Go "GOFLAGS: ... not allowed" / GONOSUMCHECK Errors - Fix in CI
By Kaveh Alemi·Latchkey
Go reads GOFLAGS, GONOSUMDB, and the legacy GONOSUMCHECK from the environment. A malformed value - a flag that go does not accept, or a deprecated variable used where Go now expects GONOSUMDB/GOPRIVATE - makes the command fail before it does any module work.
What this error means
A go command fails immediately with go: GOFLAGS=...: ... not allowed or warns that GONOSUMCHECK is ignored and modules are still sent to the sum database. The failure is environment-driven and reproduces on every run with that env.
go output
go: GOFLAGS=-mod readonly: space-separated list contains "-mod readonly",
which is not a valid flag
# or the legacy variable having no effect:
go: warning: GONOSUMCHECK is no longer supported; use GONOSUMDB or GOPRIVATE
Diagnose it: module path, proxy, or checksum?
Go module errors name the module but rarely the layer that failed. Separate the three: the module path does not resolve, the proxy cannot serve it, or the checksum database disagrees with what was downloaded.
Terminal
# what Go resolves and from where
go env GOPROXY GOSUMDB GOPRIVATE GOFLAGS
# does the module resolve at all, bypassing the build?
go list -m -versions github.com/org/module
# verify the module cache against go.sum
go mod verify
# private modules must be excluded from proxy and sumdb
go env -w GOPRIVATE=github.com/yourorg/*
Common causes
A malformed GOFLAGS value
GOFLAGS must be a space-separated list of valid flags. A value like -mod readonly (space instead of =) or an unknown flag is rejected.
Using deprecated GONOSUMCHECK
Modern Go uses GONOSUMDB/GOPRIVATE to skip the checksum database. A leftover GONOSUMCHECK is ignored, so modules you meant to exempt still hit the sum DB.
How to fix it
Write GOFLAGS as valid flags
Each flag must use = for its value, separated by spaces.
Terminal
export GOFLAGS="-mod=readonly -trimpath"
go build ./...
Replace GONOSUMCHECK with GONOSUMDB / GOPRIVATE
Use the supported variables to skip the sum database for trusted paths.
Terminal
export GONOSUMDB=github.com/yourorg/*
# or, more broadly:
export GOPRIVATE=github.com/yourorg/*
Inspect the effective environment
Terminal
go env GOFLAGS GONOSUMDB GOPRIVATE
How to prevent it
Set GOFLAGS as a space-separated list of =-valued flags.
Use GONOSUMDB/GOPRIVATE, not the deprecated GONOSUMCHECK.
Verify env with go env so a bad value fails locally, not just in CI.
Frequently asked questions
What causes Go "GOFLAGS: ... not allowed" / GONOSUMCHECK errors?
There are 2 common causes: a malformed goflags value and using deprecated gonosumcheck. GOFLAGS must be a space-separated list of valid flags.
How do I fix Go "GOFLAGS: ... not allowed" / GONOSUMCHECK errors?
There are 3 fixes depending on which cause you have: write goflags as valid flags, replace gonosumcheck with gonosumdb / goprivate, and inspect the effective environment. Work through them in order, since the first is the most common.
What does Go "GOFLAGS: ... not allowed" / GONOSUMCHECK errors actually mean?
A go command fails immediately with go: GOFLAGS=...: ...
How do I stop Go "GOFLAGS: ... not allowed" / GONOSUMCHECK errors happening again?
Set GOFLAGS as a space-separated list of =-valued flags. The prevention section lists 3 changes that keep it from recurring.
