From c830cfcf7f3a7eeeda6c5bd552e0ad0c7744e788 Mon Sep 17 00:00:00 2001
From: scttbnsn <80784472+scttbnsn@users.noreply.github.com>
Date: Thu, 27 Aug 2026 01:12:39 -0400
Subject: [PATCH] chore(renovate): tidy go.sum after a gomod update

Renovate writes the new go.sum hashes and leaves the superseded ones behind.
`go build` passes because go.sum only has to be sufficient, so the failure
surfaces later in the GoReleaser gate, whose `go mod tidy` before-hook removes
the stale lines and dirties the tree against a clean-tree assertion. Diagnosed
on sockguard #343 by that lane: a go-containerregistry 0.21.8 -> 0.21.9 bump
pulled a transitive golang.org/x/net 0.57 -> 0.58 and go.sum ended up carrying
all four versions.

Fixed in the shared preset rather than per-repo. sockguard and portwing are the
two Go consumers, both extend this file with no local postUpdateOptions, so
portwing would hit the identical failure on its next transitive bump.

Only gomodTidy. gomodUpdateImportPaths was suggested alongside it but addresses
major-version module path rewrites, which is a different problem with no
observed failure here, and it changes behaviour on every major bump across both
repos.
---
 .../tests/renovate_config_contract_test.py    | 33 +++++++++++++++++++
 renovate-config.json                          |  3 ++
 2 files changed, 36 insertions(+)
 create mode 100644 .github/tests/renovate_config_contract_test.py

diff --git a/.github/tests/renovate_config_contract_test.py b/.github/tests/renovate_config_contract_test.py
new file mode 100644
index 0000000..66dc2f8
--- /dev/null
+++ b/.github/tests/renovate_config_contract_test.py
@@ -0,0 +1,33 @@
+import json
+from pathlib import Path
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+class RenovateConfigContractTest(unittest.TestCase):
+    def read_config(self):
+        with (ROOT / "renovate-config.json").open() as config_file:
+            return json.load(config_file)
+
+    def test_gomod_updates_are_tidied(self):
+        """Renovate writes the new go.sum hashes and leaves the superseded
+        ones in place. `go build` tolerates that, because go.sum only has to
+        be sufficient — so the break lands later, in the GoReleaser gate,
+        whose `go mod tidy` removes the stale lines and dirties the tree
+        against a clean-tree assertion. Measured on sockguard #343, where a
+        go-containerregistry 0.21.8 to 0.21.9 bump pulled a transitive
+        golang.org/x/net 0.57 to 0.58 and go.sum ended up carrying all four.
+
+        Every Go repo in the org consumes this preset and none sets its own
+        `postUpdateOptions`, so removing this reintroduces the failure on
+        every future transitive bump, in a job that names neither Renovate
+        nor go.sum."""
+        config = self.read_config()
+
+        self.assertIn("gomodTidy", config.get("postUpdateOptions", []))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/renovate-config.json b/renovate-config.json
index 3033de7..1de927c 100644
--- a/renovate-config.json
+++ b/renovate-config.json
@@ -12,6 +12,9 @@
   "minimumReleaseAge": "14 days",
   "internalChecksFilter": "strict",
   "skipInstalls": false,
+  "postUpdateOptions": [
+    "gomodTidy"
+  ],
   "labels": [
     "dependencies"
   ],