Go "updates to go.sum needed" (GOFLAGS) - Fix in CI

go.sum must contain a checksum for every module the build uses. Under readonly mode Go will not add missing entries; it stops and points you at go mod download so the file is committed, not mutated in CI.

What this error means

A build fails with missing go.sum entry for module X; to add it: go mod download X. go.sum is incomplete and readonly mode forbids writing it.

missing go.sum entry for module example.com/lib; to add it:
	go mod download example.com/lib

Common causes

go.sum missing entries

A required module has no checksum line, so the build cannot verify it under readonly mode.

go.sum not committed after a bump

Dependencies changed but the updated go.sum was never committed.

How to fix it

Download and commit go.sum

1. Populate go.sum locally and commit it.

go mod download
git add go.sum

Allow writes deliberately if intended

1. If a job is meant to update modules, set GOFLAGS explicitly rather than relying on default.

env:
  GOFLAGS: -mod=mod

How to prevent it

• Commit go.sum whenever dependencies change.
• Keep -mod=readonly in build/test jobs to catch missing entries.
• Only use -mod=mod in jobs whose purpose is updating modules.

Related guides