Go "go mod verify" Failed - Detect Tampered Module Cache in CI

go mod verify recomputes the hash of every module in the cache and compares it to go.sum. A failure means a cached module on disk no longer matches its recorded checksum - usually a corrupted, edited, or improperly restored cache.

What this error means

go mod verify reports <module>: dir has been modified or a hash mismatch for one or more cached modules, instead of the expected all modules verified. The on-disk cache and go.sum disagree.

go output

github.com/example/lib@v1.4.0: dir has been modified
	(/home/runner/go/pkg/mod/github.com/example/lib@v1.4.0)

Common causes

A corrupted or partially restored cache

A cache restored from CI artifacts can be truncated or modified, so the files no longer hash to the recorded value.

The module cache was written to

The module cache is meant to be read-only. A process that edited files under pkg/mod (a generator, a test, a misbehaving tool) invalidates the verification.

How to fix it

Clear and re-download the cache

Wipe the module cache and fetch clean copies that will hash correctly.

Terminal

go clean -modcache
go mod download
go mod verify

Make the restored cache trustworthy

Cache ~/go/pkg/mod keyed on go.sum so restores match the exact modules.
Never write into the module cache during a build or test.
If a restore looks suspect, fall back to a fresh go mod download.

How to prevent it

Treat ~/go/pkg/mod as read-only; never modify cached files.
Key the module cache on a hash of go.sum.
Run go mod verify early so a bad cache fails fast.