Verify vendor directory

[bobcatfish]

Expected Behavior

Running dep ensure (or whatever our DEVELOMENT.md says to run) should be a no-op on the repo unless deps have actually changed.

Actual Behavior

When I run dep ensure -v on the repo, I get a whole slew of changes to vendor/

Steps to Reproduce the Problem

1. Checkout repo
2. Install go dep
3. Run dep ensure -v

Additional Info

In the long run we'd like to use a script as part of CI to make sure vendor/ is kept in good shape on master. Potentially we can use:

• Skaffold's dep.sh
• knative/serving's update-deps.sh

[nader-ziada]

Looks like the Gopkg.lock file is missing the digest field which gets added by running dep ensure

[dprotaso]

If the digest fields are missing it means an older dep was used. We should be using the latest 0.5.0.

[nader-ziada]

Adding the script might be a too early now since it uses the test-infra repo but there is no code using that yet. In serving, its used by the e2e tests

[nader-ziada]

/assign @pivotal-nader-ziada

[bobcatfish]

Thanks for taking this on @pivotal-nader-ziada ! We don't have prow working yet (#15) so commands like /assign don't yet do anything 😅

[bobcatfish]

If the digest fields are missing it means an older dep was used. We should be using the latest 0.5.0.

Ah that probably explains the problem - we should add something to our DEVELOPMENT.md requirements about the version of dep.