What Are Go Modules? Go Dependency Management Explained
Go modules are Go's built-in dependency system: go.mod declares your module and its requirements, and go.sum locks them down for reproducible builds.
Go modules replaced the old GOPATH workspace model and gave Go versioned, reproducible dependencies. With modules, any directory containing a go.mod is a buildable project, and the Go toolchain handles fetching and verifying everything it needs.
What Go modules are
A Go module is a collection of packages with a go.mod file at its root that declares the module path, the Go version, and the required dependencies. The companion go.sum file records cryptographic checksums of every dependency so the toolchain can verify they have not changed.
How they work
When you import a package and build, Go resolves the needed versions using minimal version selection and downloads them through a module proxy, caching them locally. go.mod is updated with the requirements and go.sum with their checksums. This makes builds reproducible: the same go.mod and go.sum produce the same dependency set everywhere.
A usage example
Initialize a module, add a dependency by importing and tidying.
# create a module
go mod init example.com/myapp
# add or prune dependencies to match the code
go mod tidy
# build and test
go build ./...
go test ./...Role in CI/CD
In CI, "go build" and "go test" resolve dependencies from go.mod, and go.sum verification guards against tampering. Running "go mod verify" or checking that "go mod tidy" produces no diff catches dependency drift. Caching the Go module cache and build cache between runs avoids re-downloading and recompiling, which speeds up every job.
Alternatives
Before modules, Go used GOPATH plus third-party tools like dep and glide; modules made those obsolete. Within the modules era, the only choices are configuration details like which module proxy to use. For very large monorepos, some teams add Bazel on top, but go.mod remains the foundation.
Key takeaways
- Go modules manage dependencies via go.mod (requirements) and go.sum (checksums).
- They make builds reproducible and replaced the old GOPATH model.
- Cache the module and build caches in CI; verify go.sum to prevent drift.