🚲 Don't want to get too far into painting the bike shed but a name like -getmode=repeatable or -getmode=read-only might make it more clear what that means.

I'm completely fine with it trying to automatically satisfy dependencies by downloading them. I just want to make sure there's a mode that will only download the exact versions which are captured in the go.mod/go.sum files and doesn't do anything beyond that.

(My personal preference would be that go build would default to such a mode for repeatable builds, and warn you if you need to run some command to update the file. But I understand that's likely been discussed and decided elsewhere.)

We meant for -getmode=local to mean this, but it really means something a little bit different.

I'm not actually sure what it means at the moment (see #26370). But I agree that we probably do want separate modes for “use only modules that are available” and “don't modify my go.mod at all”.

I don't think noauto fits in as a -getmode flag.

Currently, GO111MODULE determines whether we use modules and -getmode determines how we fetch them.

In contrast, CI systems may or may not care about how we fetch modules. (For example, a CI system with a reliable connection to a GOPROXY should be happy to fetch the modules from it on demand.) The important property for CI testing is that the module configuration does not change, and to me that seems more like a GO111MODULE setting than a getmode.

So I would suggest instead a new GO111MODULE setting, GO111MODULE=readonly. That would mean “fetch the active modules according to -getmode, but do not adjust go.mod or resolve imports that it does not provide”.

Change https://golang.org/cl/126696 mentions this issue: cmd/go: replace -getmode with -mod, $GOPROXY