vendor with go mod

.dockerignore

@@ -4,4 +4,6 @@
 /man/man*/
 /docs/yaml/gen/
 profile.out
-/vndr.log
+
+# top-level go.mod is not meant to be checked in
+/go.mod

.gitattributes

@@ -0,0 +1,3 @@
+Dockerfile* linguist-language=Dockerfile
+vendor.mod linguist-language=Go-Module
+vendor.sum linguist-language=Go-Checksums

.github/workflows/validate.yml

@@ -11,14 +11,15 @@ on:
   pull_request:
 
 jobs:
-  lint:
+  validate:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         target:
           - lint
           - shellcheck
+          - validate-vendor
     steps:
       -
         name: Checkout

.gitignore

@@ -15,4 +15,6 @@ Thumbs.db
 /man/man8/
 /docs/yaml/gen/
 profile.out
-/vndr.log
+
+# top-level go.mod is not meant to be checked in
+/go.mod

Makefile

@@ -49,11 +49,18 @@ dynbinary: ## build dynamically linked binary
 plugins: ## build example CLI plugins
 	./scripts/build/plugins
 
-vendor: vendor.conf ## check that vendor matches vendor.conf
+.PHONY: vendor
+vendor: ## update vendor with go modules
 	rm -rf vendor
-	bash -c 'vndr |& grep -v -i clone | tee ./vndr.log'
-	scripts/validate/check-git-diff vendor
-	scripts/validate/check-all-packages-vendored
+	./scripts/vendor update
+
+.PHONY: validate-vendor
+validate-vendor: ## validate vendor
+	./scripts/vendor validate
+
+.PHONY: mod-outdated
+mod-outdated: ## check outdated dependencies
+	./scripts/vendor outdated
 
 .PHONY: authors
 authors: ## generate AUTHORS file from git history
@@ -73,6 +80,5 @@ help: ## print this help
 
 .PHONY: ci-validate
 ci-validate:
-	time make -B vendor
 	time make manpages
 	time make yamldocs

docker-bake.hcl

@@ -78,6 +78,28 @@ target "shellcheck" {
     output = ["type=cacheonly"]
 }
 
+target "validate-vendor" {
+    dockerfile = "./dockerfiles/Dockerfile.vendor"
+    target = "validate"
+    output = ["type=cacheonly"]
+}
+
+target "update-vendor" {
+    dockerfile = "./dockerfiles/Dockerfile.vendor"
+    target = "update"
+    output = ["."]
+}
+
+target "mod-outdated" {
+    dockerfile = "./dockerfiles/Dockerfile.vendor"
+    target = "outdated"
+    args = {
+        // used to invalidate cache (more info https://github.com/moby/buildkit/issues/1213)
+        UUID = uuidv4()
+    }
+    output = ["type=cacheonly"]
+}
+
 target "test" {
     target = "test"
     output = ["type=cacheonly"]

docker.Makefile

@@ -80,8 +80,20 @@ fmt: ## run gofmt
 	$(DOCKER_RUN) $(DEV_DOCKER_IMAGE_NAME) make fmt
 
 .PHONY: vendor
-vendor: build_docker_image vendor.conf ## download dependencies (vendor/) listed in vendor.conf
-	$(DOCKER_RUN) -it $(DEV_DOCKER_IMAGE_NAME) make vendor
+vendor: ## update vendor with go modules
+	$(eval $@_TMP_OUT := $(shell mktemp -d -t dockercli-output.XXXXXXXXXX))
+	docker buildx bake --set "*.output=$($@_TMP_OUT)" update-vendor
+	rm -rf ./vendor
+	cp -R "$($@_TMP_OUT)"/out/* .
+	rm -rf $($@_TMP_OUT)/*
+
+.PHONY: validate-vendor
+validate-vendor: ## validate vendor
+	docker buildx bake validate-vendor
+
+.PHONY: mod-outdated
+mod-outdated: ## check outdated dependencies
+	docker buildx bake mod-outdated
 
 .PHONY: authors
 authors: ## generate AUTHORS file from git history

dockerfiles/Dockerfile.dev

@@ -12,13 +12,6 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=tmpfs,target=/go/src/ \
     GO111MODULE=on go install gotest.tools/gotestsum@${GOTESTSUM_VERSION}
 
