Go "cannot find package" (vendor stale) - Fix in CI

With a vendor directory present, Go builds from vendor and ignores the module cache. When go.mod requires a package that vendor/ does not contain, the build cannot find it.

What this error means

A vendored build fails with cannot find package "X" in any of: ... vendor/X. A dependency was added to go.mod but go mod vendor was not re-run, so vendor/ is missing it.

cannot find package "github.com/spf13/cobra" in any of:
	/app/vendor/github.com/spf13/cobra (vendor tree)
	/usr/local/go/src/github.com/spf13/cobra (from $GOROOT)

Common causes

New dependency not vendored

go.mod gained a require but go mod vendor was never re-run, so vendor/ has no copy of the package.

vendor/modules.txt out of sync

The vendor manifest does not match go.mod, so Go treats the tree as incomplete and refuses the package.

How to fix it

Re-vendor and commit

Run go mod vendor locally to rebuild the vendor tree.
Commit vendor/ and vendor/modules.txt so CI builds from a complete tree.

shell

go mod tidy
go mod vendor
git add vendor go.mod go.sum

Verify vendoring in CI

Re-run vendor in CI and fail if it changes anything tracked.

.github/workflows/ci.yml

- run: go mod vendor
- run: git diff --exit-code vendor

How to prevent it

Run go mod vendor whenever you change go.mod, and commit the result.
Add a CI check that go mod vendor produces no diff.
Build with -mod=vendor so drift fails loudly.