Just when I thought js/ts is a mess with its npm, I ran into GO

$ xk6 build --with gitlab.com/<...>
smth wrong with module name

*fixes module name*
$ git push
$ xk6 build --with gitlab.com/<...>
smth wrong with module name
*go pulls initial commit instead of the last one*

$ go clean [or wtv it's called]
$ xk6 build --with gitlab.com/<...>
smth wrong with module name
*go pulls initial commit instead of the last one*

$ cd /tmp
$ xk6 build --with gitlab.com/<...>
OK

oh well... I guess this is how it's gonna be

"go mod tidy" ftw.
Usually. otherwise, you have to pull the dependent module from the remote git, and set up a replace directive in the go.mod file.

@magicMirror ran that (this is what I meant by `go clean`), didn't help. Next compilation logs that it's pulling the initial commit's hash

@netikras
That happen when the go.mod of a dependent module has that hash specified. Need update that one....

go has a graph dependency command - should show which module imports which dependcy.

That is not Go. Wtf is xk6?

@hjk101 k6 extensions. Written in go

@netikras ah, that sounds like an apt name for that. Odd that it has its own build wrapper around Go.

One of the more confusing things is that the import name does not have to be equal to the github url. Check the go.mod file or docs for that.
There are always bad actors in community repos Go is not immune to that. I have used Benthos and that has a shitload of deps. Some are not v1+ so are allowed to have breaking changes. Some are however and still change exported function signatures.

Fortunately I've only run into stuff breaking 5 times in 10+ years of Go development and even the first projects still compile. Also a lot of third party shenanigans can be fixed using replace in the go.mod file.