-FROM golang AS vndr
-ARG VNDR_VERSION=v0.1.2
-RUN --mount=type=cache,target=/root/.cache/go-build \
-    --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=tmpfs,target=/go/src/ \
-    GO111MODULE=on go install github.com/LK4D4/vndr@${VNDR_VERSION}
-
 FROM golang AS goversioninfo
 ARG GOVERSIONINFO_VERSION=v1.3.0
 RUN --mount=type=cache,target=/root/.cache/go-build \
@@ -39,7 +32,6 @@ CMD bash
 ENV DISABLE_WARN_OUTSIDE_CONTAINER=1
 ENV PATH=$PATH:/go/src/github.com/docker/cli/build
 
-COPY --from=vndr            /go/bin/* /go/bin/
 COPY --from=gotestsum       /go/bin/* /go/bin/
 COPY --from=goversioninfo   /go/bin/* /go/bin/
 

dockerfiles/Dockerfile.vendor

@@ -0,0 +1,41 @@
+# syntax=docker/dockerfile:1.3-labs
+
+ARG GO_VERSION=1.16.11
+ARG MODOUTDATED_VERSION=v0.8.0
+
+FROM golang:${GO_VERSION}-alpine AS base
+RUN apk add --no-cache bash git rsync
+WORKDIR /src
+
+FROM base AS vendored
+RUN --mount=target=/context \
+    --mount=target=.,type=tmpfs  \
+    --mount=target=/go/pkg/mod,type=cache <<EOT
+set -e
+rsync -a /context/. .
+./scripts/vendor update
+mkdir /out
+cp -r vendor.mod vendor.sum vendor /out
+EOT
+
+FROM scratch AS update
+COPY --from=vendored /out /out
+
+FROM vendored AS validate
+RUN --mount=target=/context \
+    --mount=target=.,type=tmpfs <<EOT
+set -e
+rsync -a /context/. .
+git add -A
+rm -rf vendor
+cp -rf /out/* .
+./scripts/vendor validate
+EOT
+
+FROM psampaz/go-mod-outdated:${MODOUTDATED_VERSION} AS go-mod-outdated
+FROM base AS outdated
+ARG UUID
+RUN --mount=target=.,rw \
+    --mount=target=/go/pkg/mod,type=cache \
+    --mount=from=go-mod-outdated,source=/home/go-mod-outdated,target=/usr/bin/go-mod-outdated \
+    ./scripts/vendor outdated

man/import.go

@@ -3,5 +3,5 @@
 package main
 
 // Not used, but required for generating other man pages.
-// Import it here so that the package is included by vndr.
+// Import it here so that the package is included by go modules.
 import _ "github.com/cpuguy83/go-md2man/v2"

scripts/vendor

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+set -eu
+
+TYP=$1
+
+usage() {
+  echo "usage: ./scripts/vendor <update|validate|outdated>"
+  exit 1
+}
+
+if [ -z "$TYP" ]; then
+  usage
+fi
+
+# create dummy go.mod, see comment in vendor.mod
+cat > go.mod <<EOL
+module github.com/docker/cli
+
+go 1.16
+EOL
+
+update() {
+  (set -x ; go mod vendor -modfile=vendor.mod)
+}
+
+validate() {
+  (set -x ; go mod tidy -modfile=vendor.mod)
+  diff=$(git status --porcelain -- vendor.mod vendor.sum vendor)
+  if [ -n "$diff" ]; then
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "make -f docker.Makefile vendor"'
+    echo "$diff"
+    exit 1
+  fi
+}
+
+outdated() {
+  if [ ! -x "$(command -v go-mod-outdated)" ]; then
+    echo "go-mod-outdated not found. Install with 'go install github.com/psampaz/go-mod-outdated@v0.8.0'"
+    exit 1
+  fi
+  (set -x ; go list -mod=vendor -mod=readonly -modfile=vendor.mod -u -m -json all | go-mod-outdated -update -direct)
+}
+
+case $TYP in
+  "update")
+    update
+    ;;
+  "validate")
+    update
+    validate
+    ;;
+  "outdated")
+    outdated
+    ;;
+  *)
+    echo >&2 "Unknown type $TYP"
+    exit 1
+    ;;
+esac