[Go] fix: add testify dependency to go.mod and go.sum unconditionally

IN
8h ago
+281-15

Fixes #25270.

The go generator's go.mod.mustache placed the testify dependency inside the {{#hasOAuthMethods}} conditional (introduced in v7.15.0), even though the generated test files import testify unconditionally. As a result:

  • specs without OAuth2 got a go.mod without testify, so go test ./... failed out of the box;
  • go.sum never contained the testify checksums, so even specs with OAuth2 failed.

What changed

  • go.mod.mustache:
    • github.com/stretchr/testify is now an unconditional direct dependency;
    • added the // indirect require block (go-spew, go-difflib, yaml.v3) needed by Go 1.17+ module graph pruning so the generated tests compile without running go mod tidy;
    • bumped the go directive from 1.23 to 1.23.0 — golang.org/x/oauth2 v0.27.0 declares a patch-style go directive, and with the plain go 1.23 directive any read-only module load (go build / go test without -mod=mod) fails with "updates to go.mod needed".
  • go.sum.mustache: added checksums for testify and its transitive graph (go-spew, go-difflib, yaml.v3, check.v1), plus go-cmp v0.5.9 (required by the oauth2 v0.27.0 module graph, kept inside the {{#hasOAuthMethods}} block). All checksums verified against sum.golang.org.
  • Added a regression test in GoClientCodegenTest that generates a client from echo_api.yaml (a spec without OAuth2) and asserts testify is present in both go.mod and go.sum.
  • Regenerated all samples produced by the go generator configs.

Verification

With Go 1.23 (docker, default read-only module mode — no -mod=mod, no go mod tidy):

  • samples/client/petstore/go/go-petstore (OAuth2 spec): go build ./... OK, test compilation OK;
  • samples/client/echo_api/go (no OAuth2): go build ./... OK;
  • go mod tidy on the regenerated output results in no go.mod changes (it only suggests adding the optional toolchain line, which is environment-specific and intentionally omitted from the template).

Note: go test compilation of the echo_api sample's test/ package fails with undefined: StringEnumRef. This is a pre-existing, unrelated generator bug — a $ref'd enum path parameter is emitted without the package qualifier in api_test.mustache (it fails the same way on master with -mod=mod and is unaffected by this change, which only touches go.mod/go.sum).

PR checklist

  • Read the contribution guidelines.
  • Ran ./mvnw clean package and regenerated samples via ./bin/generate-samples.sh (the individual go generator configs); no files deleted.
  • Pull request is created against the master branch.
  • @wing328 (Go technical committee) for visibility.

Summary by cubic

Fixes #25270. The Go generator no longer produces clients that fail go test out of the box: testify is now added to go.mod and go.sum unconditionally. Previously the dependency was only included inside the {{#hasOAuthMethods}} conditional, so specs without OAuth2 got a go.mod missing the dependency their generated tests import, and go.sum never contained the testify checksums.

Bug Fixes

  • Moves testify out of the OAuth2 conditional and adds the // indirect requires needed by Go 1.17+ module graph pruning.
  • Bumps the go directive to 1.23.0 because golang.org/x/oauth2 v0.27.0 declares a patch-style directive, which breaks read-only module loads with plain go 1.23.
  • Adds the missing go.sum checksums for testify and its transitive graph (go-spew, go-difflib, yaml.v3, check.v1, and go-cmp for the OAuth2 path).
  • Adds a regression test that generates a client from a spec without OAuth2 and asserts testify is present in both go.mod and go.sum.
  • Regenerates all go generator samples, including the previously missed oneof-not-enum sample.