x/exp/cmd/gorelease returns error: "go: updates to go.sum needed, disabled by -mod=readonly"

[clambin]

What version of Go are you using (go version)?

$ go version
go version go1.20.5 darwin/amd64

Does this issue reproduce with the latest release?

On latest

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/christophe/Library/Caches/go-build"
GOENV="/Users/christophe/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/christophe/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/christophe/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/opt/go/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/opt/go/libexec/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.20.5"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="cc"
CXX="c++"
CGO_ENABLED="1"
GOMOD="/Users/christophe/GolandProjects/tado/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/qv/91w11htj7jz9zn4qm0gq81bw0000gr/T/go-build3558913071=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

When I try gorelease on my packages, it returns an error: "go: updates to go.sum needed, disabled by -mod=readonly". Yet, no changes are needed: "go mod tidy" doesn't make any changes.

Going through the code, I think it's because of this call:

% go list -json -m -u all
go: updates to go.sum needed, disabled by -mod=readonly

Without either the '-u' or 'all', the command works successfully.

Can be reproduced with repo https://github.com/clambin/tado on the oauth2 branch. The only difference on that branch is the inclusion of golang.org/x/oauth2@v0.9.0. On the main branch, where this module isn't included, gorelease works just fine.

[bcmills]

Duplicate of #60698