Go "GOFLAGS: ... not allowed" / GONOSUMCHECK Errors - Fix in CI

Go reads GOFLAGS, GONOSUMDB, and the legacy GONOSUMCHECK from the environment. A malformed value - a flag that go does not accept, or a deprecated variable used where Go now expects GONOSUMDB/GOPRIVATE - makes the command fail before it does any module work.

What this error means

A go command fails immediately with go: GOFLAGS=...: ... not allowed or warns that GONOSUMCHECK is ignored and modules are still sent to the sum database. The failure is environment-driven and reproduces on every run with that env.

go: GOFLAGS=-mod readonly: space-separated list contains "-mod readonly",
	which is not a valid flag

# or the legacy variable having no effect:
go: warning: GONOSUMCHECK is no longer supported; use GONOSUMDB or GOPRIVATE

Common causes

A malformed GOFLAGS value

GOFLAGS must be a space-separated list of valid flags. A value like -mod readonly (space instead of =) or an unknown flag is rejected.

Using deprecated GONOSUMCHECK

Modern Go uses GONOSUMDB/GOPRIVATE to skip the checksum database. A leftover GONOSUMCHECK is ignored, so modules you meant to exempt still hit the sum DB.

How to fix it

Write GOFLAGS as valid flags

Each flag must use = for its value, separated by spaces.

export GOFLAGS="-mod=readonly -trimpath"
go build ./...

Replace GONOSUMCHECK with GONOSUMDB / GOPRIVATE

Use the supported variables to skip the sum database for trusted paths.

export GONOSUMDB=github.com/yourorg/*
# or, more broadly:
export GOPRIVATE=github.com/yourorg/*

Inspect the effective environment

go env GOFLAGS GONOSUMDB GOPRIVATE

How to prevent it

• Set GOFLAGS as a space-separated list of =-valued flags.
• Use GONOSUMDB/GOPRIVATE, not the deprecated GONOSUMCHECK.
• Verify env with go env so a bad value fails locally, not just in CI.

Related guides