Switch to letting go get mutate go.mod

go_modules/lib/dependabot/go_modules/file_updater/go_mod_updater.rb

@@ -96,11 +96,6 @@ def update_files # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
             # Bump the deps we want to upgrade using `go get lib@version`
             run_go_get(dependencies)
 
-            # Run `go get`'s internal validation checks against _each_ module in `go.mod`
-            # by running `go get` w/o specifying any library. It finds problems like when a
-            # module declares itself using a different name than specified in our `go.mod` etc.
-            run_go_get
-
             # If we stubbed modules, don't run `go mod {tidy,vendor}` as
             # dependencies are incomplete
             if substitutions.empty?
@@ -169,11 +164,21 @@ def run_go_get(dependencies = [])
           command = +"go get -d"
           # `go get` accepts multiple packages, each separated by a space
           dependencies.each do |dep|
+            # Use version pinning rather than `latest` just in case
+            # a new version gets released in the middle of our run.
             version = "v" + dep.version.sub(/^v/i, "")
             command << " #{dep.name}@#{version}"
           end
           command = SharedHelpers.escape_command(command)
+          _, stderr, status = Open3.capture3(ENVIRONMENT, command)
+          handle_subprocess_error(stderr) unless status.success?
 
+          # Hmm... I'm still unclear/digging to understand why we'd need a blank `go get -d`
+          # possibly re-jigger func defs
+          # https://github.com/dependabot/dependabot-core/pull/3590#discussion_r632456405
+          # TODO: go 1.18 will make `-d` the default behavior, so remove the flag then
+          command = "go get -d"
+          command = SharedHelpers.escape_command(command)
           _, stderr, status = Open3.capture3(ENVIRONMENT, command)
           handle_subprocess_error(stderr) unless status.success?
         ensure

go_modules/spec/dependabot/go_modules/file_updater/go_mod_updater_spec.rb

@@ -273,12 +273,23 @@
             # OpenAPIV2 has been renamed to openapiv2 in this version
             let(:dependency_version) { "v0.5.1" }
 
-            it "raises a DependencyFileNotResolvable error" do
-              error_class = Dependabot::DependencyFileNotResolvable
+            # NOTE: We explicitly don't want to raise a resolvability error from `go mod tidy`
+            it "does not raises a DependencyFileNotResolvable error" do
               expect { updater.updated_go_sum_content }.
-                to raise_error(error_class) do |error|
-                expect(error.message).to include("googleapis/gnostic/OpenAPIv2")
-              end
+                to_not raise_error
+            end
+
+            it "updates the go.mod" do
+              # this is failing, but I'm not sure why.
+              # The code runs `go get -d github.com/googleapis/[email protected]`
+              # and then later runs `go mod tidy -e`.
+              # So I manually ran those in the test fixture, and it resulted in
+              # this line appearing. But when the test executes, this line is missing.
+              # I'm not sure why, and not sure how to run the Ruby debugger
+              # to step through it.
+              expect(updater.updated_go_mod_content).to include(
+                %(github.com/googleapis/gnostic v0.5.1\n)
+              )
             end
           end
         end
@@ -338,7 +349,8 @@
 
       before do
         allow(Open3).to receive(:capture3).and_call_original
-        allow(Open3).to receive(:capture3).with(anything, "go get -d").and_return(["", stderr, exit_status])
+        cmd = "go get -d github.com/spf13/[email protected]"
+        allow(Open3).to receive(:capture3).with(anything, cmd).and_return(["", stderr, exit_status])
       end
 
       it { expect { subject }.to raise_error(Dependabot::DependencyFileNotResolvable, /The remote end hung up/) }

go_modules/spec/dependabot/go_modules/file_updater_spec.rb

@@ -104,9 +104,11 @@ module declares its path as: go.etcd.io/bbolt
       before do
         exit_status = double(success?: false)
         allow(Open3).to receive(:capture3).and_call_original
-        allow(Open3).to receive(:capture3).with(anything, "go get -d").and_return(["", stderr, exit_status])
+        cmd = "go get -d github.com/etcd-io/[email protected]"
+        allow(Open3).to receive(:capture3).with(anything, cmd).and_return(["", stderr, exit_status])
       end
 
+      # This is failing and I'm not sure why...
       it "raises a helpful error" do
         expect { updated_files }.to raise_error(Dependabot::GoModulePathMismatch)
       end