Go "GOFLAGS: ... not allowed" / GONOSUMCHECK Errors - Fix in CI

By Kaveh Alemi·Latchkey

Go reads GOFLAGS, GONOSUMDB, and the legacy GONOSUMCHECK from the environment. A malformed value - a flag that go does not accept, or a deprecated variable used where Go now expects GONOSUMDB/GOPRIVATE - makes the command fail before it does any module work.

What this error means

A go command fails immediately with go: GOFLAGS=...: ... not allowed or warns that GONOSUMCHECK is ignored and modules are still sent to the sum database. The failure is environment-driven and reproduces on every run with that env.

go: GOFLAGS=-mod readonly: space-separated list contains "-mod readonly",
	which is not a valid flag

# or the legacy variable having no effect:
go: warning: GONOSUMCHECK is no longer supported; use GONOSUMDB or GOPRIVATE

Diagnose it: module path, proxy, or checksum?

Go module errors name the module but rarely the layer that failed. Separate the three: the module path does not resolve, the proxy cannot serve it, or the checksum database disagrees with what was downloaded.

# what Go resolves and from where
go env GOPROXY GOSUMDB GOPRIVATE GOFLAGS

# does the module resolve at all, bypassing the build?
go list -m -versions github.com/org/module

# verify the module cache against go.sum
go mod verify

# private modules must be excluded from proxy and sumdb
go env -w GOPRIVATE=github.com/yourorg/*

Common causes

A malformed GOFLAGS value

GOFLAGS must be a space-separated list of valid flags. A value like -mod readonly (space instead of =) or an unknown flag is rejected.

Using deprecated GONOSUMCHECK

Modern Go uses GONOSUMDB/GOPRIVATE to skip the checksum database. A leftover GONOSUMCHECK is ignored, so modules you meant to exempt still hit the sum DB.

How to fix it

Write GOFLAGS as valid flags

Each flag must use = for its value, separated by spaces.

export GOFLAGS="-mod=readonly -trimpath"
go build ./...

Replace GONOSUMCHECK with GONOSUMDB / GOPRIVATE

Use the supported variables to skip the sum database for trusted paths.

export GONOSUMDB=github.com/yourorg/*
# or, more broadly:
export GOPRIVATE=github.com/yourorg/*

Inspect the effective environment

go env GOFLAGS GONOSUMDB GOPRIVATE

How to prevent it

• Set GOFLAGS as a space-separated list of =-valued flags.
• Use GONOSUMDB/GOPRIVATE, not the deprecated GONOSUMCHECK.
• Verify env with go env so a bad value fails locally, not just in CI.

Frequently asked questions

Related guides

References

• Go documentation
• GitHub Actions documentation