TODO (from call with team):

• only support from_file(go_work = ...) from root modules. (check is_root property of the module)
• double check that multiple from_file calls is disallowed
• mandate that from_file is called with only one go_work, or go_mod attribute, and not none.
• make tests/bcr use go.work
• add additional unit test support
• tidy-up

[stefanpenner]

• Debugging BCR tests, I realized this also needs to work properly with Let bazel_deps replace Go deps #1526 ... so Adding a todo.

[fmeum]

Sounds good, remaining comments are all just nits in changed code.

[stefanpenner]

I believe I have a reasonable resolution to the issue I noticed, working to implement the fix now. Let's see how it goes :)

[stefanpenner]

I believe I have a reasonable resolution to the issue I noticed, working to implement the fix now. Let's see how it goes :)

TL;DR: Within a go.work, if module A depends on an external module B (not in go.work), and B in turn depends on module C which is included in the go.work, then the version of C referenced by B will differ from the version of C that is directly included in the go.work.

Our team has been describing this the "the sandwich problem".

In general, a well formed workspace must not contain the the sandwich problem as even in a perfectly functioning system this scenario will be a source of headaches and confusion.

I did spend some time seeing if we can easily address this but with my limited understanding of gazelle I couldn't come up with a reasonable solution that didn't result in a whole new feature. That being said, someone with more expertise may have a good idea here that I'm missing.

Given this, my recommendation is:

1. proceed with this PR
2. separately explore how to enable this capability within gazelle and then add this capability in the future.

[fmeum]

Agreed, let's merge this and as a follow-up:

1. Resolve the problem you mentioned.
2. Add docs to our Bzlmod guide.

[fmeum]

Thanks for working on this large project!